This patch augments nf_tables to support stateful objects. This new infrastructure allows you to create, dump and delete stateful objects, that are identified by a user-defined name. This patch adds the generic infrastructure, follow up patches add support for two stateful objects: counters and quotas. This patch provides a native infrastructure for nf_tables to replace nfacct, the extended accounting infrastructure for iptables.
Showing the changes to include/uapi/linux (1 of 3 files). Show all
Unified · Split
| @@ -4,6 +4,7 @@ · 3 unmodified lines | |||
| 4 | #define NFT_TABLE_MAXNAMELEN 32 | 4 | #define NFT_TABLE_MAXNAMELEN 32 |
| 5 | #define NFT_CHAIN_MAXNAMELEN 32 | 5 | #define NFT_CHAIN_MAXNAMELEN 32 |
| 6 | #define NFT_SET_MAXNAMELEN 32 | 6 | #define NFT_SET_MAXNAMELEN 32 |
| 7 | #define NFT_OBJ_MAXNAMELEN 32 | ||
| 7 | #define NFT_USERDATA_MAXLEN 256 | 8 | #define NFT_USERDATA_MAXLEN 256 |
| 8 | 9 | ||
| 9 | /** | 10 | /** |
| @@ -85,6 +86,9 @@ enum nft_verdicts { · 75 unmodified lines | |||
| 85 | * @NFT_MSG_NEWGEN: announce a new generation, only for events (enum nft_gen_attributes) | 86 | * @NFT_MSG_NEWGEN: announce a new generation, only for events (enum nft_gen_attributes) |
| 86 | * @NFT_MSG_GETGEN: get the rule-set generation (enum nft_gen_attributes) | 87 | * @NFT_MSG_GETGEN: get the rule-set generation (enum nft_gen_attributes) |
| 87 | * @NFT_MSG_TRACE: trace event (enum nft_trace_attributes) | 88 | * @NFT_MSG_TRACE: trace event (enum nft_trace_attributes) |
| 89 | * @NFT_MSG_NEWOBJ: create a stateful object (enum nft_obj_attributes) | ||
| 90 | * @NFT_MSG_GETOBJ: get a stateful object (enum nft_obj_attributes) | ||
| 91 | * @NFT_MSG_DELOBJ: delete a stateful object (enum nft_obj_attributes) | ||
| 88 | */ | 92 | */ |
| 89 | enum nf_tables_msg_types { | 93 | enum nf_tables_msg_types { |
| 90 | NFT_MSG_NEWTABLE, | 94 | NFT_MSG_NEWTABLE, |
| @@ -105,6 +109,9 @@ enum nf_tables_msg_types { · 14 unmodified lines | |||
| 105 | NFT_MSG_NEWGEN, | 109 | NFT_MSG_NEWGEN, |
| 106 | NFT_MSG_GETGEN, | 110 | NFT_MSG_GETGEN, |
| 107 | NFT_MSG_TRACE, | 111 | NFT_MSG_TRACE, |
| 112 | NFT_MSG_NEWOBJ, | ||
| 113 | NFT_MSG_GETOBJ, | ||
| 114 | NFT_MSG_DELOBJ, | ||
| 108 | NFT_MSG_MAX, | 115 | NFT_MSG_MAX, |
| 109 | }; | 116 | }; |
| 110 | 117 | ||
| @@ -1178,6 +1185,28 @@ enum nft_fib_flags { · 1067 unmodified lines | |||
| 1178 | NFTA_FIB_F_OIF = 1 << 4, /* restrict to oif */ | 1185 | NFTA_FIB_F_OIF = 1 << 4, /* restrict to oif */ |
| 1179 | }; | 1186 | }; |
| 1180 | 1187 | ||
| 1188 | #define NFT_OBJECT_UNSPEC 0 | ||
| 1189 | |||
| 1190 | /** | ||
| 1191 | * enum nft_object_attributes - nf_tables stateful object netlink attributes | ||
| 1192 | * | ||
| 1193 | * @NFTA_OBJ_TABLE: name of the table containing the expression (NLA_STRING) | ||
| 1194 | * @NFTA_OBJ_NAME: name of this expression type (NLA_STRING) | ||
| 1195 | * @NFTA_OBJ_TYPE: stateful object type (NLA_U32) | ||
| 1196 | * @NFTA_OBJ_DATA: stateful object data (NLA_NESTED) | ||
| 1197 | * @NFTA_OBJ_USE: number of references to this expression (NLA_U32) | ||
| 1198 | */ | ||
| 1199 | enum nft_object_attributes { | ||
| 1200 | NFTA_OBJ_UNSPEC, | ||
| 1201 | NFTA_OBJ_TABLE, | ||
| 1202 | NFTA_OBJ_NAME, | ||
| 1203 | NFTA_OBJ_TYPE, | ||
| 1204 | NFTA_OBJ_DATA, | ||
| 1205 | NFTA_OBJ_USE, | ||
| 1206 | __NFTA_OBJ_MAX | ||
| 1207 | }; | ||
| 1208 | #define NFTA_OBJ_MAX (__NFTA_OBJ_MAX - 1) | ||
| 1209 | |||
| 1181 | /** | 1210 | /** |
| 1182 | * enum nft_trace_attributes - nf_tables trace netlink attributes | 1211 | * enum nft_trace_attributes - nf_tables trace netlink attributes |
| 1183 | * | 1212 | * |