libnftnl  1.2.9
chain.c
1 /* SPDX-License-Identifier: GPL-2.0-or-later */
2 /*
3  * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
4  *
5  * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
6  */
7 #include "internal.h"
8 
9 #include <time.h>
10 #include <endian.h>
11 #include <stdint.h>
12 #include <stdlib.h>
13 #include <limits.h>
14 #include <string.h>
15 #include <netinet/in.h>
16 #include <errno.h>
17 #include <inttypes.h>
18 
19 #include <libmnl/libmnl.h>
20 #include <linux/netfilter/nfnetlink.h>
21 #include <linux/netfilter/nf_tables.h>
22 #include <linux/netfilter.h>
23 #include <linux/netfilter_arp.h>
24 
25 #include <libnftnl/chain.h>
26 #include <libnftnl/rule.h>
27 
28 struct nftnl_chain {
29  struct list_head head;
30  struct hlist_node hnode;
31 
32  const char *name;
33  const char *type;
34  const char *table;
35  const char *dev;
36  struct nftnl_str_array dev_array;
37  uint32_t family;
38  uint32_t policy;
39  uint32_t hooknum;
40  int32_t prio;
41  uint32_t chain_flags;
42  uint32_t use;
43  uint64_t packets;
44  uint64_t bytes;
45  uint64_t handle;
46  uint32_t flags;
47  uint32_t chain_id;
48 
49  struct {
50  void *data;
51  uint32_t len;
52  } user;
53 
54  struct list_head rule_list;
55 };
56 
57 static const char *nftnl_hooknum2str(int family, int hooknum)
58 {
59  switch (family) {
60  case NFPROTO_IPV4:
61  case NFPROTO_IPV6:
62  case NFPROTO_INET:
63  case NFPROTO_BRIDGE:
64  switch (hooknum) {
65  case NF_INET_PRE_ROUTING:
66  return "prerouting";
67  case NF_INET_LOCAL_IN:
68  return "input";
69  case NF_INET_FORWARD:
70  return "forward";
71  case NF_INET_LOCAL_OUT:
72  return "output";
73  case NF_INET_POST_ROUTING:
74  return "postrouting";
75  }
76  break;
77  case NFPROTO_ARP:
78  switch (hooknum) {
79  case NF_ARP_IN:
80  return "input";
81  case NF_ARP_OUT:
82  return "output";
83  case NF_ARP_FORWARD:
84  return "forward";
85  }
86  break;
87  case NFPROTO_NETDEV:
88  switch (hooknum) {
89  case NF_NETDEV_INGRESS:
90  return "ingress";
91  }
92  break;
93  }
94  return "unknown";
95 }
96 
97 EXPORT_SYMBOL(nftnl_chain_alloc);
98 struct nftnl_chain *nftnl_chain_alloc(void)
99 {
100  struct nftnl_chain *c;
101 
102  c = calloc(1, sizeof(struct nftnl_chain));
103  if (c == NULL)
104  return NULL;
105 
106  INIT_LIST_HEAD(&c->rule_list);
107 
108  return c;
109 }
110 
111 EXPORT_SYMBOL(nftnl_chain_free);
112 void nftnl_chain_free(const struct nftnl_chain *c)
113 {
114  struct nftnl_rule *r, *tmp;
115 
116  list_for_each_entry_safe(r, tmp, &c->rule_list, head)
117  nftnl_rule_free(r);
118 
119  if (c->flags & (1 << NFTNL_CHAIN_NAME))
120  xfree(c->name);
121  if (c->flags & (1 << NFTNL_CHAIN_TABLE))
122  xfree(c->table);
123  if (c->flags & (1 << NFTNL_CHAIN_TYPE))
124  xfree(c->type);
125  if (c->flags & (1 << NFTNL_CHAIN_DEV))
126  xfree(c->dev);
127  if (c->flags & (1 << NFTNL_CHAIN_USERDATA))
128  xfree(c->user.data);
129  if (c->flags & (1 << NFTNL_CHAIN_DEVICES))
130  nftnl_str_array_clear((struct nftnl_str_array *)&c->dev_array);
131  xfree(c);
132 }
133 
134 EXPORT_SYMBOL(nftnl_chain_is_set);
135 bool nftnl_chain_is_set(const struct nftnl_chain *c, uint16_t attr)
136 {
137  return c->flags & (1 << attr);
138 }
139 
140 EXPORT_SYMBOL(nftnl_chain_unset);
141 void nftnl_chain_unset(struct nftnl_chain *c, uint16_t attr)
142 {
143  if (!(c->flags & (1 << attr)))
144  return;
145 
146  switch (attr) {
147  case NFTNL_CHAIN_NAME:
148  xfree(c->name);
149  break;
150  case NFTNL_CHAIN_TABLE:
151  xfree(c->table);
152  break;
153  case NFTNL_CHAIN_USE:
154  break;
155  case NFTNL_CHAIN_TYPE:
156  xfree(c->type);
157  break;
158  case NFTNL_CHAIN_HOOKNUM:
159  case NFTNL_CHAIN_PRIO:
160  case NFTNL_CHAIN_POLICY:
161  case NFTNL_CHAIN_BYTES:
162  case NFTNL_CHAIN_PACKETS:
163  case NFTNL_CHAIN_HANDLE:
164  case NFTNL_CHAIN_FAMILY:
165  case NFTNL_CHAIN_FLAGS:
166  case NFTNL_CHAIN_ID:
167  break;
168  case NFTNL_CHAIN_DEV:
169  xfree(c->dev);
170  break;
171  case NFTNL_CHAIN_DEVICES:
172  nftnl_str_array_clear(&c->dev_array);
173  break;
174  case NFTNL_CHAIN_USERDATA:
175  xfree(c->user.data);
176  break;
177  default:
178  return;
179  }
180 
181  c->flags &= ~(1 << attr);
182 }
183 
184 static uint32_t nftnl_chain_validate[NFTNL_CHAIN_MAX + 1] = {
185  [NFTNL_CHAIN_HOOKNUM] = sizeof(uint32_t),
186  [NFTNL_CHAIN_PRIO] = sizeof(int32_t),
187  [NFTNL_CHAIN_POLICY] = sizeof(uint32_t),
188  [NFTNL_CHAIN_USE] = sizeof(uint32_t),
189  [NFTNL_CHAIN_BYTES] = sizeof(uint64_t),
190  [NFTNL_CHAIN_PACKETS] = sizeof(uint64_t),
191  [NFTNL_CHAIN_HANDLE] = sizeof(uint64_t),
192  [NFTNL_CHAIN_FAMILY] = sizeof(uint32_t),
193  [NFTNL_CHAIN_FLAGS] = sizeof(uint32_t),
194  [NFTNL_CHAIN_ID] = sizeof(uint32_t),
195 };
196 
197 EXPORT_SYMBOL(nftnl_chain_set_data);
198 int nftnl_chain_set_data(struct nftnl_chain *c, uint16_t attr,
199  const void *data, uint32_t data_len)
200 {
201  nftnl_assert_attr_exists(attr, NFTNL_CHAIN_MAX);
202  nftnl_assert_validate(data, nftnl_chain_validate, attr, data_len);
203 
204  switch(attr) {
205  case NFTNL_CHAIN_NAME:
206  return nftnl_set_str_attr(&c->name, &c->flags,
207  attr, data, data_len);
208  case NFTNL_CHAIN_TABLE:
209  return nftnl_set_str_attr(&c->table, &c->flags,
210  attr, data, data_len);
211  case NFTNL_CHAIN_HOOKNUM:
212  memcpy(&c->hooknum, data, sizeof(c->hooknum));
213  break;
214  case NFTNL_CHAIN_PRIO:
215  memcpy(&c->prio, data, sizeof(c->prio));
216  break;
217  case NFTNL_CHAIN_POLICY:
218  memcpy(&c->policy, data, sizeof(c->policy));
219  break;
220  case NFTNL_CHAIN_USE:
221  memcpy(&c->use, data, sizeof(c->use));
222  break;
223  case NFTNL_CHAIN_BYTES:
224  memcpy(&c->bytes, data, sizeof(c->bytes));
225  break;
226  case NFTNL_CHAIN_PACKETS:
227  memcpy(&c->packets, data, sizeof(c->packets));
228  break;
229  case NFTNL_CHAIN_HANDLE:
230  memcpy(&c->handle, data, sizeof(c->handle));
231  break;
232  case NFTNL_CHAIN_FAMILY:
233  memcpy(&c->family, data, sizeof(c->family));
234  break;
235  case NFTNL_CHAIN_TYPE:
236  return nftnl_set_str_attr(&c->type, &c->flags,
237  attr, data, data_len);
238  case NFTNL_CHAIN_DEV:
239  return nftnl_set_str_attr(&c->dev, &c->flags,
240  attr, data, data_len);
241  case NFTNL_CHAIN_DEVICES:
242  if (nftnl_str_array_set(&c->dev_array, data) < 0)
243  return -1;
244  break;
245  case NFTNL_CHAIN_FLAGS:
246  memcpy(&c->chain_flags, data, sizeof(c->chain_flags));
247  break;
248  case NFTNL_CHAIN_ID:
249  memcpy(&c->chain_id, data, sizeof(c->chain_id));
250  break;
251  case NFTNL_CHAIN_USERDATA:
252  if (c->flags & (1 << NFTNL_CHAIN_USERDATA))
253  xfree(c->user.data);
254 
255  c->user.data = malloc(data_len);
256  if (!c->user.data)
257  return -1;
258  memcpy(c->user.data, data, data_len);
259  c->user.len = data_len;
260  break;
261  }
262  c->flags |= (1 << attr);
263  return 0;
264 }
265 
266 void nftnl_chain_set(struct nftnl_chain *c, uint16_t attr, const void *data) __visible;
267 void nftnl_chain_set(struct nftnl_chain *c, uint16_t attr, const void *data)
268 {
269  nftnl_chain_set_data(c, attr, data, nftnl_chain_validate[attr]);
270 }
271 
272 EXPORT_SYMBOL(nftnl_chain_set_u32);
273 void nftnl_chain_set_u32(struct nftnl_chain *c, uint16_t attr, uint32_t data)
274 {
275  nftnl_chain_set_data(c, attr, &data, sizeof(uint32_t));
276 }
277 
278 EXPORT_SYMBOL(nftnl_chain_set_s32);
279 void nftnl_chain_set_s32(struct nftnl_chain *c, uint16_t attr, int32_t data)
280 {
281  nftnl_chain_set_data(c, attr, &data, sizeof(int32_t));
282 }
283 
284 EXPORT_SYMBOL(nftnl_chain_set_u64);
285 void nftnl_chain_set_u64(struct nftnl_chain *c, uint16_t attr, uint64_t data)
286 {
287  nftnl_chain_set_data(c, attr, &data, sizeof(uint64_t));
288 }
289 
290 EXPORT_SYMBOL(nftnl_chain_set_u8);
291 void nftnl_chain_set_u8(struct nftnl_chain *c, uint16_t attr, uint8_t data)
292 {
293  nftnl_chain_set_data(c, attr, &data, sizeof(uint8_t));
294 }
295 
296 EXPORT_SYMBOL(nftnl_chain_set_str);
297 int nftnl_chain_set_str(struct nftnl_chain *c, uint16_t attr, const char *str)
298 {
299  return nftnl_chain_set_data(c, attr, str, strlen(str) + 1);
300 }
301 
302 EXPORT_SYMBOL(nftnl_chain_set_array);
303 int nftnl_chain_set_array(struct nftnl_chain *c, uint16_t attr,
304  const char **data)
305 {
306  return nftnl_chain_set_data(c, attr, data, 0);
307 }
308 
309 EXPORT_SYMBOL(nftnl_chain_get_data);
310 const void *nftnl_chain_get_data(const struct nftnl_chain *c, uint16_t attr,
311  uint32_t *data_len)
312 {
313  if (!(c->flags & (1 << attr)))
314  return NULL;
315 
316  switch(attr) {
317  case NFTNL_CHAIN_NAME:
318  *data_len = strlen(c->name) + 1;
319  return c->name;
320  case NFTNL_CHAIN_TABLE:
321  *data_len = strlen(c->table) + 1;
322  return c->table;
323  case NFTNL_CHAIN_HOOKNUM:
324  *data_len = sizeof(uint32_t);
325  return &c->hooknum;
326  case NFTNL_CHAIN_PRIO:
327  *data_len = sizeof(int32_t);
328  return &c->prio;
329  case NFTNL_CHAIN_POLICY:
330  *data_len = sizeof(uint32_t);
331  return &c->policy;
332  case NFTNL_CHAIN_USE:
333  *data_len = sizeof(uint32_t);
334  return &c->use;
335  case NFTNL_CHAIN_BYTES:
336  *data_len = sizeof(uint64_t);
337  return &c->bytes;
338  case NFTNL_CHAIN_PACKETS:
339  *data_len = sizeof(uint64_t);
340  return &c->packets;
341  case NFTNL_CHAIN_HANDLE:
342  *data_len = sizeof(uint64_t);
343  return &c->handle;
344  case NFTNL_CHAIN_FAMILY:
345  *data_len = sizeof(uint32_t);
346  return &c->family;
347  case NFTNL_CHAIN_TYPE:
348  *data_len = sizeof(uint32_t);
349  return c->type;
350  case NFTNL_CHAIN_DEV:
351  *data_len = strlen(c->dev) + 1;
352  return c->dev;
353  case NFTNL_CHAIN_DEVICES:
354  *data_len = 0;
355  return c->dev_array.array;
356  case NFTNL_CHAIN_FLAGS:
357  *data_len = sizeof(uint32_t);
358  return &c->chain_flags;
359  case NFTNL_CHAIN_ID:
360  *data_len = sizeof(uint32_t);
361  return &c->chain_id;
362  case NFTNL_CHAIN_USERDATA:
363  *data_len = c->user.len;
364  return c->user.data;
365  }
366  return NULL;
367 }
368 
369 EXPORT_SYMBOL(nftnl_chain_get);
370 const void *nftnl_chain_get(const struct nftnl_chain *c, uint16_t attr)
371 {
372  uint32_t data_len;
373  return nftnl_chain_get_data(c, attr, &data_len);
374 }
375 
376 EXPORT_SYMBOL(nftnl_chain_get_str);
377 const char *nftnl_chain_get_str(const struct nftnl_chain *c, uint16_t attr)
378 {
379  return nftnl_chain_get(c, attr);
380 }
381 
382 EXPORT_SYMBOL(nftnl_chain_get_u32);
383 uint32_t nftnl_chain_get_u32(const struct nftnl_chain *c, uint16_t attr)
384 {
385  uint32_t data_len;
386  const uint32_t *val = nftnl_chain_get_data(c, attr, &data_len);
387 
388  nftnl_assert(val, attr, data_len == sizeof(uint32_t));
389 
390  return val ? *val : 0;
391 }
392 
393 EXPORT_SYMBOL(nftnl_chain_get_s32);
394 int32_t nftnl_chain_get_s32(const struct nftnl_chain *c, uint16_t attr)
395 {
396  uint32_t data_len;
397  const int32_t *val = nftnl_chain_get_data(c, attr, &data_len);
398 
399  nftnl_assert(val, attr, data_len == sizeof(int32_t));
400 
401  return val ? *val : 0;
402 }
403 
404 EXPORT_SYMBOL(nftnl_chain_get_u64);
405 uint64_t nftnl_chain_get_u64(const struct nftnl_chain *c, uint16_t attr)
406 {
407  uint32_t data_len;
408  const uint64_t *val = nftnl_chain_get_data(c, attr, &data_len);
409 
410  nftnl_assert(val, attr, data_len == sizeof(int64_t));
411 
412  return val ? *val : 0;
413 }
414 
415 EXPORT_SYMBOL(nftnl_chain_get_u8);
416 uint8_t nftnl_chain_get_u8(const struct nftnl_chain *c, uint16_t attr)
417 {
418  uint32_t data_len;
419  const uint8_t *val = nftnl_chain_get_data(c, attr, &data_len);
420 
421  nftnl_assert(val, attr, data_len == sizeof(int8_t));
422 
423  return val ? *val : 0;
424 }
425 
426 EXPORT_SYMBOL(nftnl_chain_get_array);
427 const char *const *nftnl_chain_get_array(const struct nftnl_chain *c, uint16_t attr)
428 {
429  uint32_t data_len;
430  const char * const *val = nftnl_chain_get_data(c, attr, &data_len);
431 
432  nftnl_assert(val, attr, attr == NFTNL_CHAIN_DEVICES);
433 
434  return val;
435 }
436 
437 EXPORT_SYMBOL(nftnl_chain_nlmsg_build_payload);
438 void nftnl_chain_nlmsg_build_payload(struct nlmsghdr *nlh, const struct nftnl_chain *c)
439 {
440  struct nlattr *nest = NULL;
441  int i;
442 
443  if (c->flags & (1 << NFTNL_CHAIN_TABLE))
444  mnl_attr_put_strz(nlh, NFTA_CHAIN_TABLE, c->table);
445  if (c->flags & (1 << NFTNL_CHAIN_NAME))
446  mnl_attr_put_strz(nlh, NFTA_CHAIN_NAME, c->name);
447 
448  if ((c->flags & (1 << NFTNL_CHAIN_HOOKNUM)) ||
449  (c->flags & (1 << NFTNL_CHAIN_PRIO)) ||
450  (c->flags & (1 << NFTNL_CHAIN_DEV)) ||
451  (c->flags & (1 << NFTNL_CHAIN_DEVICES)))
452  nest = mnl_attr_nest_start(nlh, NFTA_CHAIN_HOOK);
453 
454  if ((c->flags & (1 << NFTNL_CHAIN_HOOKNUM)))
455  mnl_attr_put_u32(nlh, NFTA_HOOK_HOOKNUM, htonl(c->hooknum));
456  if ((c->flags & (1 << NFTNL_CHAIN_PRIO)))
457  mnl_attr_put_u32(nlh, NFTA_HOOK_PRIORITY, htonl(c->prio));
458 
459  if (c->flags & (1 << NFTNL_CHAIN_DEV))
460  mnl_attr_put_strz(nlh, NFTA_HOOK_DEV, c->dev);
461  else if (c->flags & (1 << NFTNL_CHAIN_DEVICES)) {
462  struct nlattr *nest_dev;
463  const char *dev;
464 
465  nest_dev = mnl_attr_nest_start(nlh, NFTA_HOOK_DEVS);
466  nftnl_str_array_foreach(dev, &c->dev_array, i)
467  mnl_attr_put_strz(nlh, NFTA_DEVICE_NAME, dev);
468  mnl_attr_nest_end(nlh, nest_dev);
469  }
470 
471  if ((c->flags & (1 << NFTNL_CHAIN_HOOKNUM)) ||
472  (c->flags & (1 << NFTNL_CHAIN_PRIO)) ||
473  (c->flags & (1 << NFTNL_CHAIN_DEV)) ||
474  (c->flags & (1 << NFTNL_CHAIN_DEVICES)))
475  mnl_attr_nest_end(nlh, nest);
476 
477  if (c->flags & (1 << NFTNL_CHAIN_POLICY))
478  mnl_attr_put_u32(nlh, NFTA_CHAIN_POLICY, htonl(c->policy));
479  if (c->flags & (1 << NFTNL_CHAIN_USE))
480  mnl_attr_put_u32(nlh, NFTA_CHAIN_USE, htonl(c->use));
481  if ((c->flags & (1 << NFTNL_CHAIN_PACKETS)) &&
482  (c->flags & (1 << NFTNL_CHAIN_BYTES))) {
483  nest = mnl_attr_nest_start(nlh, NFTA_CHAIN_COUNTERS);
484  mnl_attr_put_u64(nlh, NFTA_COUNTER_PACKETS, be64toh(c->packets));
485  mnl_attr_put_u64(nlh, NFTA_COUNTER_BYTES, be64toh(c->bytes));
486  mnl_attr_nest_end(nlh, nest);
487  }
488  if (c->flags & (1 << NFTNL_CHAIN_HANDLE))
489  mnl_attr_put_u64(nlh, NFTA_CHAIN_HANDLE, be64toh(c->handle));
490  if (c->flags & (1 << NFTNL_CHAIN_TYPE))
491  mnl_attr_put_strz(nlh, NFTA_CHAIN_TYPE, c->type);
492  if (c->flags & (1 << NFTNL_CHAIN_FLAGS))
493  mnl_attr_put_u32(nlh, NFTA_CHAIN_FLAGS, htonl(c->chain_flags));
494  if (c->flags & (1 << NFTNL_CHAIN_ID))
495  mnl_attr_put_u32(nlh, NFTA_CHAIN_ID, htonl(c->chain_id));
496  if (c->flags & (1 << NFTNL_CHAIN_USERDATA))
497  mnl_attr_put(nlh, NFTA_CHAIN_USERDATA, c->user.len, c->user.data);
498 }
499 
500 EXPORT_SYMBOL(nftnl_chain_rule_add);
501 void nftnl_chain_rule_add(struct nftnl_rule *rule, struct nftnl_chain *c)
502 {
503  list_add(&rule->head, &c->rule_list);
504 }
505 
506 EXPORT_SYMBOL(nftnl_chain_rule_del);
507 void nftnl_chain_rule_del(struct nftnl_rule *r)
508 {
509  list_del(&r->head);
510 }
511 
512 EXPORT_SYMBOL(nftnl_chain_rule_add_tail);
513 void nftnl_chain_rule_add_tail(struct nftnl_rule *rule, struct nftnl_chain *c)
514 {
515  list_add_tail(&rule->head, &c->rule_list);
516 }
517 
518 EXPORT_SYMBOL(nftnl_chain_rule_insert_at);
519 void nftnl_chain_rule_insert_at(struct nftnl_rule *rule, struct nftnl_rule *pos)
520 {
521  list_add_tail(&rule->head, &pos->head);
522 }
523 
524 EXPORT_SYMBOL(nftnl_chain_rule_append_at);
525 void nftnl_chain_rule_append_at(struct nftnl_rule *rule, struct nftnl_rule *pos)
526 {
527  list_add(&rule->head, &pos->head);
528 }
529 
530 static int nftnl_chain_parse_attr_cb(const struct nlattr *attr, void *data)
531 {
532  const struct nlattr **tb = data;
533  int type = mnl_attr_get_type(attr);
534 
535  if (mnl_attr_type_valid(attr, NFTA_CHAIN_MAX) < 0)
536  return MNL_CB_OK;
537 
538  switch(type) {
539  case NFTA_CHAIN_NAME:
540  case NFTA_CHAIN_TABLE:
541  case NFTA_CHAIN_TYPE:
542  if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
543  abi_breakage();
544  break;
545  case NFTA_CHAIN_HOOK:
546  case NFTA_CHAIN_COUNTERS:
547  if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
548  abi_breakage();
549  break;
550  case NFTA_CHAIN_POLICY:
551  case NFTA_CHAIN_USE:
552  case NFTA_CHAIN_FLAGS:
553  case NFTA_CHAIN_ID:
554  if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
555  abi_breakage();
556  break;
557  case NFTA_CHAIN_HANDLE:
558  if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
559  abi_breakage();
560  break;
561  case NFTA_CHAIN_USERDATA:
562  if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0)
563  abi_breakage();
564  break;
565  }
566 
567  tb[type] = attr;
568  return MNL_CB_OK;
569 }
570 
571 static int nftnl_chain_parse_counters_cb(const struct nlattr *attr, void *data)
572 {
573  const struct nlattr **tb = data;
574  int type = mnl_attr_get_type(attr);
575 
576  if (mnl_attr_type_valid(attr, NFTA_COUNTER_MAX) < 0)
577  return MNL_CB_OK;
578 
579  switch(type) {
580  case NFTA_COUNTER_BYTES:
581  case NFTA_COUNTER_PACKETS:
582  if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
583  abi_breakage();
584  break;
585  }
586 
587  tb[type] = attr;
588  return MNL_CB_OK;
589 }
590 
591 static int nftnl_chain_parse_counters(struct nlattr *attr, struct nftnl_chain *c)
592 {
593  struct nlattr *tb[NFTA_COUNTER_MAX+1] = {};
594 
595  if (mnl_attr_parse_nested(attr, nftnl_chain_parse_counters_cb, tb) < 0)
596  return -1;
597 
598  if (tb[NFTA_COUNTER_PACKETS]) {
599  c->packets = be64toh(mnl_attr_get_u64(tb[NFTA_COUNTER_PACKETS]));
600  c->flags |= (1 << NFTNL_CHAIN_PACKETS);
601  }
602  if (tb[NFTA_COUNTER_BYTES]) {
603  c->bytes = be64toh(mnl_attr_get_u64(tb[NFTA_COUNTER_BYTES]));
604  c->flags |= (1 << NFTNL_CHAIN_BYTES);
605  }
606 
607  return 0;
608 }
609 
610 static int nftnl_chain_parse_hook_cb(const struct nlattr *attr, void *data)
611 {
612  const struct nlattr **tb = data;
613  int type = mnl_attr_get_type(attr);
614 
615  if (mnl_attr_type_valid(attr, NFTA_HOOK_MAX) < 0)
616  return MNL_CB_OK;
617 
618  switch(type) {
619  case NFTA_HOOK_HOOKNUM:
620  case NFTA_HOOK_PRIORITY:
621  if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
622  abi_breakage();
623  break;
624  case NFTA_HOOK_DEV:
625  if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
626  abi_breakage();
627  break;
628  }
629 
630  tb[type] = attr;
631  return MNL_CB_OK;
632 }
633 
634 static int nftnl_chain_parse_hook(struct nlattr *attr, struct nftnl_chain *c)
635 {
636  struct nlattr *tb[NFTA_HOOK_MAX+1] = {};
637  int ret;
638 
639  if (mnl_attr_parse_nested(attr, nftnl_chain_parse_hook_cb, tb) < 0)
640  return -1;
641 
642  if (tb[NFTA_HOOK_HOOKNUM]) {
643  c->hooknum = ntohl(mnl_attr_get_u32(tb[NFTA_HOOK_HOOKNUM]));
644  c->flags |= (1 << NFTNL_CHAIN_HOOKNUM);
645  }
646  if (tb[NFTA_HOOK_PRIORITY]) {
647  c->prio = ntohl(mnl_attr_get_u32(tb[NFTA_HOOK_PRIORITY]));
648  c->flags |= (1 << NFTNL_CHAIN_PRIO);
649  }
650  if (tb[NFTA_HOOK_DEV]) {
651  c->dev = strdup(mnl_attr_get_str(tb[NFTA_HOOK_DEV]));
652  if (!c->dev)
653  return -1;
654  c->flags |= (1 << NFTNL_CHAIN_DEV);
655  }
656  if (tb[NFTA_HOOK_DEVS]) {
657  ret = nftnl_parse_devs(&c->dev_array, tb[NFTA_HOOK_DEVS]);
658  if (ret < 0)
659  return -1;
660  c->flags |= (1 << NFTNL_CHAIN_DEVICES);
661  }
662 
663  return 0;
664 }
665 
666 EXPORT_SYMBOL(nftnl_chain_nlmsg_parse);
667 int nftnl_chain_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_chain *c)
668 {
669  struct nlattr *tb[NFTA_CHAIN_MAX+1] = {};
670  struct nfgenmsg *nfg = mnl_nlmsg_get_payload(nlh);
671  int ret = 0;
672 
673  if (mnl_attr_parse(nlh, sizeof(*nfg), nftnl_chain_parse_attr_cb, tb) < 0)
674  return -1;
675 
676  if (tb[NFTA_CHAIN_NAME]) {
677  if (c->flags & (1 << NFTNL_CHAIN_NAME))
678  xfree(c->name);
679  c->name = strdup(mnl_attr_get_str(tb[NFTA_CHAIN_NAME]));
680  if (!c->name)
681  return -1;
682  c->flags |= (1 << NFTNL_CHAIN_NAME);
683  }
684  if (tb[NFTA_CHAIN_TABLE]) {
685  if (c->flags & (1 << NFTNL_CHAIN_TABLE))
686  xfree(c->table);
687  c->table = strdup(mnl_attr_get_str(tb[NFTA_CHAIN_TABLE]));
688  if (!c->table)
689  return -1;
690  c->flags |= (1 << NFTNL_CHAIN_TABLE);
691  }
692  if (tb[NFTA_CHAIN_HOOK]) {
693  ret = nftnl_chain_parse_hook(tb[NFTA_CHAIN_HOOK], c);
694  if (ret < 0)
695  return ret;
696  }
697  if (tb[NFTA_CHAIN_POLICY]) {
698  c->policy = ntohl(mnl_attr_get_u32(tb[NFTA_CHAIN_POLICY]));
699  c->flags |= (1 << NFTNL_CHAIN_POLICY);
700  }
701  if (tb[NFTA_CHAIN_USE]) {
702  c->use = ntohl(mnl_attr_get_u32(tb[NFTA_CHAIN_USE]));
703  c->flags |= (1 << NFTNL_CHAIN_USE);
704  }
705  if (tb[NFTA_CHAIN_COUNTERS]) {
706  ret = nftnl_chain_parse_counters(tb[NFTA_CHAIN_COUNTERS], c);
707  if (ret < 0)
708  return ret;
709  }
710  if (tb[NFTA_CHAIN_HANDLE]) {
711  c->handle = be64toh(mnl_attr_get_u64(tb[NFTA_CHAIN_HANDLE]));
712  c->flags |= (1 << NFTNL_CHAIN_HANDLE);
713  }
714  if (tb[NFTA_CHAIN_TYPE]) {
715  if (c->flags & (1 << NFTNL_CHAIN_TYPE))
716  xfree(c->type);
717  c->type = strdup(mnl_attr_get_str(tb[NFTA_CHAIN_TYPE]));
718  if (!c->type)
719  return -1;
720  c->flags |= (1 << NFTNL_CHAIN_TYPE);
721  }
722  if (tb[NFTA_CHAIN_FLAGS]) {
723  c->chain_flags = ntohl(mnl_attr_get_u32(tb[NFTA_CHAIN_FLAGS]));
724  c->flags |= (1 << NFTNL_CHAIN_FLAGS);
725  }
726  if (tb[NFTA_CHAIN_ID]) {
727  c->chain_id = ntohl(mnl_attr_get_u32(tb[NFTA_CHAIN_ID]));
728  c->flags |= (1 << NFTNL_CHAIN_ID);
729  }
730  if (tb[NFTA_CHAIN_USERDATA]) {
731  nftnl_chain_set_data(c, NFTNL_CHAIN_USERDATA,
732  mnl_attr_get_payload(tb[NFTA_CHAIN_USERDATA]),
733  mnl_attr_get_payload_len(tb[NFTA_CHAIN_USERDATA]));
734  }
735 
736  c->family = nfg->nfgen_family;
737  c->flags |= (1 << NFTNL_CHAIN_FAMILY);
738 
739  return ret;
740 }
741 
742 static int nftnl_chain_snprintf_default(char *buf, size_t remain,
743  const struct nftnl_chain *c)
744 {
745  int ret, offset = 0, i;
746  const char *dev;
747 
748  ret = snprintf(buf, remain, "%s %s %s use %u",
749  nftnl_family2str(c->family), c->table, c->name, c->use);
750  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
751 
752  if (c->flags & (1 << NFTNL_CHAIN_HOOKNUM)) {
753  ret = snprintf(buf + offset, remain, " type %s hook %s prio %d",
754  c->type, nftnl_hooknum2str(c->family, c->hooknum),
755  c->prio);
756  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
757 
758  if (c->flags & (1 << NFTNL_CHAIN_POLICY)) {
759  ret = snprintf(buf + offset, remain, " policy %s",
760  nftnl_verdict2str(c->policy));
761  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
762  }
763 
764  ret = snprintf(buf + offset, remain,
765  " packets %"PRIu64" bytes %"PRIu64"",
766  c->packets, c->bytes);
767  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
768 
769  if (c->flags & (1 << NFTNL_CHAIN_DEV)) {
770  ret = snprintf(buf + offset, remain, " dev %s ",
771  c->dev);
772  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
773  }
774  if (c->flags & (1 << NFTNL_CHAIN_DEVICES)) {
775  ret = snprintf(buf + offset, remain, " dev { ");
776  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
777 
778  nftnl_str_array_foreach(dev, &c->dev_array, i) {
779  ret = snprintf(buf + offset, remain, " %s ",
780  dev);
781  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
782  }
783  ret = snprintf(buf + offset, remain, " } ");
784  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
785  }
786  if (c->flags & (1 << NFTNL_CHAIN_FLAGS)) {
787  ret = snprintf(buf + offset, remain, " flags %x",
788  c->chain_flags);
789  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
790  }
791  if (c->flags & (1 << NFTNL_CHAIN_ID)) {
792  ret = snprintf(buf + offset, remain, " id %x",
793  c->chain_id);
794  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
795  }
796  }
797 
798  return offset;
799 }
800 
801 static int nftnl_chain_cmd_snprintf(char *buf, size_t remain,
802  const struct nftnl_chain *c, uint32_t cmd,
803  uint32_t type, uint32_t flags)
804 {
805  int ret, offset = 0;
806 
807  if (type != NFTNL_OUTPUT_DEFAULT)
808  return -1;
809 
810  ret = nftnl_chain_snprintf_default(buf + offset, remain, c);
811  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
812  return offset;
813 }
814 
815 EXPORT_SYMBOL(nftnl_chain_snprintf);
816 int nftnl_chain_snprintf(char *buf, size_t size, const struct nftnl_chain *c,
817  uint32_t type, uint32_t flags)
818 {
819  if (size)
820  buf[0] = '\0';
821 
822  return nftnl_chain_cmd_snprintf(buf, size, c, nftnl_flag2cmd(flags),
823  type, flags);
824 }
825 
826 static int nftnl_chain_do_snprintf(char *buf, size_t size, const void *c,
827  uint32_t cmd, uint32_t type, uint32_t flags)
828 {
829  return nftnl_chain_snprintf(buf, size, c, type, flags);
830 }
831 
832 EXPORT_SYMBOL(nftnl_chain_fprintf);
833 int nftnl_chain_fprintf(FILE *fp, const struct nftnl_chain *c, uint32_t type,
834  uint32_t flags)
835 {
836  return nftnl_fprintf(fp, c, NFTNL_CMD_UNSPEC, type, flags,
837  nftnl_chain_do_snprintf);
838 }
839 
840 EXPORT_SYMBOL(nftnl_rule_foreach);
841 int nftnl_rule_foreach(struct nftnl_chain *c,
842  int (*cb)(struct nftnl_rule *r, void *data),
843  void *data)
844 {
845  struct nftnl_rule *cur, *tmp;
846  int ret;
847 
848  list_for_each_entry_safe(cur, tmp, &c->rule_list, head) {
849  ret = cb(cur, data);
850  if (ret < 0)
851  return ret;
852  }
853  return 0;
854 }
855 
856 EXPORT_SYMBOL(nftnl_rule_lookup_byindex);
857 struct nftnl_rule *
858 nftnl_rule_lookup_byindex(struct nftnl_chain *c, uint32_t index)
859 {
860  struct nftnl_rule *r;
861 
862  list_for_each_entry(r, &c->rule_list, head) {
863  if (!index)
864  return r;
865  index--;
866  }
867  return NULL;
868 }
869 
871  const struct nftnl_chain *c;
872  struct nftnl_rule *cur;
873 };
874 
875 static void nftnl_rule_iter_init(const struct nftnl_chain *c,
876  struct nftnl_rule_iter *iter)
877 {
878  iter->c = c;
879  if (list_empty(&c->rule_list))
880  iter->cur = NULL;
881  else
882  iter->cur = list_entry(c->rule_list.next, struct nftnl_rule,
883  head);
884 }
885 
886 EXPORT_SYMBOL(nftnl_rule_iter_create);
887 struct nftnl_rule_iter *nftnl_rule_iter_create(const struct nftnl_chain *c)
888 {
889  struct nftnl_rule_iter *iter;
890 
891  iter = calloc(1, sizeof(struct nftnl_rule_iter));
892  if (iter == NULL)
893  return NULL;
894 
895  nftnl_rule_iter_init(c, iter);
896 
897  return iter;
898 }
899 
900 EXPORT_SYMBOL(nftnl_rule_iter_next);
901 struct nftnl_rule *nftnl_rule_iter_next(struct nftnl_rule_iter *iter)
902 {
903  struct nftnl_rule *rule = iter->cur;
904 
905  if (rule == NULL)
906  return NULL;
907 
908  /* get next rule, if any */
909  iter->cur = list_entry(iter->cur->head.next, struct nftnl_rule, head);
910  if (&iter->cur->head == iter->c->rule_list.next)
911  return NULL;
912 
913  return rule;
914 }
915 
916 EXPORT_SYMBOL(nftnl_rule_iter_destroy);
917 void nftnl_rule_iter_destroy(struct nftnl_rule_iter *iter)
918 {
919  xfree(iter);
920 }
921 
922 #define CHAIN_NAME_HSIZE 512
923 
925 
926  struct list_head list;
927  struct hlist_head name_hash[CHAIN_NAME_HSIZE];
928 };
929 
930 EXPORT_SYMBOL(nftnl_chain_list_alloc);
931 struct nftnl_chain_list *nftnl_chain_list_alloc(void)
932 {
933  struct nftnl_chain_list *list;
934  int i;
935 
936  list = calloc(1, sizeof(struct nftnl_chain_list));
937  if (list == NULL)
938  return NULL;
939 
940  INIT_LIST_HEAD(&list->list);
941  for (i = 0; i < CHAIN_NAME_HSIZE; i++)
942  INIT_HLIST_HEAD(&list->name_hash[i]);
943 
944  return list;
945 }
946 
947 EXPORT_SYMBOL(nftnl_chain_list_free);
948 void nftnl_chain_list_free(struct nftnl_chain_list *list)
949 {
950  struct nftnl_chain *r, *tmp;
951 
952  list_for_each_entry_safe(r, tmp, &list->list, head) {
953  list_del(&r->head);
954  hlist_del(&r->hnode);
955  nftnl_chain_free(r);
956  }
957  xfree(list);
958 }
959 
960 EXPORT_SYMBOL(nftnl_chain_list_is_empty);
961 int nftnl_chain_list_is_empty(const struct nftnl_chain_list *list)
962 {
963  return list_empty(&list->list);
964 }
965 
966 static uint32_t djb_hash(const char *key)
967 {
968  uint32_t i, hash = 5381;
969 
970  for (i = 0; i < strlen(key); i++)
971  hash = ((hash << 5) + hash) + key[i];
972 
973  return hash;
974 }
975 
976 EXPORT_SYMBOL(nftnl_chain_list_add);
977 void nftnl_chain_list_add(struct nftnl_chain *r, struct nftnl_chain_list *list)
978 {
979  int key = djb_hash(r->name) % CHAIN_NAME_HSIZE;
980 
981  hlist_add_head(&r->hnode, &list->name_hash[key]);
982  list_add(&r->head, &list->list);
983 }
984 
985 EXPORT_SYMBOL(nftnl_chain_list_add_tail);
986 void nftnl_chain_list_add_tail(struct nftnl_chain *r, struct nftnl_chain_list *list)
987 {
988  int key = djb_hash(r->name) % CHAIN_NAME_HSIZE;
989 
990  hlist_add_head(&r->hnode, &list->name_hash[key]);
991  list_add_tail(&r->head, &list->list);
992 }
993 
994 EXPORT_SYMBOL(nftnl_chain_list_del);
995 void nftnl_chain_list_del(struct nftnl_chain *r)
996 {
997  list_del(&r->head);
998  hlist_del(&r->hnode);
999 }
1000 
1001 EXPORT_SYMBOL(nftnl_chain_list_foreach);
1002 int nftnl_chain_list_foreach(struct nftnl_chain_list *chain_list,
1003  int (*cb)(struct nftnl_chain *r, void *data),
1004  void *data)
1005 {
1006  struct nftnl_chain *cur, *tmp;
1007  int ret;
1008 
1009  list_for_each_entry_safe(cur, tmp, &chain_list->list, head) {
1010  ret = cb(cur, data);
1011  if (ret < 0)
1012  return ret;
1013  }
1014  return 0;
1015 }
1016 
1017 EXPORT_SYMBOL(nftnl_chain_list_lookup_byname);
1018 struct nftnl_chain *
1019 nftnl_chain_list_lookup_byname(struct nftnl_chain_list *chain_list,
1020  const char *chain)
1021 {
1022  int key = djb_hash(chain) % CHAIN_NAME_HSIZE;
1023  struct nftnl_chain *c;
1024  struct hlist_node *n;
1025 
1026  hlist_for_each_entry(c, n, &chain_list->name_hash[key], hnode) {
1027  if (!strcmp(chain, c->name))
1028  return c;
1029  }
1030  return NULL;
1031 }
1032 
1034  const struct nftnl_chain_list *list;
1035  struct nftnl_chain *cur;
1036 };
1037 
1038 EXPORT_SYMBOL(nftnl_chain_list_iter_create);
1039 struct nftnl_chain_list_iter *
1040 nftnl_chain_list_iter_create(const struct nftnl_chain_list *l)
1041 {
1042  struct nftnl_chain_list_iter *iter;
1043 
1044  iter = calloc(1, sizeof(struct nftnl_chain_list_iter));
1045  if (iter == NULL)
1046  return NULL;
1047 
1048  iter->list = l;
1049  if (nftnl_chain_list_is_empty(l))
1050  iter->cur = NULL;
1051  else
1052  iter->cur = list_entry(l->list.next, struct nftnl_chain, head);
1053 
1054  return iter;
1055 }
1056 
1057 EXPORT_SYMBOL(nftnl_chain_list_iter_next);
1058 struct nftnl_chain *nftnl_chain_list_iter_next(struct nftnl_chain_list_iter *iter)
1059 {
1060  struct nftnl_chain *r = iter->cur;
1061 
1062  if (r == NULL)
1063  return NULL;
1064 
1065  /* get next chain, if any */
1066  iter->cur = list_entry(iter->cur->head.next, struct nftnl_chain, head);
1067  if (&iter->cur->head == iter->list->list.next)
1068  return NULL;
1069 
1070  return r;
1071 }
1072 
1073 EXPORT_SYMBOL(nftnl_chain_list_iter_destroy);
1074 void nftnl_chain_list_iter_destroy(struct nftnl_chain_list_iter *iter)
1075 {
1076  xfree(iter);
1077 }