libnftnl 1.2.8
dynset.c
1/*
2 * Copyright (c) 2014, 2015 Patrick McHardy <kaber@trash.net>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published
6 * by the Free Software Foundation; either version 2 of the License, or
7 * (at your option) any later version.
8 */
9
10#include "internal.h"
11
12#include <stdio.h>
13#include <stdint.h>
14#include <inttypes.h>
15#include <errno.h>
16#include <arpa/inet.h>
17#include <libmnl/libmnl.h>
18#include <linux/netfilter/nf_tables.h>
19#include <libnftnl/rule.h>
20#include <libnftnl/expr.h>
21#include "data_reg.h"
22#include "expr_ops.h"
23
25 enum nft_registers sreg_key;
26 enum nft_registers sreg_data;
27 enum nft_dynset_ops op;
28 uint64_t timeout;
29 struct list_head expr_list;
30 char *set_name;
31 uint32_t set_id;
32 uint32_t dynset_flags;
33};
34
35static int
36nftnl_expr_dynset_set(struct nftnl_expr *e, uint16_t type,
37 const void *data, uint32_t data_len)
38{
39 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
40 struct nftnl_expr *expr, *next;
41
42 switch (type) {
43 case NFTNL_EXPR_DYNSET_SREG_KEY:
44 memcpy(&dynset->sreg_key, data, data_len);
45 break;
46 case NFTNL_EXPR_DYNSET_SREG_DATA:
47 memcpy(&dynset->sreg_data, data, data_len);
48 break;
49 case NFTNL_EXPR_DYNSET_OP:
50 memcpy(&dynset->op, data, data_len);
51 break;
52 case NFTNL_EXPR_DYNSET_TIMEOUT:
53 memcpy(&dynset->timeout, data, data_len);
54 break;
55 case NFTNL_EXPR_DYNSET_SET_NAME:
56 dynset->set_name = strdup((const char *)data);
57 if (!dynset->set_name)
58 return -1;
59 break;
60 case NFTNL_EXPR_DYNSET_SET_ID:
61 memcpy(&dynset->set_id, data, data_len);
62 break;
63 case NFTNL_EXPR_DYNSET_EXPR:
64 list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
65 nftnl_expr_free(expr);
66
67 expr = (void *)data;
68 list_add(&expr->head, &dynset->expr_list);
69 break;
70 case NFTNL_EXPR_DYNSET_FLAGS:
71 memcpy(&dynset->dynset_flags, data, data_len);
72 break;
73 default:
74 return -1;
75 }
76 return 0;
77}
78
79static const void *
80nftnl_expr_dynset_get(const struct nftnl_expr *e, uint16_t type,
81 uint32_t *data_len)
82{
83 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
84 struct nftnl_expr *expr;
85
86 switch (type) {
87 case NFTNL_EXPR_DYNSET_SREG_KEY:
88 *data_len = sizeof(dynset->sreg_key);
89 return &dynset->sreg_key;
90 case NFTNL_EXPR_DYNSET_SREG_DATA:
91 *data_len = sizeof(dynset->sreg_data);
92 return &dynset->sreg_data;
93 case NFTNL_EXPR_DYNSET_OP:
94 *data_len = sizeof(dynset->op);
95 return &dynset->op;
96 case NFTNL_EXPR_DYNSET_TIMEOUT:
97 *data_len = sizeof(dynset->timeout);
98 return &dynset->timeout;
99 case NFTNL_EXPR_DYNSET_SET_NAME:
100 *data_len = strlen(dynset->set_name) + 1;
101 return dynset->set_name;
102 case NFTNL_EXPR_DYNSET_SET_ID:
103 *data_len = sizeof(dynset->set_id);
104 return &dynset->set_id;
105 case NFTNL_EXPR_DYNSET_EXPR:
106 list_for_each_entry(expr, &dynset->expr_list, head)
107 break;
108 return expr;
109 case NFTNL_EXPR_DYNSET_FLAGS:
110 *data_len = sizeof(dynset->dynset_flags);
111 return &dynset->dynset_flags;
112 }
113 return NULL;
114}
115
116static int nftnl_expr_dynset_cb(const struct nlattr *attr, void *data)
117{
118 const struct nlattr **tb = data;
119 int type = mnl_attr_get_type(attr);
120
121 if (mnl_attr_type_valid(attr, NFTA_DYNSET_MAX) < 0)
122 return MNL_CB_OK;
123
124 switch (type) {
125 case NFTA_DYNSET_SREG_KEY:
126 case NFTA_DYNSET_SREG_DATA:
127 case NFTA_DYNSET_SET_ID:
128 case NFTA_DYNSET_OP:
129 case NFTA_DYNSET_FLAGS:
130 if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
131 abi_breakage();
132 break;
133 case NFTA_DYNSET_TIMEOUT:
134 if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
135 abi_breakage();
136 break;
137 case NFTA_DYNSET_SET_NAME:
138 if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
139 abi_breakage();
140 break;
141 case NFTA_DYNSET_EXPR:
142 case NFTA_DYNSET_EXPRESSIONS:
143 if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
144 abi_breakage();
145 break;
146 }
147
148 tb[type] = attr;
149 return MNL_CB_OK;
150}
151
152static void
153nftnl_expr_dynset_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
154{
155 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
156 struct nlattr *nest;
157 int num_exprs = 0;
158
159 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_KEY))
160 mnl_attr_put_u32(nlh, NFTA_DYNSET_SREG_KEY, htonl(dynset->sreg_key));
161 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_DATA))
162 mnl_attr_put_u32(nlh, NFTA_DYNSET_SREG_DATA, htonl(dynset->sreg_data));
163 if (e->flags & (1 << NFTNL_EXPR_DYNSET_OP))
164 mnl_attr_put_u32(nlh, NFTA_DYNSET_OP, htonl(dynset->op));
165 if (e->flags & (1 << NFTNL_EXPR_DYNSET_TIMEOUT))
166 mnl_attr_put_u64(nlh, NFTA_DYNSET_TIMEOUT, htobe64(dynset->timeout));
167 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SET_NAME))
168 mnl_attr_put_strz(nlh, NFTA_DYNSET_SET_NAME, dynset->set_name);
169 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SET_ID))
170 mnl_attr_put_u32(nlh, NFTA_DYNSET_SET_ID, htonl(dynset->set_id));
171 if (!list_empty(&dynset->expr_list)) {
172 struct nftnl_expr *expr;
173
174 list_for_each_entry(expr, &dynset->expr_list, head)
175 num_exprs++;
176
177 if (num_exprs == 1) {
178 nest = mnl_attr_nest_start(nlh, NFTA_DYNSET_EXPR);
179 list_for_each_entry(expr, &dynset->expr_list, head)
180 nftnl_expr_build_payload(nlh, expr);
181 mnl_attr_nest_end(nlh, nest);
182 } else if (num_exprs > 1) {
183 struct nlattr *nest1, *nest2;
184
185 nest1 = mnl_attr_nest_start(nlh, NFTA_DYNSET_EXPRESSIONS);
186 list_for_each_entry(expr, &dynset->expr_list, head) {
187 nest2 = mnl_attr_nest_start(nlh, NFTA_LIST_ELEM);
188 nftnl_expr_build_payload(nlh, expr);
189 mnl_attr_nest_end(nlh, nest2);
190 }
191 mnl_attr_nest_end(nlh, nest1);
192 }
193 }
194 if (e->flags & (1 << NFTNL_EXPR_DYNSET_FLAGS))
195 mnl_attr_put_u32(nlh, NFTA_DYNSET_FLAGS,
196 htonl(dynset->dynset_flags));
197}
198
199EXPORT_SYMBOL(nftnl_expr_add_expr);
200void nftnl_expr_add_expr(struct nftnl_expr *e, uint32_t type,
201 struct nftnl_expr *expr)
202{
203 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
204
205 list_add_tail(&expr->head, &dynset->expr_list);
206}
207
208EXPORT_SYMBOL(nftnl_expr_expr_foreach);
209int nftnl_expr_expr_foreach(const struct nftnl_expr *e,
210 int (*cb)(struct nftnl_expr *e, void *data),
211 void *data)
212{
213 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
214 struct nftnl_expr *cur, *tmp;
215 int ret;
216
217 list_for_each_entry_safe(cur, tmp, &dynset->expr_list, head) {
218 ret = cb(cur, data);
219 if (ret < 0)
220 return ret;
221 }
222 return 0;
223}
224
225static int
226nftnl_expr_dynset_parse(struct nftnl_expr *e, struct nlattr *attr)
227{
228 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
229 struct nlattr *tb[NFTA_DYNSET_MAX+1] = {};
230 struct nftnl_expr *expr, *next;
231 int ret = 0;
232
233 if (mnl_attr_parse_nested(attr, nftnl_expr_dynset_cb, tb) < 0)
234 return -1;
235
236 if (tb[NFTA_DYNSET_SREG_KEY]) {
237 dynset->sreg_key = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SREG_KEY]));
238 e->flags |= (1 << NFTNL_EXPR_DYNSET_SREG_KEY);
239 }
240 if (tb[NFTA_DYNSET_SREG_DATA]) {
241 dynset->sreg_data = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SREG_DATA]));
242 e->flags |= (1 << NFTNL_EXPR_DYNSET_SREG_DATA);
243 }
244 if (tb[NFTA_DYNSET_OP]) {
245 dynset->op = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_OP]));
246 e->flags |= (1 << NFTNL_EXPR_DYNSET_OP);
247 }
248 if (tb[NFTA_DYNSET_TIMEOUT]) {
249 dynset->timeout = be64toh(mnl_attr_get_u64(tb[NFTA_DYNSET_TIMEOUT]));
250 e->flags |= (1 << NFTNL_EXPR_DYNSET_TIMEOUT);
251 }
252 if (tb[NFTA_DYNSET_SET_NAME]) {
253 dynset->set_name =
254 strdup(mnl_attr_get_str(tb[NFTA_DYNSET_SET_NAME]));
255 if (!dynset->set_name)
256 return -1;
257 e->flags |= (1 << NFTNL_EXPR_DYNSET_SET_NAME);
258 }
259 if (tb[NFTA_DYNSET_SET_ID]) {
260 dynset->set_id = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SET_ID]));
261 e->flags |= (1 << NFTNL_EXPR_DYNSET_SET_ID);
262 }
263 if (tb[NFTA_DYNSET_EXPR]) {
264 expr = nftnl_expr_parse(tb[NFTA_DYNSET_EXPR]);
265 if (expr == NULL)
266 return -1;
267
268 list_add(&expr->head, &dynset->expr_list);
269 e->flags |= (1 << NFTNL_EXPR_DYNSET_EXPR);
270 } else if (tb[NFTA_DYNSET_EXPRESSIONS]) {
271 struct nlattr *attr2;
272
273 mnl_attr_for_each_nested(attr2, tb[NFTA_DYNSET_EXPRESSIONS]) {
274 if (mnl_attr_get_type(attr2) != NFTA_LIST_ELEM)
275 goto out_dynset_expr;
276
277 expr = nftnl_expr_parse(attr2);
278 if (!expr)
279 goto out_dynset_expr;
280
281 list_add_tail(&expr->head, &dynset->expr_list);
282 }
283 e->flags |= (1 << NFTNL_EXPR_DYNSET_EXPRESSIONS);
284 }
285 if (tb[NFTA_DYNSET_FLAGS]) {
286 dynset->dynset_flags = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_FLAGS]));
287 e->flags |= (1 << NFTNL_EXPR_DYNSET_FLAGS);
288 }
289
290 return ret;
291out_dynset_expr:
292 list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
293 nftnl_expr_free(expr);
294
295 return -1;
296}
297
298static const char *op2str_array[] = {
299 [NFT_DYNSET_OP_ADD] = "add",
300 [NFT_DYNSET_OP_UPDATE] = "update",
301 [NFT_DYNSET_OP_DELETE] = "delete",
302};
303
304static const char *op2str(enum nft_dynset_ops op)
305{
306 if (op > NFT_DYNSET_OP_DELETE)
307 return "unknown";
308 return op2str_array[op];
309}
310
311static int
312nftnl_expr_dynset_snprintf(char *buf, size_t remain,
313 uint32_t flags, const struct nftnl_expr *e)
314{
315 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
316 struct nftnl_expr *expr;
317 int offset = 0, ret;
318
319 ret = snprintf(buf, remain, "%s reg_key %u set %s ",
320 op2str(dynset->op), dynset->sreg_key, dynset->set_name);
321 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
322
323 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_DATA)) {
324 ret = snprintf(buf + offset, remain, "sreg_data %u ",
325 dynset->sreg_data);
326 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
327 }
328 if (e->flags & (1 << NFTNL_EXPR_DYNSET_TIMEOUT)) {
329 ret = snprintf(buf + offset, remain, "timeout %"PRIu64"ms ",
330 dynset->timeout);
331 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
332 }
333 list_for_each_entry(expr, &dynset->expr_list, head) {
334 ret = snprintf(buf + offset, remain, "expr [ %s ",
335 expr->ops->name);
336 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
337
338 ret = nftnl_expr_snprintf(buf + offset, remain, expr,
339 NFTNL_OUTPUT_DEFAULT,
340 NFTNL_OF_EVENT_ANY);
341 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
342
343 ret = snprintf(buf + offset, remain, "] ");
344 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
345 }
346
347 return offset;
348}
349
350static void nftnl_expr_dynset_init(const struct nftnl_expr *e)
351{
352 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
353
354 INIT_LIST_HEAD(&dynset->expr_list);
355}
356
357static void nftnl_expr_dynset_free(const struct nftnl_expr *e)
358{
359 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
360 struct nftnl_expr *expr, *next;
361
362 xfree(dynset->set_name);
363 list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
364 nftnl_expr_free(expr);
365}
366
367static struct attr_policy dynset_attr_policy[__NFTNL_EXPR_DYNSET_MAX] = {
368 [NFTNL_EXPR_DYNSET_SREG_KEY] = { .maxlen = sizeof(uint32_t) },
369 [NFTNL_EXPR_DYNSET_SREG_DATA] = { .maxlen = sizeof(uint32_t) },
370 [NFTNL_EXPR_DYNSET_OP] = { .maxlen = sizeof(uint32_t) },
371 [NFTNL_EXPR_DYNSET_TIMEOUT] = { .maxlen = sizeof(uint64_t) },
372 [NFTNL_EXPR_DYNSET_SET_NAME] = { .maxlen = NFT_SET_MAXNAMELEN },
373 [NFTNL_EXPR_DYNSET_SET_ID] = { .maxlen = sizeof(uint32_t) },
374 [NFTNL_EXPR_DYNSET_EXPR] = { .maxlen = 0 },
375 [NFTNL_EXPR_DYNSET_EXPRESSIONS] = { .maxlen = 0 },
376 [NFTNL_EXPR_DYNSET_FLAGS] = { .maxlen = sizeof(uint32_t) },
377};
378
379struct expr_ops expr_ops_dynset = {
380 .name = "dynset",
381 .alloc_len = sizeof(struct nftnl_expr_dynset),
382 .nftnl_max_attr = __NFTNL_EXPR_DYNSET_MAX - 1,
383 .attr_policy = dynset_attr_policy,
384 .init = nftnl_expr_dynset_init,
385 .free = nftnl_expr_dynset_free,
386 .set = nftnl_expr_dynset_set,
387 .get = nftnl_expr_dynset_get,
388 .parse = nftnl_expr_dynset_parse,
389 .build = nftnl_expr_dynset_build,
390 .output = nftnl_expr_dynset_snprintf,
391};