libnftnl  1.1.2
rule.c
1 /*
2  * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License as published
6  * by the Free Software Foundation; either version 2 of the License, or
7  * (at your option) any later version.
8  *
9  * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
10  */
11 #include "internal.h"
12 
13 #include <time.h>
14 #include <endian.h>
15 #include <stdint.h>
16 #include <stdlib.h>
17 #include <limits.h>
18 #include <string.h>
19 #include <netinet/in.h>
20 #include <errno.h>
21 #include <inttypes.h>
22 #include <ctype.h>
23 #include <buffer.h>
24 
25 #include <libmnl/libmnl.h>
26 #include <linux/netfilter/nfnetlink.h>
27 #include <linux/netfilter/nf_tables.h>
28 
29 #include <libnftnl/rule.h>
30 #include <libnftnl/set.h>
31 #include <libnftnl/expr.h>
32 
33 struct nftnl_rule {
34  struct list_head head;
35 
36  uint32_t flags;
37  uint32_t family;
38  const char *table;
39  const char *chain;
40  uint64_t handle;
41  uint64_t position;
42  uint32_t id;
43  struct {
44  void *data;
45  uint32_t len;
46  } user;
47  struct {
48  uint32_t flags;
49  uint32_t proto;
50  } compat;
51 
52  struct list_head expr_list;
53 };
54 
55 EXPORT_SYMBOL(nftnl_rule_alloc);
56 struct nftnl_rule *nftnl_rule_alloc(void)
57 {
58  struct nftnl_rule *r;
59 
60  r = calloc(1, sizeof(struct nftnl_rule));
61  if (r == NULL)
62  return NULL;
63 
64  INIT_LIST_HEAD(&r->expr_list);
65 
66  return r;
67 }
68 
69 EXPORT_SYMBOL(nftnl_rule_free);
70 void nftnl_rule_free(const struct nftnl_rule *r)
71 {
72  struct nftnl_expr *e, *tmp;
73 
74  list_for_each_entry_safe(e, tmp, &r->expr_list, head)
75  nftnl_expr_free(e);
76 
77  if (r->flags & (1 << (NFTNL_RULE_TABLE)))
78  xfree(r->table);
79  if (r->flags & (1 << (NFTNL_RULE_CHAIN)))
80  xfree(r->chain);
81  if (r->flags & (1 << (NFTNL_RULE_USERDATA)))
82  xfree(r->user.data);
83 
84  xfree(r);
85 }
86 
87 EXPORT_SYMBOL(nftnl_rule_is_set);
88 bool nftnl_rule_is_set(const struct nftnl_rule *r, uint16_t attr)
89 {
90  return r->flags & (1 << attr);
91 }
92 
93 EXPORT_SYMBOL(nftnl_rule_unset);
94 void nftnl_rule_unset(struct nftnl_rule *r, uint16_t attr)
95 {
96  if (!(r->flags & (1 << attr)))
97  return;
98 
99  switch (attr) {
100  case NFTNL_RULE_TABLE:
101  xfree(r->table);
102  break;
103  case NFTNL_RULE_CHAIN:
104  xfree(r->chain);
105  break;
106  case NFTNL_RULE_HANDLE:
107  case NFTNL_RULE_COMPAT_PROTO:
108  case NFTNL_RULE_COMPAT_FLAGS:
109  case NFTNL_RULE_POSITION:
110  case NFTNL_RULE_FAMILY:
111  case NFTNL_RULE_ID:
112  break;
113  case NFTNL_RULE_USERDATA:
114  xfree(r->user.data);
115  break;
116  }
117 
118  r->flags &= ~(1 << attr);
119 }
120 
121 static uint32_t nftnl_rule_validate[NFTNL_RULE_MAX + 1] = {
122  [NFTNL_RULE_HANDLE] = sizeof(uint64_t),
123  [NFTNL_RULE_COMPAT_PROTO] = sizeof(uint32_t),
124  [NFTNL_RULE_COMPAT_FLAGS] = sizeof(uint32_t),
125  [NFTNL_RULE_FAMILY] = sizeof(uint32_t),
126  [NFTNL_RULE_POSITION] = sizeof(uint64_t),
127  [NFTNL_RULE_ID] = sizeof(uint32_t),
128 };
129 
130 EXPORT_SYMBOL(nftnl_rule_set_data);
131 int nftnl_rule_set_data(struct nftnl_rule *r, uint16_t attr,
132  const void *data, uint32_t data_len)
133 {
134  nftnl_assert_attr_exists(attr, NFTNL_RULE_MAX);
135  nftnl_assert_validate(data, nftnl_rule_validate, attr, data_len);
136 
137  switch(attr) {
138  case NFTNL_RULE_TABLE:
139  if (r->flags & (1 << NFTNL_RULE_TABLE))
140  xfree(r->table);
141 
142  r->table = strdup(data);
143  if (!r->table)
144  return -1;
145  break;
146  case NFTNL_RULE_CHAIN:
147  if (r->flags & (1 << NFTNL_RULE_CHAIN))
148  xfree(r->chain);
149 
150  r->chain = strdup(data);
151  if (!r->chain)
152  return -1;
153  break;
154  case NFTNL_RULE_HANDLE:
155  memcpy(&r->handle, data, sizeof(r->handle));
156  break;
157  case NFTNL_RULE_COMPAT_PROTO:
158  memcpy(&r->compat.proto, data, sizeof(r->compat.proto));
159  break;
160  case NFTNL_RULE_COMPAT_FLAGS:
161  memcpy(&r->compat.flags, data, sizeof(r->compat.flags));
162  break;
163  case NFTNL_RULE_FAMILY:
164  memcpy(&r->family, data, sizeof(r->family));
165  break;
166  case NFTNL_RULE_POSITION:
167  memcpy(&r->position, data, sizeof(r->position));
168  break;
169  case NFTNL_RULE_USERDATA:
170  if (r->flags & (1 << NFTNL_RULE_USERDATA))
171  xfree(r->user.data);
172 
173  r->user.data = malloc(data_len);
174  if (!r->user.data)
175  return -1;
176 
177  memcpy(r->user.data, data, data_len);
178  r->user.len = data_len;
179  break;
180  case NFTNL_RULE_ID:
181  memcpy(&r->id, data, sizeof(r->id));
182  break;
183  }
184  r->flags |= (1 << attr);
185  return 0;
186 }
187 
188 EXPORT_SYMBOL(nftnl_rule_set);
189 int nftnl_rule_set(struct nftnl_rule *r, uint16_t attr, const void *data)
190 {
191  return nftnl_rule_set_data(r, attr, data, nftnl_rule_validate[attr]);
192 }
193 
194 EXPORT_SYMBOL(nftnl_rule_set_u32);
195 void nftnl_rule_set_u32(struct nftnl_rule *r, uint16_t attr, uint32_t val)
196 {
197  nftnl_rule_set_data(r, attr, &val, sizeof(uint32_t));
198 }
199 
200 EXPORT_SYMBOL(nftnl_rule_set_u64);
201 void nftnl_rule_set_u64(struct nftnl_rule *r, uint16_t attr, uint64_t val)
202 {
203  nftnl_rule_set_data(r, attr, &val, sizeof(uint64_t));
204 }
205 
206 EXPORT_SYMBOL(nftnl_rule_set_str);
207 int nftnl_rule_set_str(struct nftnl_rule *r, uint16_t attr, const char *str)
208 {
209  return nftnl_rule_set_data(r, attr, str, strlen(str) + 1);
210 }
211 
212 EXPORT_SYMBOL(nftnl_rule_get_data);
213 const void *nftnl_rule_get_data(const struct nftnl_rule *r, uint16_t attr,
214  uint32_t *data_len)
215 {
216  if (!(r->flags & (1 << attr)))
217  return NULL;
218 
219  switch(attr) {
220  case NFTNL_RULE_FAMILY:
221  *data_len = sizeof(uint32_t);
222  return &r->family;
223  case NFTNL_RULE_TABLE:
224  *data_len = strlen(r->table) + 1;
225  return r->table;
226  case NFTNL_RULE_CHAIN:
227  *data_len = strlen(r->chain) + 1;
228  return r->chain;
229  case NFTNL_RULE_HANDLE:
230  *data_len = sizeof(uint64_t);
231  return &r->handle;
232  case NFTNL_RULE_COMPAT_PROTO:
233  *data_len = sizeof(uint32_t);
234  return &r->compat.proto;
235  case NFTNL_RULE_COMPAT_FLAGS:
236  *data_len = sizeof(uint32_t);
237  return &r->compat.flags;
238  case NFTNL_RULE_POSITION:
239  *data_len = sizeof(uint64_t);
240  return &r->position;
241  case NFTNL_RULE_USERDATA:
242  *data_len = r->user.len;
243  return r->user.data;
244  case NFTNL_RULE_ID:
245  *data_len = sizeof(uint32_t);
246  return &r->id;
247  }
248  return NULL;
249 }
250 
251 EXPORT_SYMBOL(nftnl_rule_get);
252 const void *nftnl_rule_get(const struct nftnl_rule *r, uint16_t attr)
253 {
254  uint32_t data_len;
255  return nftnl_rule_get_data(r, attr, &data_len);
256 }
257 
258 EXPORT_SYMBOL(nftnl_rule_get_str);
259 const char *nftnl_rule_get_str(const struct nftnl_rule *r, uint16_t attr)
260 {
261  return nftnl_rule_get(r, attr);
262 }
263 
264 EXPORT_SYMBOL(nftnl_rule_get_u32);
265 uint32_t nftnl_rule_get_u32(const struct nftnl_rule *r, uint16_t attr)
266 {
267  uint32_t data_len;
268  const uint32_t *val = nftnl_rule_get_data(r, attr, &data_len);
269 
270  nftnl_assert(val, attr, data_len == sizeof(uint32_t));
271 
272  return val ? *val : 0;
273 }
274 
275 EXPORT_SYMBOL(nftnl_rule_get_u64);
276 uint64_t nftnl_rule_get_u64(const struct nftnl_rule *r, uint16_t attr)
277 {
278  uint32_t data_len;
279  const uint64_t *val = nftnl_rule_get_data(r, attr, &data_len);
280 
281  nftnl_assert(val, attr, data_len == sizeof(uint64_t));
282 
283  return val ? *val : 0;
284 }
285 
286 EXPORT_SYMBOL(nftnl_rule_get_u8);
287 uint8_t nftnl_rule_get_u8(const struct nftnl_rule *r, uint16_t attr)
288 {
289  uint32_t data_len;
290  const uint8_t *val = nftnl_rule_get_data(r, attr, &data_len);
291 
292  nftnl_assert(val, attr, data_len == sizeof(uint8_t));
293 
294  return val ? *val : 0;
295 }
296 
297 EXPORT_SYMBOL(nftnl_rule_nlmsg_build_payload);
298 void nftnl_rule_nlmsg_build_payload(struct nlmsghdr *nlh, struct nftnl_rule *r)
299 {
300  struct nftnl_expr *expr;
301  struct nlattr *nest, *nest2;
302 
303  if (r->flags & (1 << NFTNL_RULE_TABLE))
304  mnl_attr_put_strz(nlh, NFTA_RULE_TABLE, r->table);
305  if (r->flags & (1 << NFTNL_RULE_CHAIN))
306  mnl_attr_put_strz(nlh, NFTA_RULE_CHAIN, r->chain);
307  if (r->flags & (1 << NFTNL_RULE_HANDLE))
308  mnl_attr_put_u64(nlh, NFTA_RULE_HANDLE, htobe64(r->handle));
309  if (r->flags & (1 << NFTNL_RULE_POSITION))
310  mnl_attr_put_u64(nlh, NFTA_RULE_POSITION, htobe64(r->position));
311  if (r->flags & (1 << NFTNL_RULE_USERDATA)) {
312  mnl_attr_put(nlh, NFTA_RULE_USERDATA, r->user.len,
313  r->user.data);
314  }
315 
316  if (!list_empty(&r->expr_list)) {
317  nest = mnl_attr_nest_start(nlh, NFTA_RULE_EXPRESSIONS);
318  list_for_each_entry(expr, &r->expr_list, head) {
319  nest2 = mnl_attr_nest_start(nlh, NFTA_LIST_ELEM);
320  nftnl_expr_build_payload(nlh, expr);
321  mnl_attr_nest_end(nlh, nest2);
322  }
323  mnl_attr_nest_end(nlh, nest);
324  }
325 
326  if (r->flags & (1 << NFTNL_RULE_COMPAT_PROTO) &&
327  r->flags & (1 << NFTNL_RULE_COMPAT_FLAGS)) {
328 
329  nest = mnl_attr_nest_start(nlh, NFTA_RULE_COMPAT);
330  mnl_attr_put_u32(nlh, NFTA_RULE_COMPAT_PROTO,
331  htonl(r->compat.proto));
332  mnl_attr_put_u32(nlh, NFTA_RULE_COMPAT_FLAGS,
333  htonl(r->compat.flags));
334  mnl_attr_nest_end(nlh, nest);
335  }
336  if (r->flags & (1 << NFTNL_RULE_ID))
337  mnl_attr_put_u32(nlh, NFTA_RULE_ID, htonl(r->id));
338 }
339 
340 EXPORT_SYMBOL(nftnl_rule_add_expr);
341 void nftnl_rule_add_expr(struct nftnl_rule *r, struct nftnl_expr *expr)
342 {
343  list_add_tail(&expr->head, &r->expr_list);
344 }
345 
346 static int nftnl_rule_parse_attr_cb(const struct nlattr *attr, void *data)
347 {
348  const struct nlattr **tb = data;
349  int type = mnl_attr_get_type(attr);
350 
351  if (mnl_attr_type_valid(attr, NFTA_RULE_MAX) < 0)
352  return MNL_CB_OK;
353 
354  switch(type) {
355  case NFTA_RULE_TABLE:
356  case NFTA_RULE_CHAIN:
357  if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
358  abi_breakage();
359  break;
360  case NFTA_RULE_HANDLE:
361  if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
362  abi_breakage();
363  break;
364  case NFTA_RULE_COMPAT:
365  if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
366  abi_breakage();
367  break;
368  case NFTA_RULE_POSITION:
369  if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
370  abi_breakage();
371  break;
372  case NFTA_RULE_USERDATA:
373  if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0)
374  abi_breakage();
375  break;
376  case NFTA_RULE_ID:
377  if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
378  abi_breakage();
379  break;
380  }
381 
382  tb[type] = attr;
383  return MNL_CB_OK;
384 }
385 
386 static int nftnl_rule_parse_expr(struct nlattr *nest, struct nftnl_rule *r)
387 {
388  struct nftnl_expr *expr;
389  struct nlattr *attr;
390 
391  mnl_attr_for_each_nested(attr, nest) {
392  if (mnl_attr_get_type(attr) != NFTA_LIST_ELEM)
393  return -1;
394 
395  expr = nftnl_expr_parse(attr);
396  if (expr == NULL)
397  return -1;
398 
399  list_add_tail(&expr->head, &r->expr_list);
400  }
401  return 0;
402 }
403 
404 static int nftnl_rule_parse_compat_cb(const struct nlattr *attr, void *data)
405 {
406  const struct nlattr **tb = data;
407  int type = mnl_attr_get_type(attr);
408 
409  if (mnl_attr_type_valid(attr, NFTA_RULE_COMPAT_MAX) < 0)
410  return MNL_CB_OK;
411 
412  switch(type) {
413  case NFTA_RULE_COMPAT_PROTO:
414  case NFTA_RULE_COMPAT_FLAGS:
415  if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
416  abi_breakage();
417  break;
418  }
419 
420  tb[type] = attr;
421  return MNL_CB_OK;
422 }
423 
424 static int nftnl_rule_parse_compat(struct nlattr *nest, struct nftnl_rule *r)
425 {
426  struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1] = {};
427 
428  if (mnl_attr_parse_nested(nest, nftnl_rule_parse_compat_cb, tb) < 0)
429  return -1;
430 
431  if (tb[NFTA_RULE_COMPAT_PROTO]) {
432  r->compat.proto =
433  ntohl(mnl_attr_get_u32(tb[NFTA_RULE_COMPAT_PROTO]));
434  r->flags |= (1 << NFTNL_RULE_COMPAT_PROTO);
435  }
436  if (tb[NFTA_RULE_COMPAT_FLAGS]) {
437  r->compat.flags =
438  ntohl(mnl_attr_get_u32(tb[NFTA_RULE_COMPAT_FLAGS]));
439  r->flags |= (1 << NFTNL_RULE_COMPAT_FLAGS);
440  }
441  return 0;
442 }
443 
444 EXPORT_SYMBOL(nftnl_rule_nlmsg_parse);
445 int nftnl_rule_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_rule *r)
446 {
447  struct nlattr *tb[NFTA_RULE_MAX+1] = {};
448  struct nfgenmsg *nfg = mnl_nlmsg_get_payload(nlh);
449  int ret;
450 
451  if (mnl_attr_parse(nlh, sizeof(*nfg), nftnl_rule_parse_attr_cb, tb) < 0)
452  return -1;
453 
454  if (tb[NFTA_RULE_TABLE]) {
455  if (r->flags & (1 << NFTNL_RULE_TABLE))
456  xfree(r->table);
457  r->table = strdup(mnl_attr_get_str(tb[NFTA_RULE_TABLE]));
458  if (!r->table)
459  return -1;
460  r->flags |= (1 << NFTNL_RULE_TABLE);
461  }
462  if (tb[NFTA_RULE_CHAIN]) {
463  if (r->flags & (1 << NFTNL_RULE_CHAIN))
464  xfree(r->chain);
465  r->chain = strdup(mnl_attr_get_str(tb[NFTA_RULE_CHAIN]));
466  if (!r->chain)
467  return -1;
468  r->flags |= (1 << NFTNL_RULE_CHAIN);
469  }
470  if (tb[NFTA_RULE_HANDLE]) {
471  r->handle = be64toh(mnl_attr_get_u64(tb[NFTA_RULE_HANDLE]));
472  r->flags |= (1 << NFTNL_RULE_HANDLE);
473  }
474  if (tb[NFTA_RULE_EXPRESSIONS]) {
475  ret = nftnl_rule_parse_expr(tb[NFTA_RULE_EXPRESSIONS], r);
476  if (ret < 0)
477  return ret;
478  }
479  if (tb[NFTA_RULE_COMPAT]) {
480  ret = nftnl_rule_parse_compat(tb[NFTA_RULE_COMPAT], r);
481  if (ret < 0)
482  return ret;
483  }
484  if (tb[NFTA_RULE_POSITION]) {
485  r->position = be64toh(mnl_attr_get_u64(tb[NFTA_RULE_POSITION]));
486  r->flags |= (1 << NFTNL_RULE_POSITION);
487  }
488  if (tb[NFTA_RULE_USERDATA]) {
489  const void *udata =
490  mnl_attr_get_payload(tb[NFTA_RULE_USERDATA]);
491 
492  if (r->flags & (1 << NFTNL_RULE_USERDATA))
493  xfree(r->user.data);
494 
495  r->user.len = mnl_attr_get_payload_len(tb[NFTA_RULE_USERDATA]);
496 
497  r->user.data = malloc(r->user.len);
498  if (r->user.data == NULL)
499  return -1;
500 
501  memcpy(r->user.data, udata, r->user.len);
502  r->flags |= (1 << NFTNL_RULE_USERDATA);
503  }
504  if (tb[NFTA_RULE_ID]) {
505  r->id = ntohl(mnl_attr_get_u32(tb[NFTA_RULE_ID]));
506  r->flags |= (1 << NFTNL_RULE_ID);
507  }
508 
509  r->family = nfg->nfgen_family;
510  r->flags |= (1 << NFTNL_RULE_FAMILY);
511 
512  return 0;
513 }
514 
515 static int nftnl_rule_do_parse(struct nftnl_rule *r, enum nftnl_parse_type type,
516  const void *data, struct nftnl_parse_err *err,
517  enum nftnl_parse_input input)
518 {
519  int ret;
520  struct nftnl_parse_err perr = {};
521 
522  switch (type) {
523  case NFTNL_PARSE_JSON:
524  case NFTNL_PARSE_XML:
525  default:
526  ret = -1;
527  errno = EOPNOTSUPP;
528  break;
529  }
530  if (err != NULL)
531  *err = perr;
532 
533  return ret;
534 }
535 
536 EXPORT_SYMBOL(nftnl_rule_parse);
537 int nftnl_rule_parse(struct nftnl_rule *r, enum nftnl_parse_type type,
538  const char *data, struct nftnl_parse_err *err)
539 {
540  return nftnl_rule_do_parse(r, type, data, err, NFTNL_PARSE_BUFFER);
541 }
542 
543 EXPORT_SYMBOL(nftnl_rule_parse_file);
544 int nftnl_rule_parse_file(struct nftnl_rule *r, enum nftnl_parse_type type,
545  FILE *fp, struct nftnl_parse_err *err)
546 {
547  return nftnl_rule_do_parse(r, type, fp, err, NFTNL_PARSE_FILE);
548 }
549 
550 static int nftnl_rule_snprintf_default(char *buf, size_t size,
551  const struct nftnl_rule *r,
552  uint32_t type, uint32_t flags)
553 {
554  struct nftnl_expr *expr;
555  int ret, remain = size, offset = 0, i;
556 
557  if (r->flags & (1 << NFTNL_RULE_FAMILY)) {
558  ret = snprintf(buf + offset, remain, "%s ",
559  nftnl_family2str(r->family));
560  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
561  }
562 
563  if (r->flags & (1 << NFTNL_RULE_TABLE)) {
564  ret = snprintf(buf + offset, remain, "%s ",
565  r->table);
566  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
567  }
568 
569  if (r->flags & (1 << NFTNL_RULE_CHAIN)) {
570  ret = snprintf(buf + offset, remain, "%s ",
571  r->chain);
572  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
573  }
574  if (r->flags & (1 << NFTNL_RULE_HANDLE)) {
575  ret = snprintf(buf + offset, remain, "%llu ",
576  (unsigned long long)r->handle);
577  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
578  }
579 
580  if (r->flags & (1 << NFTNL_RULE_POSITION)) {
581  ret = snprintf(buf + offset, remain, "%llu ",
582  (unsigned long long)r->position);
583  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
584  }
585 
586  if (r->flags & (1 << NFTNL_RULE_ID)) {
587  ret = snprintf(buf + offset, remain, "%u ", r->id);
588  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
589  }
590 
591  ret = snprintf(buf + offset, remain, "\n");
592  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
593 
594  list_for_each_entry(expr, &r->expr_list, head) {
595  ret = snprintf(buf + offset, remain, " [ %s ", expr->ops->name);
596  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
597 
598  ret = nftnl_expr_snprintf(buf + offset, remain, expr,
599  type, flags);
600  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
601 
602  ret = snprintf(buf + offset, remain, "]\n");
603  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
604  }
605 
606  if (r->user.len) {
607  ret = snprintf(buf + offset, remain, " userdata = { ");
608  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
609 
610  for (i = 0; i < r->user.len; i++) {
611  char *c = r->user.data;
612 
613  ret = snprintf(buf + offset, remain, "%c",
614  isalnum(c[i]) ? c[i] : 0);
615  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
616  }
617 
618  ret = snprintf(buf + offset, remain, " }\n");
619  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
620 
621  }
622 
623  return offset;
624 }
625 
626 static int nftnl_rule_cmd_snprintf(char *buf, size_t size,
627  const struct nftnl_rule *r, uint32_t cmd,
628  uint32_t type, uint32_t flags)
629 {
630  int ret, remain = size, offset = 0;
631  uint32_t inner_flags = flags;
632 
633  inner_flags &= ~NFTNL_OF_EVENT_ANY;
634 
635  switch(type) {
636  case NFTNL_OUTPUT_DEFAULT:
637  ret = nftnl_rule_snprintf_default(buf + offset, remain, r, type,
638  inner_flags);
639  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
640  break;
641  case NFTNL_OUTPUT_JSON:
642  case NFTNL_OUTPUT_XML:
643  default:
644  return -1;
645  }
646 
647  return offset;
648 }
649 
650 EXPORT_SYMBOL(nftnl_rule_snprintf);
651 int nftnl_rule_snprintf(char *buf, size_t size, const struct nftnl_rule *r,
652  uint32_t type, uint32_t flags)
653 {
654  if (size)
655  buf[0] = '\0';
656 
657  return nftnl_rule_cmd_snprintf(buf, size, r, nftnl_flag2cmd(flags), type,
658  flags);
659 }
660 
661 static int nftnl_rule_do_snprintf(char *buf, size_t size, const void *r,
662  uint32_t cmd, uint32_t type, uint32_t flags)
663 {
664  return nftnl_rule_snprintf(buf, size, r, type, flags);
665 }
666 
667 EXPORT_SYMBOL(nftnl_rule_fprintf);
668 int nftnl_rule_fprintf(FILE *fp, const struct nftnl_rule *r, uint32_t type,
669  uint32_t flags)
670 {
671  return nftnl_fprintf(fp, r, NFTNL_CMD_UNSPEC, type, flags,
672  nftnl_rule_do_snprintf);
673 }
674 
675 EXPORT_SYMBOL(nftnl_expr_foreach);
676 int nftnl_expr_foreach(struct nftnl_rule *r,
677  int (*cb)(struct nftnl_expr *e, void *data),
678  void *data)
679 {
680  struct nftnl_expr *cur, *tmp;
681  int ret;
682 
683  list_for_each_entry_safe(cur, tmp, &r->expr_list, head) {
684  ret = cb(cur, data);
685  if (ret < 0)
686  return ret;
687  }
688  return 0;
689 }
690 
692  const struct nftnl_rule *r;
693  struct nftnl_expr *cur;
694 };
695 
696 static void nftnl_expr_iter_init(const struct nftnl_rule *r,
697  struct nftnl_expr_iter *iter)
698 {
699  iter->r = r;
700  if (list_empty(&r->expr_list))
701  iter->cur = NULL;
702  else
703  iter->cur = list_entry(r->expr_list.next, struct nftnl_expr,
704  head);
705 }
706 
707 EXPORT_SYMBOL(nftnl_expr_iter_create);
708 struct nftnl_expr_iter *nftnl_expr_iter_create(const struct nftnl_rule *r)
709 {
710  struct nftnl_expr_iter *iter;
711 
712  iter = calloc(1, sizeof(struct nftnl_expr_iter));
713  if (iter == NULL)
714  return NULL;
715 
716  nftnl_expr_iter_init(r, iter);
717 
718  return iter;
719 }
720 
721 EXPORT_SYMBOL(nftnl_expr_iter_next);
722 struct nftnl_expr *nftnl_expr_iter_next(struct nftnl_expr_iter *iter)
723 {
724  struct nftnl_expr *expr = iter->cur;
725 
726  if (expr == NULL)
727  return NULL;
728 
729  /* get next expression, if any */
730  iter->cur = list_entry(iter->cur->head.next, struct nftnl_expr, head);
731  if (&iter->cur->head == iter->r->expr_list.next)
732  return NULL;
733 
734  return expr;
735 }
736 
737 EXPORT_SYMBOL(nftnl_expr_iter_destroy);
738 void nftnl_expr_iter_destroy(struct nftnl_expr_iter *iter)
739 {
740  xfree(iter);
741 }
742 
744  struct list_head list;
745 };
746 
747 EXPORT_SYMBOL(nftnl_rule_list_alloc);
748 struct nftnl_rule_list *nftnl_rule_list_alloc(void)
749 {
750  struct nftnl_rule_list *list;
751 
752  list = calloc(1, sizeof(struct nftnl_rule_list));
753  if (list == NULL)
754  return NULL;
755 
756  INIT_LIST_HEAD(&list->list);
757 
758  return list;
759 }
760 
761 EXPORT_SYMBOL(nftnl_rule_list_free);
762 void nftnl_rule_list_free(struct nftnl_rule_list *list)
763 {
764  struct nftnl_rule *r, *tmp;
765 
766  list_for_each_entry_safe(r, tmp, &list->list, head) {
767  list_del(&r->head);
768  nftnl_rule_free(r);
769  }
770  xfree(list);
771 }
772 
773 EXPORT_SYMBOL(nftnl_rule_list_is_empty);
774 int nftnl_rule_list_is_empty(const struct nftnl_rule_list *list)
775 {
776  return list_empty(&list->list);
777 }
778 
779 EXPORT_SYMBOL(nftnl_rule_list_add);
780 void nftnl_rule_list_add(struct nftnl_rule *r, struct nftnl_rule_list *list)
781 {
782  list_add(&r->head, &list->list);
783 }
784 
785 EXPORT_SYMBOL(nftnl_rule_list_insert_at);
786 void nftnl_rule_list_insert_at(struct nftnl_rule *r, struct nftnl_rule *pos)
787 {
788  list_add(&r->head, &pos->head);
789 }
790 
791 EXPORT_SYMBOL(nftnl_rule_list_add_tail);
792 void nftnl_rule_list_add_tail(struct nftnl_rule *r, struct nftnl_rule_list *list)
793 {
794  list_add_tail(&r->head, &list->list);
795 }
796 
797 EXPORT_SYMBOL(nftnl_rule_list_del);
798 void nftnl_rule_list_del(struct nftnl_rule *r)
799 {
800  list_del(&r->head);
801 }
802 
803 EXPORT_SYMBOL(nftnl_rule_list_foreach);
804 int nftnl_rule_list_foreach(struct nftnl_rule_list *rule_list,
805  int (*cb)(struct nftnl_rule *r, void *data),
806  void *data)
807 {
808  struct nftnl_rule *cur, *tmp;
809  int ret;
810 
811  list_for_each_entry_safe(cur, tmp, &rule_list->list, head) {
812  ret = cb(cur, data);
813  if (ret < 0)
814  return ret;
815  }
816  return 0;
817 }
818 
820  const struct nftnl_rule_list *list;
821  struct nftnl_rule *cur;
822 };
823 
824 EXPORT_SYMBOL(nftnl_rule_list_iter_create);
825 struct nftnl_rule_list_iter *
826 nftnl_rule_list_iter_create(const struct nftnl_rule_list *l)
827 {
828  struct nftnl_rule_list_iter *iter;
829 
830  iter = calloc(1, sizeof(struct nftnl_rule_list_iter));
831  if (iter == NULL)
832  return NULL;
833 
834  iter->list = l;
835  if (nftnl_rule_list_is_empty(l))
836  iter->cur = NULL;
837  else
838  iter->cur = list_entry(l->list.next, struct nftnl_rule, head);
839 
840  return iter;
841 }
842 
843 EXPORT_SYMBOL(nftnl_rule_list_iter_cur);
844 struct nftnl_rule *nftnl_rule_list_iter_cur(struct nftnl_rule_list_iter *iter)
845 {
846  return iter->cur;
847 }
848 
849 EXPORT_SYMBOL(nftnl_rule_list_iter_next);
850 struct nftnl_rule *nftnl_rule_list_iter_next(struct nftnl_rule_list_iter *iter)
851 {
852  struct nftnl_rule *r = iter->cur;
853 
854  if (r == NULL)
855  return NULL;
856 
857  /* get next rule, if any */
858  iter->cur = list_entry(iter->cur->head.next, struct nftnl_rule, head);
859  if (&iter->cur->head == iter->list->list.next)
860  return NULL;
861 
862  return r;
863 }
864 
865 EXPORT_SYMBOL(nftnl_rule_list_iter_destroy);
866 void nftnl_rule_list_iter_destroy(const struct nftnl_rule_list_iter *iter)
867 {
868  xfree(iter);
869 }