This patch augments nf_tables to support stateful objects. This new infrastructure allows you to create, dump and delete stateful objects, that are identified by a user-defined name. This patch adds the generic infrastructure, follow up patches add support for two stateful objects: counters and quotas. This patch provides a native infrastructure for nf_tables to replace nfacct, the extended accounting infrastructure for iptables.
Showing the changes to include/uapi/linux (1 of 3 files). Show all
Unified · Split
| @@ -4,6 +4,7 @@ · 3 unmodified lines | ||
| 4 | 4 | #define NFT_TABLE_MAXNAMELEN 32 |
| 5 | 5 | #define NFT_CHAIN_MAXNAMELEN 32 |
| 6 | 6 | #define NFT_SET_MAXNAMELEN 32 |
| 7 | +#define NFT_OBJ_MAXNAMELEN 32 | |
| 7 | 8 | #define NFT_USERDATA_MAXLEN 256 |
| 8 | 9 | |
| 9 | 10 | /** |
| @@ -85,6 +86,9 @@ enum nft_verdicts { · 75 unmodified lines | ||
| 85 | 86 | * @NFT_MSG_NEWGEN: announce a new generation, only for events (enum nft_gen_attributes) |
| 86 | 87 | * @NFT_MSG_GETGEN: get the rule-set generation (enum nft_gen_attributes) |
| 87 | 88 | * @NFT_MSG_TRACE: trace event (enum nft_trace_attributes) |
| 89 | + * @NFT_MSG_NEWOBJ: create a stateful object (enum nft_obj_attributes) | |
| 90 | + * @NFT_MSG_GETOBJ: get a stateful object (enum nft_obj_attributes) | |
| 91 | + * @NFT_MSG_DELOBJ: delete a stateful object (enum nft_obj_attributes) | |
| 88 | 92 | */ |
| 89 | 93 | enum nf_tables_msg_types { |
| 90 | 94 | NFT_MSG_NEWTABLE, |
| @@ -105,6 +109,9 @@ enum nf_tables_msg_types { · 14 unmodified lines | ||
| 105 | 109 | NFT_MSG_NEWGEN, |
| 106 | 110 | NFT_MSG_GETGEN, |
| 107 | 111 | NFT_MSG_TRACE, |
| 112 | + NFT_MSG_NEWOBJ, | |
| 113 | + NFT_MSG_GETOBJ, | |
| 114 | + NFT_MSG_DELOBJ, | |
| 108 | 115 | NFT_MSG_MAX, |
| 109 | 116 | }; |
| 110 | 117 | |
| @@ -1178,6 +1185,28 @@ enum nft_fib_flags { · 1067 unmodified lines | ||
| 1178 | 1185 | NFTA_FIB_F_OIF = 1 << 4, /* restrict to oif */ |
| 1179 | 1186 | }; |
| 1180 | 1187 | |
| 1188 | +#define NFT_OBJECT_UNSPEC 0 | |
| 1189 | + | |
| 1190 | +/** | |
| 1191 | + * enum nft_object_attributes - nf_tables stateful object netlink attributes | |
| 1192 | + * | |
| 1193 | + * @NFTA_OBJ_TABLE: name of the table containing the expression (NLA_STRING) | |
| 1194 | + * @NFTA_OBJ_NAME: name of this expression type (NLA_STRING) | |
| 1195 | + * @NFTA_OBJ_TYPE: stateful object type (NLA_U32) | |
| 1196 | + * @NFTA_OBJ_DATA: stateful object data (NLA_NESTED) | |
| 1197 | + * @NFTA_OBJ_USE: number of references to this expression (NLA_U32) | |
| 1198 | + */ | |
| 1199 | +enum nft_object_attributes { | |
| 1200 | + NFTA_OBJ_UNSPEC, | |
| 1201 | + NFTA_OBJ_TABLE, | |
| 1202 | + NFTA_OBJ_NAME, | |
| 1203 | + NFTA_OBJ_TYPE, | |
| 1204 | + NFTA_OBJ_DATA, | |
| 1205 | + NFTA_OBJ_USE, | |
| 1206 | + __NFTA_OBJ_MAX | |
| 1207 | +}; | |
| 1208 | +#define NFTA_OBJ_MAX (__NFTA_OBJ_MAX - 1) | |
| 1209 | + | |
| 1181 | 1210 | /** |
| 1182 | 1211 | * enum nft_trace_attributes - nf_tables trace netlink attributes |
| 1183 | 1212 | * |