13#include <libmnl/libmnl.h>
14#include <linux/netfilter/nf_tables.h>
15#include <libnftnl/rule.h>
16#include <libnftnl/expr.h>
21 enum nft_registers sreg_key;
22 enum nft_registers sreg_data;
23 enum nft_dynset_ops op;
25 struct list_head expr_list;
28 uint32_t dynset_flags;
32nftnl_expr_dynset_set(
struct nftnl_expr *e, uint16_t type,
33 const void *data, uint32_t data_len)
36 struct nftnl_expr *expr, *next;
39 case NFTNL_EXPR_DYNSET_SREG_KEY:
40 memcpy(&dynset->sreg_key, data, data_len);
42 case NFTNL_EXPR_DYNSET_SREG_DATA:
43 memcpy(&dynset->sreg_data, data, data_len);
45 case NFTNL_EXPR_DYNSET_OP:
46 memcpy(&dynset->op, data, data_len);
48 case NFTNL_EXPR_DYNSET_TIMEOUT:
49 memcpy(&dynset->timeout, data, data_len);
51 case NFTNL_EXPR_DYNSET_SET_NAME:
52 dynset->set_name = strdup((
const char *)data);
53 if (!dynset->set_name)
56 case NFTNL_EXPR_DYNSET_SET_ID:
57 memcpy(&dynset->set_id, data, data_len);
59 case NFTNL_EXPR_DYNSET_EXPR:
60 list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
61 nftnl_expr_free(expr);
64 list_add(&expr->head, &dynset->expr_list);
66 case NFTNL_EXPR_DYNSET_FLAGS:
67 memcpy(&dynset->dynset_flags, data, data_len);
76nftnl_expr_dynset_get(
const struct nftnl_expr *e, uint16_t type,
80 struct nftnl_expr *expr;
83 case NFTNL_EXPR_DYNSET_SREG_KEY:
84 *data_len =
sizeof(dynset->sreg_key);
85 return &dynset->sreg_key;
86 case NFTNL_EXPR_DYNSET_SREG_DATA:
87 *data_len =
sizeof(dynset->sreg_data);
88 return &dynset->sreg_data;
89 case NFTNL_EXPR_DYNSET_OP:
90 *data_len =
sizeof(dynset->op);
92 case NFTNL_EXPR_DYNSET_TIMEOUT:
93 *data_len =
sizeof(dynset->timeout);
94 return &dynset->timeout;
95 case NFTNL_EXPR_DYNSET_SET_NAME:
96 *data_len = strlen(dynset->set_name) + 1;
97 return dynset->set_name;
98 case NFTNL_EXPR_DYNSET_SET_ID:
99 *data_len =
sizeof(dynset->set_id);
100 return &dynset->set_id;
101 case NFTNL_EXPR_DYNSET_EXPR:
102 list_for_each_entry(expr, &dynset->expr_list, head)
105 case NFTNL_EXPR_DYNSET_FLAGS:
106 *data_len =
sizeof(dynset->dynset_flags);
107 return &dynset->dynset_flags;
112static int nftnl_expr_dynset_cb(
const struct nlattr *attr,
void *data)
114 const struct nlattr **tb = data;
115 int type = mnl_attr_get_type(attr);
117 if (mnl_attr_type_valid(attr, NFTA_DYNSET_MAX) < 0)
121 case NFTA_DYNSET_SREG_KEY:
122 case NFTA_DYNSET_SREG_DATA:
123 case NFTA_DYNSET_SET_ID:
125 case NFTA_DYNSET_FLAGS:
126 if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
129 case NFTA_DYNSET_TIMEOUT:
130 if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
133 case NFTA_DYNSET_SET_NAME:
134 if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
137 case NFTA_DYNSET_EXPR:
138 case NFTA_DYNSET_EXPRESSIONS:
139 if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
149nftnl_expr_dynset_build(
struct nlmsghdr *nlh,
const struct nftnl_expr *e)
155 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_KEY))
156 mnl_attr_put_u32(nlh, NFTA_DYNSET_SREG_KEY, htonl(dynset->sreg_key));
157 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_DATA))
158 mnl_attr_put_u32(nlh, NFTA_DYNSET_SREG_DATA, htonl(dynset->sreg_data));
159 if (e->flags & (1 << NFTNL_EXPR_DYNSET_OP))
160 mnl_attr_put_u32(nlh, NFTA_DYNSET_OP, htonl(dynset->op));
161 if (e->flags & (1 << NFTNL_EXPR_DYNSET_TIMEOUT))
162 mnl_attr_put_u64(nlh, NFTA_DYNSET_TIMEOUT, htobe64(dynset->timeout));
163 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SET_NAME))
164 mnl_attr_put_strz(nlh, NFTA_DYNSET_SET_NAME, dynset->set_name);
165 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SET_ID))
166 mnl_attr_put_u32(nlh, NFTA_DYNSET_SET_ID, htonl(dynset->set_id));
167 if (!list_empty(&dynset->expr_list)) {
168 struct nftnl_expr *expr;
170 list_for_each_entry(expr, &dynset->expr_list, head)
173 if (num_exprs == 1) {
174 nest = mnl_attr_nest_start(nlh, NFTA_DYNSET_EXPR);
175 list_for_each_entry(expr, &dynset->expr_list, head)
176 nftnl_expr_build_payload(nlh, expr);
177 mnl_attr_nest_end(nlh, nest);
178 }
else if (num_exprs > 1) {
179 struct nlattr *nest1, *nest2;
181 nest1 = mnl_attr_nest_start(nlh, NFTA_DYNSET_EXPRESSIONS);
182 list_for_each_entry(expr, &dynset->expr_list, head) {
183 nest2 = mnl_attr_nest_start(nlh, NFTA_LIST_ELEM);
184 nftnl_expr_build_payload(nlh, expr);
185 mnl_attr_nest_end(nlh, nest2);
187 mnl_attr_nest_end(nlh, nest1);
190 if (e->flags & (1 << NFTNL_EXPR_DYNSET_FLAGS))
191 mnl_attr_put_u32(nlh, NFTA_DYNSET_FLAGS,
192 htonl(dynset->dynset_flags));
195EXPORT_SYMBOL(nftnl_expr_add_expr);
196void nftnl_expr_add_expr(
struct nftnl_expr *e, uint32_t type,
197 struct nftnl_expr *expr)
201 list_add_tail(&expr->head, &dynset->expr_list);
204EXPORT_SYMBOL(nftnl_expr_expr_foreach);
205int nftnl_expr_expr_foreach(
const struct nftnl_expr *e,
206 int (*cb)(
struct nftnl_expr *e,
void *data),
210 struct nftnl_expr *cur, *tmp;
213 list_for_each_entry_safe(cur, tmp, &dynset->expr_list, head) {
222nftnl_expr_dynset_parse(
struct nftnl_expr *e,
struct nlattr *attr)
225 struct nlattr *tb[NFTA_DYNSET_MAX+1] = {};
226 struct nftnl_expr *expr, *next;
229 if (mnl_attr_parse_nested(attr, nftnl_expr_dynset_cb, tb) < 0)
232 if (tb[NFTA_DYNSET_SREG_KEY]) {
233 dynset->sreg_key = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SREG_KEY]));
234 e->flags |= (1 << NFTNL_EXPR_DYNSET_SREG_KEY);
236 if (tb[NFTA_DYNSET_SREG_DATA]) {
237 dynset->sreg_data = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SREG_DATA]));
238 e->flags |= (1 << NFTNL_EXPR_DYNSET_SREG_DATA);
240 if (tb[NFTA_DYNSET_OP]) {
241 dynset->op = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_OP]));
242 e->flags |= (1 << NFTNL_EXPR_DYNSET_OP);
244 if (tb[NFTA_DYNSET_TIMEOUT]) {
245 dynset->timeout = be64toh(mnl_attr_get_u64(tb[NFTA_DYNSET_TIMEOUT]));
246 e->flags |= (1 << NFTNL_EXPR_DYNSET_TIMEOUT);
248 if (tb[NFTA_DYNSET_SET_NAME]) {
250 strdup(mnl_attr_get_str(tb[NFTA_DYNSET_SET_NAME]));
251 if (!dynset->set_name)
253 e->flags |= (1 << NFTNL_EXPR_DYNSET_SET_NAME);
255 if (tb[NFTA_DYNSET_SET_ID]) {
256 dynset->set_id = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SET_ID]));
257 e->flags |= (1 << NFTNL_EXPR_DYNSET_SET_ID);
259 if (tb[NFTA_DYNSET_EXPR]) {
260 expr = nftnl_expr_parse(tb[NFTA_DYNSET_EXPR]);
264 list_add(&expr->head, &dynset->expr_list);
265 e->flags |= (1 << NFTNL_EXPR_DYNSET_EXPR);
266 }
else if (tb[NFTA_DYNSET_EXPRESSIONS]) {
267 struct nlattr *attr2;
269 mnl_attr_for_each_nested(attr2, tb[NFTA_DYNSET_EXPRESSIONS]) {
270 if (mnl_attr_get_type(attr2) != NFTA_LIST_ELEM)
271 goto out_dynset_expr;
273 expr = nftnl_expr_parse(attr2);
275 goto out_dynset_expr;
277 list_add_tail(&expr->head, &dynset->expr_list);
279 e->flags |= (1 << NFTNL_EXPR_DYNSET_EXPRESSIONS);
281 if (tb[NFTA_DYNSET_FLAGS]) {
282 dynset->dynset_flags = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_FLAGS]));
283 e->flags |= (1 << NFTNL_EXPR_DYNSET_FLAGS);
288 list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
289 nftnl_expr_free(expr);
294static const char *op2str_array[] = {
295 [NFT_DYNSET_OP_ADD] =
"add",
296 [NFT_DYNSET_OP_UPDATE] =
"update",
297 [NFT_DYNSET_OP_DELETE] =
"delete",
300static const char *op2str(
enum nft_dynset_ops op)
302 if (op > NFT_DYNSET_OP_DELETE)
304 return op2str_array[op];
308nftnl_expr_dynset_snprintf(
char *buf,
size_t remain,
309 uint32_t flags,
const struct nftnl_expr *e)
312 struct nftnl_expr *expr;
315 ret = snprintf(buf, remain,
"%s reg_key %u set %s ",
316 op2str(dynset->op), dynset->sreg_key, dynset->set_name);
317 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
319 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_DATA)) {
320 ret = snprintf(buf + offset, remain,
"sreg_data %u ",
322 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
324 if (e->flags & (1 << NFTNL_EXPR_DYNSET_TIMEOUT)) {
325 ret = snprintf(buf + offset, remain,
"timeout %"PRIu64
"ms ",
327 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
329 list_for_each_entry(expr, &dynset->expr_list, head) {
330 ret = snprintf(buf + offset, remain,
"expr [ %s ",
332 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
334 ret = nftnl_expr_snprintf(buf + offset, remain, expr,
335 NFTNL_OUTPUT_DEFAULT,
337 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
339 ret = snprintf(buf + offset, remain,
"] ");
340 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
346static void nftnl_expr_dynset_init(
const struct nftnl_expr *e)
350 INIT_LIST_HEAD(&dynset->expr_list);
353static void nftnl_expr_dynset_free(
const struct nftnl_expr *e)
356 struct nftnl_expr *expr, *next;
358 xfree(dynset->set_name);
359 list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
360 nftnl_expr_free(expr);
363static struct attr_policy dynset_attr_policy[__NFTNL_EXPR_DYNSET_MAX] = {
364 [NFTNL_EXPR_DYNSET_SREG_KEY] = { .maxlen =
sizeof(uint32_t) },
365 [NFTNL_EXPR_DYNSET_SREG_DATA] = { .maxlen =
sizeof(uint32_t) },
366 [NFTNL_EXPR_DYNSET_OP] = { .maxlen =
sizeof(uint32_t) },
367 [NFTNL_EXPR_DYNSET_TIMEOUT] = { .maxlen =
sizeof(uint64_t) },
368 [NFTNL_EXPR_DYNSET_SET_NAME] = { .maxlen = NFT_SET_MAXNAMELEN },
369 [NFTNL_EXPR_DYNSET_SET_ID] = { .maxlen =
sizeof(uint32_t) },
370 [NFTNL_EXPR_DYNSET_EXPR] = { .maxlen = 0 },
371 [NFTNL_EXPR_DYNSET_EXPRESSIONS] = { .maxlen = 0 },
372 [NFTNL_EXPR_DYNSET_FLAGS] = { .maxlen =
sizeof(uint32_t) },
375struct expr_ops expr_ops_dynset = {
378 .nftnl_max_attr = __NFTNL_EXPR_DYNSET_MAX - 1,
379 .attr_policy = dynset_attr_policy,
380 .init = nftnl_expr_dynset_init,
381 .free = nftnl_expr_dynset_free,
382 .set = nftnl_expr_dynset_set,
383 .get = nftnl_expr_dynset_get,
384 .parse = nftnl_expr_dynset_parse,
385 .build = nftnl_expr_dynset_build,
386 .output = nftnl_expr_dynset_snprintf,