libnftnl  1.2.8
dynset.c
1 /*
2  * Copyright (c) 2014, 2015 Patrick McHardy <kaber@trash.net>
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License as published
6  * by the Free Software Foundation; either version 2 of the License, or
7  * (at your option) any later version.
8  */
9 
10 #include "internal.h"
11 
12 #include <stdio.h>
13 #include <stdint.h>
14 #include <inttypes.h>
15 #include <errno.h>
16 #include <arpa/inet.h>
17 #include <libmnl/libmnl.h>
18 #include <linux/netfilter/nf_tables.h>
19 #include <libnftnl/rule.h>
20 #include <libnftnl/expr.h>
21 #include "data_reg.h"
22 #include "expr_ops.h"
23 
25  enum nft_registers sreg_key;
26  enum nft_registers sreg_data;
27  enum nft_dynset_ops op;
28  uint64_t timeout;
29  struct list_head expr_list;
30  char *set_name;
31  uint32_t set_id;
32  uint32_t dynset_flags;
33 };
34 
35 static int
36 nftnl_expr_dynset_set(struct nftnl_expr *e, uint16_t type,
37  const void *data, uint32_t data_len)
38 {
39  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
40  struct nftnl_expr *expr, *next;
41 
42  switch (type) {
43  case NFTNL_EXPR_DYNSET_SREG_KEY:
44  memcpy(&dynset->sreg_key, data, data_len);
45  break;
46  case NFTNL_EXPR_DYNSET_SREG_DATA:
47  memcpy(&dynset->sreg_data, data, data_len);
48  break;
49  case NFTNL_EXPR_DYNSET_OP:
50  memcpy(&dynset->op, data, data_len);
51  break;
52  case NFTNL_EXPR_DYNSET_TIMEOUT:
53  memcpy(&dynset->timeout, data, data_len);
54  break;
55  case NFTNL_EXPR_DYNSET_SET_NAME:
56  dynset->set_name = strdup((const char *)data);
57  if (!dynset->set_name)
58  return -1;
59  break;
60  case NFTNL_EXPR_DYNSET_SET_ID:
61  memcpy(&dynset->set_id, data, data_len);
62  break;
63  case NFTNL_EXPR_DYNSET_EXPR:
64  list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
65  nftnl_expr_free(expr);
66 
67  expr = (void *)data;
68  list_add(&expr->head, &dynset->expr_list);
69  break;
70  case NFTNL_EXPR_DYNSET_FLAGS:
71  memcpy(&dynset->dynset_flags, data, data_len);
72  break;
73  default:
74  return -1;
75  }
76  return 0;
77 }
78 
79 static const void *
80 nftnl_expr_dynset_get(const struct nftnl_expr *e, uint16_t type,
81  uint32_t *data_len)
82 {
83  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
84  struct nftnl_expr *expr;
85 
86  switch (type) {
87  case NFTNL_EXPR_DYNSET_SREG_KEY:
88  *data_len = sizeof(dynset->sreg_key);
89  return &dynset->sreg_key;
90  case NFTNL_EXPR_DYNSET_SREG_DATA:
91  *data_len = sizeof(dynset->sreg_data);
92  return &dynset->sreg_data;
93  case NFTNL_EXPR_DYNSET_OP:
94  *data_len = sizeof(dynset->op);
95  return &dynset->op;
96  case NFTNL_EXPR_DYNSET_TIMEOUT:
97  *data_len = sizeof(dynset->timeout);
98  return &dynset->timeout;
99  case NFTNL_EXPR_DYNSET_SET_NAME:
100  *data_len = strlen(dynset->set_name) + 1;
101  return dynset->set_name;
102  case NFTNL_EXPR_DYNSET_SET_ID:
103  *data_len = sizeof(dynset->set_id);
104  return &dynset->set_id;
105  case NFTNL_EXPR_DYNSET_EXPR:
106  list_for_each_entry(expr, &dynset->expr_list, head)
107  break;
108  return expr;
109  case NFTNL_EXPR_DYNSET_FLAGS:
110  *data_len = sizeof(dynset->dynset_flags);
111  return &dynset->dynset_flags;
112  }
113  return NULL;
114 }
115 
116 static int nftnl_expr_dynset_cb(const struct nlattr *attr, void *data)
117 {
118  const struct nlattr **tb = data;
119  int type = mnl_attr_get_type(attr);
120 
121  if (mnl_attr_type_valid(attr, NFTA_DYNSET_MAX) < 0)
122  return MNL_CB_OK;
123 
124  switch (type) {
125  case NFTA_DYNSET_SREG_KEY:
126  case NFTA_DYNSET_SREG_DATA:
127  case NFTA_DYNSET_SET_ID:
128  case NFTA_DYNSET_OP:
129  case NFTA_DYNSET_FLAGS:
130  if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
131  abi_breakage();
132  break;
133  case NFTA_DYNSET_TIMEOUT:
134  if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
135  abi_breakage();
136  break;
137  case NFTA_DYNSET_SET_NAME:
138  if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
139  abi_breakage();
140  break;
141  case NFTA_DYNSET_EXPR:
142  case NFTA_DYNSET_EXPRESSIONS:
143  if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
144  abi_breakage();
145  break;
146  }
147 
148  tb[type] = attr;
149  return MNL_CB_OK;
150 }
151 
152 static void
153 nftnl_expr_dynset_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
154 {
155  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
156  struct nlattr *nest;
157  int num_exprs = 0;
158 
159  if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_KEY))
160  mnl_attr_put_u32(nlh, NFTA_DYNSET_SREG_KEY, htonl(dynset->sreg_key));
161  if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_DATA))
162  mnl_attr_put_u32(nlh, NFTA_DYNSET_SREG_DATA, htonl(dynset->sreg_data));
163  if (e->flags & (1 << NFTNL_EXPR_DYNSET_OP))
164  mnl_attr_put_u32(nlh, NFTA_DYNSET_OP, htonl(dynset->op));
165  if (e->flags & (1 << NFTNL_EXPR_DYNSET_TIMEOUT))
166  mnl_attr_put_u64(nlh, NFTA_DYNSET_TIMEOUT, htobe64(dynset->timeout));
167  if (e->flags & (1 << NFTNL_EXPR_DYNSET_SET_NAME))
168  mnl_attr_put_strz(nlh, NFTA_DYNSET_SET_NAME, dynset->set_name);
169  if (e->flags & (1 << NFTNL_EXPR_DYNSET_SET_ID))
170  mnl_attr_put_u32(nlh, NFTA_DYNSET_SET_ID, htonl(dynset->set_id));
171  if (!list_empty(&dynset->expr_list)) {
172  struct nftnl_expr *expr;
173 
174  list_for_each_entry(expr, &dynset->expr_list, head)
175  num_exprs++;
176 
177  if (num_exprs == 1) {
178  nest = mnl_attr_nest_start(nlh, NFTA_DYNSET_EXPR);
179  list_for_each_entry(expr, &dynset->expr_list, head)
180  nftnl_expr_build_payload(nlh, expr);
181  mnl_attr_nest_end(nlh, nest);
182  } else if (num_exprs > 1) {
183  struct nlattr *nest1, *nest2;
184 
185  nest1 = mnl_attr_nest_start(nlh, NFTA_DYNSET_EXPRESSIONS);
186  list_for_each_entry(expr, &dynset->expr_list, head) {
187  nest2 = mnl_attr_nest_start(nlh, NFTA_LIST_ELEM);
188  nftnl_expr_build_payload(nlh, expr);
189  mnl_attr_nest_end(nlh, nest2);
190  }
191  mnl_attr_nest_end(nlh, nest1);
192  }
193  }
194  if (e->flags & (1 << NFTNL_EXPR_DYNSET_FLAGS))
195  mnl_attr_put_u32(nlh, NFTA_DYNSET_FLAGS,
196  htonl(dynset->dynset_flags));
197 }
198 
199 EXPORT_SYMBOL(nftnl_expr_add_expr);
200 void nftnl_expr_add_expr(struct nftnl_expr *e, uint32_t type,
201  struct nftnl_expr *expr)
202 {
203  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
204 
205  list_add_tail(&expr->head, &dynset->expr_list);
206 }
207 
208 EXPORT_SYMBOL(nftnl_expr_expr_foreach);
209 int nftnl_expr_expr_foreach(const struct nftnl_expr *e,
210  int (*cb)(struct nftnl_expr *e, void *data),
211  void *data)
212 {
213  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
214  struct nftnl_expr *cur, *tmp;
215  int ret;
216 
217  list_for_each_entry_safe(cur, tmp, &dynset->expr_list, head) {
218  ret = cb(cur, data);
219  if (ret < 0)
220  return ret;
221  }
222  return 0;
223 }
224 
225 static int
226 nftnl_expr_dynset_parse(struct nftnl_expr *e, struct nlattr *attr)
227 {
228  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
229  struct nlattr *tb[NFTA_DYNSET_MAX+1] = {};
230  struct nftnl_expr *expr, *next;
231  int ret = 0;
232 
233  if (mnl_attr_parse_nested(attr, nftnl_expr_dynset_cb, tb) < 0)
234  return -1;
235 
236  if (tb[NFTA_DYNSET_SREG_KEY]) {
237  dynset->sreg_key = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SREG_KEY]));
238  e->flags |= (1 << NFTNL_EXPR_DYNSET_SREG_KEY);
239  }
240  if (tb[NFTA_DYNSET_SREG_DATA]) {
241  dynset->sreg_data = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SREG_DATA]));
242  e->flags |= (1 << NFTNL_EXPR_DYNSET_SREG_DATA);
243  }
244  if (tb[NFTA_DYNSET_OP]) {
245  dynset->op = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_OP]));
246  e->flags |= (1 << NFTNL_EXPR_DYNSET_OP);
247  }
248  if (tb[NFTA_DYNSET_TIMEOUT]) {
249  dynset->timeout = be64toh(mnl_attr_get_u64(tb[NFTA_DYNSET_TIMEOUT]));
250  e->flags |= (1 << NFTNL_EXPR_DYNSET_TIMEOUT);
251  }
252  if (tb[NFTA_DYNSET_SET_NAME]) {
253  dynset->set_name =
254  strdup(mnl_attr_get_str(tb[NFTA_DYNSET_SET_NAME]));
255  if (!dynset->set_name)
256  return -1;
257  e->flags |= (1 << NFTNL_EXPR_DYNSET_SET_NAME);
258  }
259  if (tb[NFTA_DYNSET_SET_ID]) {
260  dynset->set_id = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SET_ID]));
261  e->flags |= (1 << NFTNL_EXPR_DYNSET_SET_ID);
262  }
263  if (tb[NFTA_DYNSET_EXPR]) {
264  expr = nftnl_expr_parse(tb[NFTA_DYNSET_EXPR]);
265  if (expr == NULL)
266  return -1;
267 
268  list_add(&expr->head, &dynset->expr_list);
269  e->flags |= (1 << NFTNL_EXPR_DYNSET_EXPR);
270  } else if (tb[NFTA_DYNSET_EXPRESSIONS]) {
271  struct nlattr *attr2;
272 
273  mnl_attr_for_each_nested(attr2, tb[NFTA_DYNSET_EXPRESSIONS]) {
274  if (mnl_attr_get_type(attr2) != NFTA_LIST_ELEM)
275  goto out_dynset_expr;
276 
277  expr = nftnl_expr_parse(attr2);
278  if (!expr)
279  goto out_dynset_expr;
280 
281  list_add_tail(&expr->head, &dynset->expr_list);
282  }
283  e->flags |= (1 << NFTNL_EXPR_DYNSET_EXPRESSIONS);
284  }
285  if (tb[NFTA_DYNSET_FLAGS]) {
286  dynset->dynset_flags = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_FLAGS]));
287  e->flags |= (1 << NFTNL_EXPR_DYNSET_FLAGS);
288  }
289 
290  return ret;
291 out_dynset_expr:
292  list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
293  nftnl_expr_free(expr);
294 
295  return -1;
296 }
297 
298 static const char *op2str_array[] = {
299  [NFT_DYNSET_OP_ADD] = "add",
300  [NFT_DYNSET_OP_UPDATE] = "update",
301  [NFT_DYNSET_OP_DELETE] = "delete",
302 };
303 
304 static const char *op2str(enum nft_dynset_ops op)
305 {
306  if (op > NFT_DYNSET_OP_DELETE)
307  return "unknown";
308  return op2str_array[op];
309 }
310 
311 static int
312 nftnl_expr_dynset_snprintf(char *buf, size_t remain,
313  uint32_t flags, const struct nftnl_expr *e)
314 {
315  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
316  struct nftnl_expr *expr;
317  int offset = 0, ret;
318 
319  ret = snprintf(buf, remain, "%s reg_key %u set %s ",
320  op2str(dynset->op), dynset->sreg_key, dynset->set_name);
321  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
322 
323  if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_DATA)) {
324  ret = snprintf(buf + offset, remain, "sreg_data %u ",
325  dynset->sreg_data);
326  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
327  }
328  if (e->flags & (1 << NFTNL_EXPR_DYNSET_TIMEOUT)) {
329  ret = snprintf(buf + offset, remain, "timeout %"PRIu64"ms ",
330  dynset->timeout);
331  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
332  }
333  list_for_each_entry(expr, &dynset->expr_list, head) {
334  ret = snprintf(buf + offset, remain, "expr [ %s ",
335  expr->ops->name);
336  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
337 
338  ret = nftnl_expr_snprintf(buf + offset, remain, expr,
339  NFTNL_OUTPUT_DEFAULT,
340  NFTNL_OF_EVENT_ANY);
341  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
342 
343  ret = snprintf(buf + offset, remain, "] ");
344  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
345  }
346 
347  return offset;
348 }
349 
350 static void nftnl_expr_dynset_init(const struct nftnl_expr *e)
351 {
352  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
353 
354  INIT_LIST_HEAD(&dynset->expr_list);
355 }
356 
357 static void nftnl_expr_dynset_free(const struct nftnl_expr *e)
358 {
359  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
360  struct nftnl_expr *expr, *next;
361 
362  xfree(dynset->set_name);
363  list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
364  nftnl_expr_free(expr);
365 }
366 
367 static struct attr_policy dynset_attr_policy[__NFTNL_EXPR_DYNSET_MAX] = {
368  [NFTNL_EXPR_DYNSET_SREG_KEY] = { .maxlen = sizeof(uint32_t) },
369  [NFTNL_EXPR_DYNSET_SREG_DATA] = { .maxlen = sizeof(uint32_t) },
370  [NFTNL_EXPR_DYNSET_OP] = { .maxlen = sizeof(uint32_t) },
371  [NFTNL_EXPR_DYNSET_TIMEOUT] = { .maxlen = sizeof(uint64_t) },
372  [NFTNL_EXPR_DYNSET_SET_NAME] = { .maxlen = NFT_SET_MAXNAMELEN },
373  [NFTNL_EXPR_DYNSET_SET_ID] = { .maxlen = sizeof(uint32_t) },
374  [NFTNL_EXPR_DYNSET_EXPR] = { .maxlen = 0 },
375  [NFTNL_EXPR_DYNSET_EXPRESSIONS] = { .maxlen = 0 },
376  [NFTNL_EXPR_DYNSET_FLAGS] = { .maxlen = sizeof(uint32_t) },
377 };
378 
379 struct expr_ops expr_ops_dynset = {
380  .name = "dynset",
381  .alloc_len = sizeof(struct nftnl_expr_dynset),
382  .nftnl_max_attr = __NFTNL_EXPR_DYNSET_MAX - 1,
383  .attr_policy = dynset_attr_policy,
384  .init = nftnl_expr_dynset_init,
385  .free = nftnl_expr_dynset_free,
386  .set = nftnl_expr_dynset_set,
387  .get = nftnl_expr_dynset_get,
388  .parse = nftnl_expr_dynset_parse,
389  .build = nftnl_expr_dynset_build,
390  .output = nftnl_expr_dynset_snprintf,
391 };