libnftnl  1.2.0
dynset.c
1 /*
2  * Copyright (c) 2014, 2015 Patrick McHardy <kaber@trash.net>
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License as published
6  * by the Free Software Foundation; either version 2 of the License, or
7  * (at your option) any later version.
8  */
9 
10 #include "internal.h"
11 
12 #include <stdio.h>
13 #include <stdint.h>
14 #include <inttypes.h>
15 #include <errno.h>
16 #include <arpa/inet.h>
17 #include <libmnl/libmnl.h>
18 #include <linux/netfilter/nf_tables.h>
19 #include <libnftnl/rule.h>
20 #include <libnftnl/expr.h>
21 #include "data_reg.h"
22 #include "expr_ops.h"
23 
25  enum nft_registers sreg_key;
26  enum nft_registers sreg_data;
27  enum nft_dynset_ops op;
28  uint64_t timeout;
29  struct list_head expr_list;
30  char *set_name;
31  uint32_t set_id;
32  uint32_t dynset_flags;
33 };
34 
35 static int
36 nftnl_expr_dynset_set(struct nftnl_expr *e, uint16_t type,
37  const void *data, uint32_t data_len)
38 {
39  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
40  struct nftnl_expr *expr, *next;
41 
42  switch (type) {
43  case NFTNL_EXPR_DYNSET_SREG_KEY:
44  memcpy(&dynset->sreg_key, data, sizeof(dynset->sreg_key));
45  break;
46  case NFTNL_EXPR_DYNSET_SREG_DATA:
47  memcpy(&dynset->sreg_data, data, sizeof(dynset->sreg_data));
48  break;
49  case NFTNL_EXPR_DYNSET_OP:
50  memcpy(&dynset->op, data, sizeof(dynset->op));
51  break;
52  case NFTNL_EXPR_DYNSET_TIMEOUT:
53  memcpy(&dynset->timeout, data, sizeof(dynset->timeout));
54  break;
55  case NFTNL_EXPR_DYNSET_SET_NAME:
56  dynset->set_name = strdup((const char *)data);
57  if (!dynset->set_name)
58  return -1;
59  break;
60  case NFTNL_EXPR_DYNSET_SET_ID:
61  memcpy(&dynset->set_id, data, sizeof(dynset->set_id));
62  break;
63  case NFTNL_EXPR_DYNSET_EXPR:
64  list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
65  nftnl_expr_free(expr);
66 
67  expr = (void *)data;
68  list_add(&expr->head, &dynset->expr_list);
69  break;
70  case NFTNL_EXPR_DYNSET_FLAGS:
71  memcpy(&dynset->dynset_flags, data, sizeof(dynset->dynset_flags));
72  break;
73  default:
74  return -1;
75  }
76  return 0;
77 }
78 
79 static const void *
80 nftnl_expr_dynset_get(const struct nftnl_expr *e, uint16_t type,
81  uint32_t *data_len)
82 {
83  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
84  struct nftnl_expr *expr;
85 
86  switch (type) {
87  case NFTNL_EXPR_DYNSET_SREG_KEY:
88  *data_len = sizeof(dynset->sreg_key);
89  return &dynset->sreg_key;
90  case NFTNL_EXPR_DYNSET_SREG_DATA:
91  *data_len = sizeof(dynset->sreg_data);
92  return &dynset->sreg_data;
93  case NFTNL_EXPR_DYNSET_OP:
94  *data_len = sizeof(dynset->op);
95  return &dynset->op;
96  case NFTNL_EXPR_DYNSET_TIMEOUT:
97  *data_len = sizeof(dynset->timeout);
98  return &dynset->timeout;
99  case NFTNL_EXPR_DYNSET_SET_NAME:
100  *data_len = strlen(dynset->set_name) + 1;
101  return dynset->set_name;
102  case NFTNL_EXPR_DYNSET_SET_ID:
103  *data_len = sizeof(dynset->set_id);
104  return &dynset->set_id;
105  case NFTNL_EXPR_DYNSET_EXPR:
106  list_for_each_entry(expr, &dynset->expr_list, head)
107  break;
108  return expr;
109  case NFTNL_EXPR_DYNSET_FLAGS:
110  *data_len = sizeof(dynset->dynset_flags);
111  return &dynset->dynset_flags;
112  }
113  return NULL;
114 }
115 
116 static int nftnl_expr_dynset_cb(const struct nlattr *attr, void *data)
117 {
118  const struct nlattr **tb = data;
119  int type = mnl_attr_get_type(attr);
120 
121  if (mnl_attr_type_valid(attr, NFTA_SET_MAX) < 0)
122  return MNL_CB_OK;
123 
124  switch (type) {
125  case NFTA_DYNSET_SREG_KEY:
126  case NFTA_DYNSET_SREG_DATA:
127  case NFTA_DYNSET_SET_ID:
128  case NFTA_DYNSET_OP:
129  case NFTA_DYNSET_FLAGS:
130  if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
131  abi_breakage();
132  break;
133  case NFTA_DYNSET_TIMEOUT:
134  if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
135  abi_breakage();
136  break;
137  case NFTA_DYNSET_SET_NAME:
138  if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
139  abi_breakage();
140  break;
141  case NFTA_DYNSET_EXPR:
142  if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
143  abi_breakage();
144  break;
145  }
146 
147  tb[type] = attr;
148  return MNL_CB_OK;
149 }
150 
151 static void
152 nftnl_expr_dynset_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
153 {
154  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
155  struct nlattr *nest;
156  int num_exprs = 0;
157 
158  if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_KEY))
159  mnl_attr_put_u32(nlh, NFTA_DYNSET_SREG_KEY, htonl(dynset->sreg_key));
160  if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_DATA))
161  mnl_attr_put_u32(nlh, NFTA_DYNSET_SREG_DATA, htonl(dynset->sreg_data));
162  if (e->flags & (1 << NFTNL_EXPR_DYNSET_OP))
163  mnl_attr_put_u32(nlh, NFTA_DYNSET_OP, htonl(dynset->op));
164  if (e->flags & (1 << NFTNL_EXPR_DYNSET_TIMEOUT))
165  mnl_attr_put_u64(nlh, NFTA_DYNSET_TIMEOUT, htobe64(dynset->timeout));
166  if (e->flags & (1 << NFTNL_EXPR_DYNSET_SET_NAME))
167  mnl_attr_put_strz(nlh, NFTA_DYNSET_SET_NAME, dynset->set_name);
168  if (e->flags & (1 << NFTNL_EXPR_DYNSET_SET_ID))
169  mnl_attr_put_u32(nlh, NFTA_DYNSET_SET_ID, htonl(dynset->set_id));
170  if (!list_empty(&dynset->expr_list)) {
171  struct nftnl_expr *expr;
172 
173  list_for_each_entry(expr, &dynset->expr_list, head)
174  num_exprs++;
175 
176  if (num_exprs == 1) {
177  nest = mnl_attr_nest_start(nlh, NFTA_DYNSET_EXPR);
178  list_for_each_entry(expr, &dynset->expr_list, head)
179  nftnl_expr_build_payload(nlh, expr);
180  mnl_attr_nest_end(nlh, nest);
181  } else if (num_exprs > 1) {
182  struct nlattr *nest1, *nest2;
183 
184  nest1 = mnl_attr_nest_start(nlh, NFTA_DYNSET_EXPRESSIONS);
185  list_for_each_entry(expr, &dynset->expr_list, head) {
186  nest2 = mnl_attr_nest_start(nlh, NFTA_LIST_ELEM);
187  nftnl_expr_build_payload(nlh, expr);
188  mnl_attr_nest_end(nlh, nest2);
189  }
190  mnl_attr_nest_end(nlh, nest1);
191  }
192  }
193  if (e->flags & (1 << NFTNL_EXPR_DYNSET_FLAGS))
194  mnl_attr_put_u32(nlh, NFTA_DYNSET_FLAGS,
195  htonl(dynset->dynset_flags));
196 }
197 
198 EXPORT_SYMBOL(nftnl_expr_add_expr);
199 void nftnl_expr_add_expr(struct nftnl_expr *e, uint32_t type,
200  struct nftnl_expr *expr)
201 {
202  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
203 
204  list_add_tail(&expr->head, &dynset->expr_list);
205 }
206 
207 EXPORT_SYMBOL(nftnl_expr_expr_foreach);
208 int nftnl_expr_expr_foreach(const struct nftnl_expr *e,
209  int (*cb)(struct nftnl_expr *e, void *data),
210  void *data)
211 {
212  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
213  struct nftnl_expr *cur, *tmp;
214  int ret;
215 
216  list_for_each_entry_safe(cur, tmp, &dynset->expr_list, head) {
217  ret = cb(cur, data);
218  if (ret < 0)
219  return ret;
220  }
221  return 0;
222 }
223 
224 static int
225 nftnl_expr_dynset_parse(struct nftnl_expr *e, struct nlattr *attr)
226 {
227  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
228  struct nlattr *tb[NFTA_SET_MAX+1] = {};
229  struct nftnl_expr *expr, *next;
230  int ret = 0;
231 
232  if (mnl_attr_parse_nested(attr, nftnl_expr_dynset_cb, tb) < 0)
233  return -1;
234 
235  if (tb[NFTA_DYNSET_SREG_KEY]) {
236  dynset->sreg_key = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SREG_KEY]));
237  e->flags |= (1 << NFTNL_EXPR_DYNSET_SREG_KEY);
238  }
239  if (tb[NFTA_DYNSET_SREG_DATA]) {
240  dynset->sreg_data = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SREG_DATA]));
241  e->flags |= (1 << NFTNL_EXPR_DYNSET_SREG_DATA);
242  }
243  if (tb[NFTA_DYNSET_OP]) {
244  dynset->op = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_OP]));
245  e->flags |= (1 << NFTNL_EXPR_DYNSET_OP);
246  }
247  if (tb[NFTA_DYNSET_TIMEOUT]) {
248  dynset->timeout = be64toh(mnl_attr_get_u64(tb[NFTA_DYNSET_TIMEOUT]));
249  e->flags |= (1 << NFTNL_EXPR_DYNSET_TIMEOUT);
250  }
251  if (tb[NFTA_DYNSET_SET_NAME]) {
252  dynset->set_name =
253  strdup(mnl_attr_get_str(tb[NFTA_DYNSET_SET_NAME]));
254  if (!dynset->set_name)
255  return -1;
256  e->flags |= (1 << NFTNL_EXPR_DYNSET_SET_NAME);
257  }
258  if (tb[NFTA_DYNSET_SET_ID]) {
259  dynset->set_id = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SET_ID]));
260  e->flags |= (1 << NFTNL_EXPR_DYNSET_SET_ID);
261  }
262  if (tb[NFTA_DYNSET_EXPR]) {
263  expr = nftnl_expr_parse(tb[NFTA_DYNSET_EXPR]);
264  if (expr == NULL)
265  return -1;
266 
267  list_add(&expr->head, &dynset->expr_list);
268  e->flags |= (1 << NFTNL_EXPR_DYNSET_EXPR);
269  } else if (tb[NFTA_DYNSET_EXPRESSIONS]) {
270  struct nlattr *attr2;
271 
272  mnl_attr_for_each_nested(attr2, tb[NFTA_DYNSET_EXPRESSIONS]) {
273  if (mnl_attr_get_type(attr2) != NFTA_LIST_ELEM)
274  goto out_dynset_expr;
275 
276  expr = nftnl_expr_parse(attr2);
277  if (!expr)
278  goto out_dynset_expr;
279 
280  list_add_tail(&expr->head, &dynset->expr_list);
281  }
282  e->flags |= (1 << NFTNL_EXPR_DYNSET_EXPRESSIONS);
283  }
284  if (tb[NFTA_DYNSET_FLAGS]) {
285  dynset->dynset_flags = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_FLAGS]));
286  e->flags |= (1 << NFTNL_EXPR_DYNSET_FLAGS);
287  }
288 
289  return ret;
290 out_dynset_expr:
291  list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
292  nftnl_expr_free(expr);
293 
294  return -1;
295 }
296 
297 static const char *op2str_array[] = {
298  [NFT_DYNSET_OP_ADD] = "add",
299  [NFT_DYNSET_OP_UPDATE] = "update",
300  [NFT_DYNSET_OP_DELETE] = "delete",
301 };
302 
303 static const char *op2str(enum nft_dynset_ops op)
304 {
305  if (op > NFT_DYNSET_OP_DELETE)
306  return "unknown";
307  return op2str_array[op];
308 }
309 
310 static int
311 nftnl_expr_dynset_snprintf(char *buf, size_t remain,
312  uint32_t flags, const struct nftnl_expr *e)
313 {
314  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
315  struct nftnl_expr *expr;
316  int offset = 0, ret;
317 
318  ret = snprintf(buf, remain, "%s reg_key %u set %s ",
319  op2str(dynset->op), dynset->sreg_key, dynset->set_name);
320  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
321 
322  if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_DATA)) {
323  ret = snprintf(buf + offset, remain, "sreg_data %u ",
324  dynset->sreg_data);
325  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
326  }
327  if (e->flags & (1 << NFTNL_EXPR_DYNSET_TIMEOUT)) {
328  ret = snprintf(buf + offset, remain, "timeout %"PRIu64"ms ",
329  dynset->timeout);
330  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
331  }
332  list_for_each_entry(expr, &dynset->expr_list, head) {
333  ret = snprintf(buf + offset, remain, "expr [ %s ",
334  expr->ops->name);
335  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
336 
337  ret = nftnl_expr_snprintf(buf + offset, remain, expr,
338  NFTNL_OUTPUT_DEFAULT,
339  NFTNL_OF_EVENT_ANY);
340  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
341 
342  ret = snprintf(buf + offset, remain, "] ");
343  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
344  }
345 
346  return offset;
347 }
348 
349 static void nftnl_expr_dynset_init(const struct nftnl_expr *e)
350 {
351  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
352 
353  INIT_LIST_HEAD(&dynset->expr_list);
354 }
355 
356 static void nftnl_expr_dynset_free(const struct nftnl_expr *e)
357 {
358  struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
359  struct nftnl_expr *expr, *next;
360 
361  xfree(dynset->set_name);
362  list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
363  nftnl_expr_free(expr);
364 }
365 
366 struct expr_ops expr_ops_dynset = {
367  .name = "dynset",
368  .alloc_len = sizeof(struct nftnl_expr_dynset),
369  .max_attr = NFTA_DYNSET_MAX,
370  .init = nftnl_expr_dynset_init,
371  .free = nftnl_expr_dynset_free,
372  .set = nftnl_expr_dynset_set,
373  .get = nftnl_expr_dynset_get,
374  .parse = nftnl_expr_dynset_parse,
375  .build = nftnl_expr_dynset_build,
376  .snprintf = nftnl_expr_dynset_snprintf,
377 };