libnftnl 1.3.1
dynset.c
1/* SPDX-License-Identifier: GPL-2.0-or-later */
2/*
3 * Copyright (c) 2014, 2015 Patrick McHardy <kaber@trash.net>
4 */
5
6#include "internal.h"
7
8#include <stdio.h>
9#include <stdint.h>
10#include <inttypes.h>
11#include <errno.h>
12#include <arpa/inet.h>
13#include <libmnl/libmnl.h>
14#include <linux/netfilter/nf_tables.h>
15#include <libnftnl/rule.h>
16#include <libnftnl/expr.h>
17#include "data_reg.h"
18#include "expr_ops.h"
19
20struct nftnl_expr_dynset {
21 enum nft_registers sreg_key;
22 enum nft_registers sreg_data;
23 enum nft_dynset_ops op;
24 uint64_t timeout;
25 struct list_head expr_list;
26 char *set_name;
27 uint32_t set_id;
28 uint32_t dynset_flags;
29};
30
31static int
32nftnl_expr_dynset_set(struct nftnl_expr *e, uint16_t type,
33 const void *data, uint32_t data_len)
34{
35 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
36 struct nftnl_expr *expr, *next;
37
38 switch (type) {
39 case NFTNL_EXPR_DYNSET_SREG_KEY:
40 memcpy(&dynset->sreg_key, data, data_len);
41 break;
42 case NFTNL_EXPR_DYNSET_SREG_DATA:
43 memcpy(&dynset->sreg_data, data, data_len);
44 break;
45 case NFTNL_EXPR_DYNSET_OP:
46 memcpy(&dynset->op, data, data_len);
47 break;
48 case NFTNL_EXPR_DYNSET_TIMEOUT:
49 memcpy(&dynset->timeout, data, data_len);
50 break;
51 case NFTNL_EXPR_DYNSET_SET_NAME:
52 dynset->set_name = strdup((const char *)data);
53 if (!dynset->set_name)
54 return -1;
55 break;
56 case NFTNL_EXPR_DYNSET_SET_ID:
57 memcpy(&dynset->set_id, data, data_len);
58 break;
59 case NFTNL_EXPR_DYNSET_EXPR:
60 list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
61 nftnl_expr_free(expr);
62
63 expr = (void *)data;
64 list_add(&expr->head, &dynset->expr_list);
65 break;
66 case NFTNL_EXPR_DYNSET_FLAGS:
67 memcpy(&dynset->dynset_flags, data, data_len);
68 break;
69 default:
70 return -1;
71 }
72 return 0;
73}
74
75static const void *
76nftnl_expr_dynset_get(const struct nftnl_expr *e, uint16_t type,
77 uint32_t *data_len)
78{
79 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
80 struct nftnl_expr *expr;
81
82 switch (type) {
83 case NFTNL_EXPR_DYNSET_SREG_KEY:
84 *data_len = sizeof(dynset->sreg_key);
85 return &dynset->sreg_key;
86 case NFTNL_EXPR_DYNSET_SREG_DATA:
87 *data_len = sizeof(dynset->sreg_data);
88 return &dynset->sreg_data;
89 case NFTNL_EXPR_DYNSET_OP:
90 *data_len = sizeof(dynset->op);
91 return &dynset->op;
92 case NFTNL_EXPR_DYNSET_TIMEOUT:
93 *data_len = sizeof(dynset->timeout);
94 return &dynset->timeout;
95 case NFTNL_EXPR_DYNSET_SET_NAME:
96 *data_len = strlen(dynset->set_name) + 1;
97 return dynset->set_name;
98 case NFTNL_EXPR_DYNSET_SET_ID:
99 *data_len = sizeof(dynset->set_id);
100 return &dynset->set_id;
101 case NFTNL_EXPR_DYNSET_EXPR:
102 list_for_each_entry(expr, &dynset->expr_list, head)
103 break;
104 return expr;
105 case NFTNL_EXPR_DYNSET_FLAGS:
106 *data_len = sizeof(dynset->dynset_flags);
107 return &dynset->dynset_flags;
108 }
109 return NULL;
110}
111
112static int nftnl_expr_dynset_cb(const struct nlattr *attr, void *data)
113{
114 const struct nlattr **tb = data;
115 int type = mnl_attr_get_type(attr);
116
117 if (mnl_attr_type_valid(attr, NFTA_DYNSET_MAX) < 0)
118 return MNL_CB_OK;
119
120 switch (type) {
121 case NFTA_DYNSET_SREG_KEY:
122 case NFTA_DYNSET_SREG_DATA:
123 case NFTA_DYNSET_SET_ID:
124 case NFTA_DYNSET_OP:
125 case NFTA_DYNSET_FLAGS:
126 if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
127 abi_breakage();
128 break;
129 case NFTA_DYNSET_TIMEOUT:
130 if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
131 abi_breakage();
132 break;
133 case NFTA_DYNSET_SET_NAME:
134 if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
135 abi_breakage();
136 break;
137 case NFTA_DYNSET_EXPR:
138 case NFTA_DYNSET_EXPRESSIONS:
139 if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
140 abi_breakage();
141 break;
142 }
143
144 tb[type] = attr;
145 return MNL_CB_OK;
146}
147
148static void
149nftnl_expr_dynset_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
150{
151 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
152 struct nlattr *nest;
153 int num_exprs = 0;
154
155 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_KEY))
156 mnl_attr_put_u32(nlh, NFTA_DYNSET_SREG_KEY, htonl(dynset->sreg_key));
157 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_DATA))
158 mnl_attr_put_u32(nlh, NFTA_DYNSET_SREG_DATA, htonl(dynset->sreg_data));
159 if (e->flags & (1 << NFTNL_EXPR_DYNSET_OP))
160 mnl_attr_put_u32(nlh, NFTA_DYNSET_OP, htonl(dynset->op));
161 if (e->flags & (1 << NFTNL_EXPR_DYNSET_TIMEOUT))
162 mnl_attr_put_u64(nlh, NFTA_DYNSET_TIMEOUT, htobe64(dynset->timeout));
163 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SET_NAME))
164 mnl_attr_put_strz(nlh, NFTA_DYNSET_SET_NAME, dynset->set_name);
165 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SET_ID))
166 mnl_attr_put_u32(nlh, NFTA_DYNSET_SET_ID, htonl(dynset->set_id));
167 if (!list_empty(&dynset->expr_list)) {
168 struct nftnl_expr *expr;
169
170 list_for_each_entry(expr, &dynset->expr_list, head)
171 num_exprs++;
172
173 if (num_exprs == 1) {
174 nest = mnl_attr_nest_start(nlh, NFTA_DYNSET_EXPR);
175 list_for_each_entry(expr, &dynset->expr_list, head)
176 nftnl_expr_build_payload(nlh, expr);
177 mnl_attr_nest_end(nlh, nest);
178 } else if (num_exprs > 1) {
179 struct nlattr *nest1, *nest2;
180
181 nest1 = mnl_attr_nest_start(nlh, NFTA_DYNSET_EXPRESSIONS);
182 list_for_each_entry(expr, &dynset->expr_list, head) {
183 nest2 = mnl_attr_nest_start(nlh, NFTA_LIST_ELEM);
184 nftnl_expr_build_payload(nlh, expr);
185 mnl_attr_nest_end(nlh, nest2);
186 }
187 mnl_attr_nest_end(nlh, nest1);
188 }
189 }
190 if (e->flags & (1 << NFTNL_EXPR_DYNSET_FLAGS))
191 mnl_attr_put_u32(nlh, NFTA_DYNSET_FLAGS,
192 htonl(dynset->dynset_flags));
193}
194
195EXPORT_SYMBOL(nftnl_expr_add_expr);
196void nftnl_expr_add_expr(struct nftnl_expr *e, uint32_t type,
197 struct nftnl_expr *expr)
198{
199 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
200
201 list_add_tail(&expr->head, &dynset->expr_list);
202}
203
204EXPORT_SYMBOL(nftnl_expr_expr_foreach);
205int nftnl_expr_expr_foreach(const struct nftnl_expr *e,
206 int (*cb)(struct nftnl_expr *e, void *data),
207 void *data)
208{
209 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
210 struct nftnl_expr *cur, *tmp;
211 int ret;
212
213 list_for_each_entry_safe(cur, tmp, &dynset->expr_list, head) {
214 ret = cb(cur, data);
215 if (ret < 0)
216 return ret;
217 }
218 return 0;
219}
220
221static int
222nftnl_expr_dynset_parse(struct nftnl_expr *e, struct nlattr *attr)
223{
224 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
225 struct nlattr *tb[NFTA_DYNSET_MAX+1] = {};
226 struct nftnl_expr *expr, *next;
227 int ret = 0;
228
229 if (mnl_attr_parse_nested(attr, nftnl_expr_dynset_cb, tb) < 0)
230 return -1;
231
232 if (tb[NFTA_DYNSET_SREG_KEY]) {
233 dynset->sreg_key = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SREG_KEY]));
234 e->flags |= (1 << NFTNL_EXPR_DYNSET_SREG_KEY);
235 }
236 if (tb[NFTA_DYNSET_SREG_DATA]) {
237 dynset->sreg_data = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SREG_DATA]));
238 e->flags |= (1 << NFTNL_EXPR_DYNSET_SREG_DATA);
239 }
240 if (tb[NFTA_DYNSET_OP]) {
241 dynset->op = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_OP]));
242 e->flags |= (1 << NFTNL_EXPR_DYNSET_OP);
243 }
244 if (tb[NFTA_DYNSET_TIMEOUT]) {
245 dynset->timeout = be64toh(mnl_attr_get_u64(tb[NFTA_DYNSET_TIMEOUT]));
246 e->flags |= (1 << NFTNL_EXPR_DYNSET_TIMEOUT);
247 }
248 if (nftnl_parse_str_attr(tb[NFTA_DYNSET_SET_NAME],
249 NFTNL_EXPR_DYNSET_SET_NAME,
250 (const char **)&dynset->set_name,
251 &e->flags) < 0)
252 return -1;
253 if (tb[NFTA_DYNSET_SET_ID]) {
254 dynset->set_id = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SET_ID]));
255 e->flags |= (1 << NFTNL_EXPR_DYNSET_SET_ID);
256 }
257 if (tb[NFTA_DYNSET_EXPR]) {
258 expr = nftnl_expr_parse(tb[NFTA_DYNSET_EXPR]);
259 if (expr == NULL)
260 return -1;
261
262 list_add(&expr->head, &dynset->expr_list);
263 e->flags |= (1 << NFTNL_EXPR_DYNSET_EXPR);
264 } else if (tb[NFTA_DYNSET_EXPRESSIONS]) {
265 struct nlattr *attr2;
266
267 mnl_attr_for_each_nested(attr2, tb[NFTA_DYNSET_EXPRESSIONS]) {
268 if (mnl_attr_get_type(attr2) != NFTA_LIST_ELEM)
269 goto out_dynset_expr;
270
271 expr = nftnl_expr_parse(attr2);
272 if (!expr)
273 goto out_dynset_expr;
274
275 list_add_tail(&expr->head, &dynset->expr_list);
276 }
277 e->flags |= (1 << NFTNL_EXPR_DYNSET_EXPRESSIONS);
278 }
279 if (tb[NFTA_DYNSET_FLAGS]) {
280 dynset->dynset_flags = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_FLAGS]));
281 e->flags |= (1 << NFTNL_EXPR_DYNSET_FLAGS);
282 }
283
284 return ret;
285out_dynset_expr:
286 list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
287 nftnl_expr_free(expr);
288
289 return -1;
290}
291
292static const char *op2str_array[] = {
293 [NFT_DYNSET_OP_ADD] = "add",
294 [NFT_DYNSET_OP_UPDATE] = "update",
295 [NFT_DYNSET_OP_DELETE] = "delete",
296};
297
298static const char *op2str(enum nft_dynset_ops op)
299{
300 if (op > NFT_DYNSET_OP_DELETE)
301 return "unknown";
302 return op2str_array[op];
303}
304
305static int
306nftnl_expr_dynset_snprintf(char *buf, size_t remain,
307 uint32_t flags, const struct nftnl_expr *e)
308{
309 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
310 struct nftnl_expr *expr;
311 int offset = 0, ret;
312
313 ret = snprintf(buf, remain, "%s reg_key %u set %s ",
314 op2str(dynset->op), dynset->sreg_key, dynset->set_name);
315 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
316
317 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_DATA)) {
318 ret = snprintf(buf + offset, remain, "sreg_data %u ",
319 dynset->sreg_data);
320 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
321 }
322 if (e->flags & (1 << NFTNL_EXPR_DYNSET_TIMEOUT)) {
323 ret = snprintf(buf + offset, remain, "timeout %"PRIu64"ms ",
324 dynset->timeout);
325 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
326 }
327 list_for_each_entry(expr, &dynset->expr_list, head) {
328 ret = snprintf(buf + offset, remain, "expr [ %s ",
329 expr->ops->name);
330 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
331
332 ret = nftnl_expr_snprintf(buf + offset, remain, expr,
333 NFTNL_OUTPUT_DEFAULT,
334 NFTNL_OF_EVENT_ANY);
335 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
336
337 ret = snprintf(buf + offset, remain, "] ");
338 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
339 }
340
341 return offset;
342}
343
344static void nftnl_expr_dynset_init(const struct nftnl_expr *e)
345{
346 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
347
348 INIT_LIST_HEAD(&dynset->expr_list);
349}
350
351static void nftnl_expr_dynset_free(const struct nftnl_expr *e)
352{
353 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
354 struct nftnl_expr *expr, *next;
355
356 xfree(dynset->set_name);
357 list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
358 nftnl_expr_free(expr);
359}
360
361static struct attr_policy dynset_attr_policy[__NFTNL_EXPR_DYNSET_MAX] = {
362 [NFTNL_EXPR_DYNSET_SREG_KEY] = { .maxlen = sizeof(uint32_t) },
363 [NFTNL_EXPR_DYNSET_SREG_DATA] = { .maxlen = sizeof(uint32_t) },
364 [NFTNL_EXPR_DYNSET_OP] = { .maxlen = sizeof(uint32_t) },
365 [NFTNL_EXPR_DYNSET_TIMEOUT] = { .maxlen = sizeof(uint64_t) },
366 [NFTNL_EXPR_DYNSET_SET_NAME] = { .maxlen = NFT_SET_MAXNAMELEN },
367 [NFTNL_EXPR_DYNSET_SET_ID] = { .maxlen = sizeof(uint32_t) },
368 [NFTNL_EXPR_DYNSET_EXPR] = { .maxlen = 0 },
369 [NFTNL_EXPR_DYNSET_EXPRESSIONS] = { .maxlen = 0 },
370 [NFTNL_EXPR_DYNSET_FLAGS] = { .maxlen = sizeof(uint32_t) },
371};
372
373struct expr_ops expr_ops_dynset = {
374 .name = "dynset",
375 .alloc_len = sizeof(struct nftnl_expr_dynset),
376 .nftnl_max_attr = __NFTNL_EXPR_DYNSET_MAX - 1,
377 .attr_policy = dynset_attr_policy,
378 .init = nftnl_expr_dynset_init,
379 .free = nftnl_expr_dynset_free,
380 .set = nftnl_expr_dynset_set,
381 .get = nftnl_expr_dynset_get,
382 .parse = nftnl_expr_dynset_parse,
383 .build = nftnl_expr_dynset_build,
384 .output = nftnl_expr_dynset_snprintf,
385};
nftnl_expr_dynset
Definition dynset.c:20
Generated by doxygen 1.15.0