libnftnl  1.2.9
dynset.c
1 /* SPDX-License-Identifier: GPL-2.0-or-later */
2 /*
3  * Copyright (c) 2014, 2015 Patrick McHardy <kaber@trash.net>
4  */
5 
6 #include "internal.h"
7 
8 #include <stdio.h>
9 #include <stdint.h>
10 #include <inttypes.h>
11 #include <errno.h>
12 #include <arpa/inet.h>
13 #include <libmnl/libmnl.h>
14 #include <linux/netfilter/nf_tables.h>
15 #include <libnftnl/rule.h>
16 #include <libnftnl/expr.h>
17 #include "data_reg.h"
18 #include "expr_ops.h"
19 
21  enum nft_registers sreg_key;
22  enum nft_registers sreg_data;
23  enum nft_dynset_ops op;
24  uint64_t timeout;
25  struct list_head expr_list;
26  char *set_name;
27  uint32_t set_id;
28  uint32_t dynset_flags;
29 };
30 
31 static int
32 nftnl_expr_dynset_set(struct nftnl_expr *e, uint16_t type,
33  const void *data, uint32_t data_len)
34 {
35  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
36  struct nftnl_expr *expr, *next;
37 
38  switch (type) {
39  case NFTNL_EXPR_DYNSET_SREG_KEY:
40  memcpy(&dynset->sreg_key, data, data_len);
41  break;
42  case NFTNL_EXPR_DYNSET_SREG_DATA:
43  memcpy(&dynset->sreg_data, data, data_len);
44  break;
45  case NFTNL_EXPR_DYNSET_OP:
46  memcpy(&dynset->op, data, data_len);
47  break;
48  case NFTNL_EXPR_DYNSET_TIMEOUT:
49  memcpy(&dynset->timeout, data, data_len);
50  break;
51  case NFTNL_EXPR_DYNSET_SET_NAME:
52  dynset->set_name = strdup((const char *)data);
53  if (!dynset->set_name)
54  return -1;
55  break;
56  case NFTNL_EXPR_DYNSET_SET_ID:
57  memcpy(&dynset->set_id, data, data_len);
58  break;
59  case NFTNL_EXPR_DYNSET_EXPR:
60  list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
61  nftnl_expr_free(expr);
62 
63  expr = (void *)data;
64  list_add(&expr->head, &dynset->expr_list);
65  break;
66  case NFTNL_EXPR_DYNSET_FLAGS:
67  memcpy(&dynset->dynset_flags, data, data_len);
68  break;
69  default:
70  return -1;
71  }
72  return 0;
73 }
74 
75 static const void *
76 nftnl_expr_dynset_get(const struct nftnl_expr *e, uint16_t type,
77  uint32_t *data_len)
78 {
79  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
80  struct nftnl_expr *expr;
81 
82  switch (type) {
83  case NFTNL_EXPR_DYNSET_SREG_KEY:
84  *data_len = sizeof(dynset->sreg_key);
85  return &dynset->sreg_key;
86  case NFTNL_EXPR_DYNSET_SREG_DATA:
87  *data_len = sizeof(dynset->sreg_data);
88  return &dynset->sreg_data;
89  case NFTNL_EXPR_DYNSET_OP:
90  *data_len = sizeof(dynset->op);
91  return &dynset->op;
92  case NFTNL_EXPR_DYNSET_TIMEOUT:
93  *data_len = sizeof(dynset->timeout);
94  return &dynset->timeout;
95  case NFTNL_EXPR_DYNSET_SET_NAME:
96  *data_len = strlen(dynset->set_name) + 1;
97  return dynset->set_name;
98  case NFTNL_EXPR_DYNSET_SET_ID:
99  *data_len = sizeof(dynset->set_id);
100  return &dynset->set_id;
101  case NFTNL_EXPR_DYNSET_EXPR:
102  list_for_each_entry(expr, &dynset->expr_list, head)
103  break;
104  return expr;
105  case NFTNL_EXPR_DYNSET_FLAGS:
106  *data_len = sizeof(dynset->dynset_flags);
107  return &dynset->dynset_flags;
108  }
109  return NULL;
110 }
111 
112 static int nftnl_expr_dynset_cb(const struct nlattr *attr, void *data)
113 {
114  const struct nlattr **tb = data;
115  int type = mnl_attr_get_type(attr);
116 
117  if (mnl_attr_type_valid(attr, NFTA_DYNSET_MAX) < 0)
118  return MNL_CB_OK;
119 
120  switch (type) {
121  case NFTA_DYNSET_SREG_KEY:
122  case NFTA_DYNSET_SREG_DATA:
123  case NFTA_DYNSET_SET_ID:
124  case NFTA_DYNSET_OP:
125  case NFTA_DYNSET_FLAGS:
126  if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
127  abi_breakage();
128  break;
129  case NFTA_DYNSET_TIMEOUT:
130  if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
131  abi_breakage();
132  break;
133  case NFTA_DYNSET_SET_NAME:
134  if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
135  abi_breakage();
136  break;
137  case NFTA_DYNSET_EXPR:
138  case NFTA_DYNSET_EXPRESSIONS:
139  if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
140  abi_breakage();
141  break;
142  }
143 
144  tb[type] = attr;
145  return MNL_CB_OK;
146 }
147 
148 static void
149 nftnl_expr_dynset_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
150 {
151  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
152  struct nlattr *nest;
153  int num_exprs = 0;
154 
155  if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_KEY))
156  mnl_attr_put_u32(nlh, NFTA_DYNSET_SREG_KEY, htonl(dynset->sreg_key));
157  if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_DATA))
158  mnl_attr_put_u32(nlh, NFTA_DYNSET_SREG_DATA, htonl(dynset->sreg_data));
159  if (e->flags & (1 << NFTNL_EXPR_DYNSET_OP))
160  mnl_attr_put_u32(nlh, NFTA_DYNSET_OP, htonl(dynset->op));
161  if (e->flags & (1 << NFTNL_EXPR_DYNSET_TIMEOUT))
162  mnl_attr_put_u64(nlh, NFTA_DYNSET_TIMEOUT, htobe64(dynset->timeout));
163  if (e->flags & (1 << NFTNL_EXPR_DYNSET_SET_NAME))
164  mnl_attr_put_strz(nlh, NFTA_DYNSET_SET_NAME, dynset->set_name);
165  if (e->flags & (1 << NFTNL_EXPR_DYNSET_SET_ID))
166  mnl_attr_put_u32(nlh, NFTA_DYNSET_SET_ID, htonl(dynset->set_id));
167  if (!list_empty(&dynset->expr_list)) {
168  struct nftnl_expr *expr;
169 
170  list_for_each_entry(expr, &dynset->expr_list, head)
171  num_exprs++;
172 
173  if (num_exprs == 1) {
174  nest = mnl_attr_nest_start(nlh, NFTA_DYNSET_EXPR);
175  list_for_each_entry(expr, &dynset->expr_list, head)
176  nftnl_expr_build_payload(nlh, expr);
177  mnl_attr_nest_end(nlh, nest);
178  } else if (num_exprs > 1) {
179  struct nlattr *nest1, *nest2;
180 
181  nest1 = mnl_attr_nest_start(nlh, NFTA_DYNSET_EXPRESSIONS);
182  list_for_each_entry(expr, &dynset->expr_list, head) {
183  nest2 = mnl_attr_nest_start(nlh, NFTA_LIST_ELEM);
184  nftnl_expr_build_payload(nlh, expr);
185  mnl_attr_nest_end(nlh, nest2);
186  }
187  mnl_attr_nest_end(nlh, nest1);
188  }
189  }
190  if (e->flags & (1 << NFTNL_EXPR_DYNSET_FLAGS))
191  mnl_attr_put_u32(nlh, NFTA_DYNSET_FLAGS,
192  htonl(dynset->dynset_flags));
193 }
194 
195 EXPORT_SYMBOL(nftnl_expr_add_expr);
196 void nftnl_expr_add_expr(struct nftnl_expr *e, uint32_t type,
197  struct nftnl_expr *expr)
198 {
199  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
200 
201  list_add_tail(&expr->head, &dynset->expr_list);
202 }
203 
204 EXPORT_SYMBOL(nftnl_expr_expr_foreach);
205 int nftnl_expr_expr_foreach(const struct nftnl_expr *e,
206  int (*cb)(struct nftnl_expr *e, void *data),
207  void *data)
208 {
209  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
210  struct nftnl_expr *cur, *tmp;
211  int ret;
212 
213  list_for_each_entry_safe(cur, tmp, &dynset->expr_list, head) {
214  ret = cb(cur, data);
215  if (ret < 0)
216  return ret;
217  }
218  return 0;
219 }
220 
221 static int
222 nftnl_expr_dynset_parse(struct nftnl_expr *e, struct nlattr *attr)
223 {
224  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
225  struct nlattr *tb[NFTA_DYNSET_MAX+1] = {};
226  struct nftnl_expr *expr, *next;
227  int ret = 0;
228 
229  if (mnl_attr_parse_nested(attr, nftnl_expr_dynset_cb, tb) < 0)
230  return -1;
231 
232  if (tb[NFTA_DYNSET_SREG_KEY]) {
233  dynset->sreg_key = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SREG_KEY]));
234  e->flags |= (1 << NFTNL_EXPR_DYNSET_SREG_KEY);
235  }
236  if (tb[NFTA_DYNSET_SREG_DATA]) {
237  dynset->sreg_data = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SREG_DATA]));
238  e->flags |= (1 << NFTNL_EXPR_DYNSET_SREG_DATA);
239  }
240  if (tb[NFTA_DYNSET_OP]) {
241  dynset->op = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_OP]));
242  e->flags |= (1 << NFTNL_EXPR_DYNSET_OP);
243  }
244  if (tb[NFTA_DYNSET_TIMEOUT]) {
245  dynset->timeout = be64toh(mnl_attr_get_u64(tb[NFTA_DYNSET_TIMEOUT]));
246  e->flags |= (1 << NFTNL_EXPR_DYNSET_TIMEOUT);
247  }
248  if (tb[NFTA_DYNSET_SET_NAME]) {
249  dynset->set_name =
250  strdup(mnl_attr_get_str(tb[NFTA_DYNSET_SET_NAME]));
251  if (!dynset->set_name)
252  return -1;
253  e->flags |= (1 << NFTNL_EXPR_DYNSET_SET_NAME);
254  }
255  if (tb[NFTA_DYNSET_SET_ID]) {
256  dynset->set_id = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SET_ID]));
257  e->flags |= (1 << NFTNL_EXPR_DYNSET_SET_ID);
258  }
259  if (tb[NFTA_DYNSET_EXPR]) {
260  expr = nftnl_expr_parse(tb[NFTA_DYNSET_EXPR]);
261  if (expr == NULL)
262  return -1;
263 
264  list_add(&expr->head, &dynset->expr_list);
265  e->flags |= (1 << NFTNL_EXPR_DYNSET_EXPR);
266  } else if (tb[NFTA_DYNSET_EXPRESSIONS]) {
267  struct nlattr *attr2;
268 
269  mnl_attr_for_each_nested(attr2, tb[NFTA_DYNSET_EXPRESSIONS]) {
270  if (mnl_attr_get_type(attr2) != NFTA_LIST_ELEM)
271  goto out_dynset_expr;
272 
273  expr = nftnl_expr_parse(attr2);
274  if (!expr)
275  goto out_dynset_expr;
276 
277  list_add_tail(&expr->head, &dynset->expr_list);
278  }
279  e->flags |= (1 << NFTNL_EXPR_DYNSET_EXPRESSIONS);
280  }
281  if (tb[NFTA_DYNSET_FLAGS]) {
282  dynset->dynset_flags = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_FLAGS]));
283  e->flags |= (1 << NFTNL_EXPR_DYNSET_FLAGS);
284  }
285 
286  return ret;
287 out_dynset_expr:
288  list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
289  nftnl_expr_free(expr);
290 
291  return -1;
292 }
293 
294 static const char *op2str_array[] = {
295  [NFT_DYNSET_OP_ADD] = "add",
296  [NFT_DYNSET_OP_UPDATE] = "update",
297  [NFT_DYNSET_OP_DELETE] = "delete",
298 };
299 
300 static const char *op2str(enum nft_dynset_ops op)
301 {
302  if (op > NFT_DYNSET_OP_DELETE)
303  return "unknown";
304  return op2str_array[op];
305 }
306 
307 static int
308 nftnl_expr_dynset_snprintf(char *buf, size_t remain,
309  uint32_t flags, const struct nftnl_expr *e)
310 {
311  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
312  struct nftnl_expr *expr;
313  int offset = 0, ret;
314 
315  ret = snprintf(buf, remain, "%s reg_key %u set %s ",
316  op2str(dynset->op), dynset->sreg_key, dynset->set_name);
317  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
318 
319  if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_DATA)) {
320  ret = snprintf(buf + offset, remain, "sreg_data %u ",
321  dynset->sreg_data);
322  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
323  }
324  if (e->flags & (1 << NFTNL_EXPR_DYNSET_TIMEOUT)) {
325  ret = snprintf(buf + offset, remain, "timeout %"PRIu64"ms ",
326  dynset->timeout);
327  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
328  }
329  list_for_each_entry(expr, &dynset->expr_list, head) {
330  ret = snprintf(buf + offset, remain, "expr [ %s ",
331  expr->ops->name);
332  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
333 
334  ret = nftnl_expr_snprintf(buf + offset, remain, expr,
335  NFTNL_OUTPUT_DEFAULT,
336  NFTNL_OF_EVENT_ANY);
337  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
338 
339  ret = snprintf(buf + offset, remain, "] ");
340  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
341  }
342 
343  return offset;
344 }
345 
346 static void nftnl_expr_dynset_init(const struct nftnl_expr *e)
347 {
348  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
349 
350  INIT_LIST_HEAD(&dynset->expr_list);
351 }
352 
353 static void nftnl_expr_dynset_free(const struct nftnl_expr *e)
354 {
355  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
356  struct nftnl_expr *expr, *next;
357 
358  xfree(dynset->set_name);
359  list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
360  nftnl_expr_free(expr);
361 }
362 
363 static struct attr_policy dynset_attr_policy[__NFTNL_EXPR_DYNSET_MAX] = {
364  [NFTNL_EXPR_DYNSET_SREG_KEY] = { .maxlen = sizeof(uint32_t) },
365  [NFTNL_EXPR_DYNSET_SREG_DATA] = { .maxlen = sizeof(uint32_t) },
366  [NFTNL_EXPR_DYNSET_OP] = { .maxlen = sizeof(uint32_t) },
367  [NFTNL_EXPR_DYNSET_TIMEOUT] = { .maxlen = sizeof(uint64_t) },
368  [NFTNL_EXPR_DYNSET_SET_NAME] = { .maxlen = NFT_SET_MAXNAMELEN },
369  [NFTNL_EXPR_DYNSET_SET_ID] = { .maxlen = sizeof(uint32_t) },
370  [NFTNL_EXPR_DYNSET_EXPR] = { .maxlen = 0 },
371  [NFTNL_EXPR_DYNSET_EXPRESSIONS] = { .maxlen = 0 },
372  [NFTNL_EXPR_DYNSET_FLAGS] = { .maxlen = sizeof(uint32_t) },
373 };
374 
375 struct expr_ops expr_ops_dynset = {
376  .name = "dynset",
377  .alloc_len = sizeof(struct nftnl_expr_dynset),
378  .nftnl_max_attr = __NFTNL_EXPR_DYNSET_MAX - 1,
379  .attr_policy = dynset_attr_policy,
380  .init = nftnl_expr_dynset_init,
381  .free = nftnl_expr_dynset_free,
382  .set = nftnl_expr_dynset_set,
383  .get = nftnl_expr_dynset_get,
384  .parse = nftnl_expr_dynset_parse,
385  .build = nftnl_expr_dynset_build,
386  .output = nftnl_expr_dynset_snprintf,
387 };