libnftnl 1.2.9
dynset.c
1/* SPDX-License-Identifier: GPL-2.0-or-later */
2/*
3 * Copyright (c) 2014, 2015 Patrick McHardy <kaber@trash.net>
4 */
5
6#include "internal.h"
7
8#include <stdio.h>
9#include <stdint.h>
10#include <inttypes.h>
11#include <errno.h>
12#include <arpa/inet.h>
13#include <libmnl/libmnl.h>
14#include <linux/netfilter/nf_tables.h>
15#include <libnftnl/rule.h>
16#include <libnftnl/expr.h>
17#include "data_reg.h"
18#include "expr_ops.h"
19
21 enum nft_registers sreg_key;
22 enum nft_registers sreg_data;
23 enum nft_dynset_ops op;
24 uint64_t timeout;
25 struct list_head expr_list;
26 char *set_name;
27 uint32_t set_id;
28 uint32_t dynset_flags;
29};
30
31static int
32nftnl_expr_dynset_set(struct nftnl_expr *e, uint16_t type,
33 const void *data, uint32_t data_len)
34{
35 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
36 struct nftnl_expr *expr, *next;
37
38 switch (type) {
39 case NFTNL_EXPR_DYNSET_SREG_KEY:
40 memcpy(&dynset->sreg_key, data, data_len);
41 break;
42 case NFTNL_EXPR_DYNSET_SREG_DATA:
43 memcpy(&dynset->sreg_data, data, data_len);
44 break;
45 case NFTNL_EXPR_DYNSET_OP:
46 memcpy(&dynset->op, data, data_len);
47 break;
48 case NFTNL_EXPR_DYNSET_TIMEOUT:
49 memcpy(&dynset->timeout, data, data_len);
50 break;
51 case NFTNL_EXPR_DYNSET_SET_NAME:
52 dynset->set_name = strdup((const char *)data);
53 if (!dynset->set_name)
54 return -1;
55 break;
56 case NFTNL_EXPR_DYNSET_SET_ID:
57 memcpy(&dynset->set_id, data, data_len);
58 break;
59 case NFTNL_EXPR_DYNSET_EXPR:
60 list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
61 nftnl_expr_free(expr);
62
63 expr = (void *)data;
64 list_add(&expr->head, &dynset->expr_list);
65 break;
66 case NFTNL_EXPR_DYNSET_FLAGS:
67 memcpy(&dynset->dynset_flags, data, data_len);
68 break;
69 default:
70 return -1;
71 }
72 return 0;
73}
74
75static const void *
76nftnl_expr_dynset_get(const struct nftnl_expr *e, uint16_t type,
77 uint32_t *data_len)
78{
79 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
80 struct nftnl_expr *expr;
81
82 switch (type) {
83 case NFTNL_EXPR_DYNSET_SREG_KEY:
84 *data_len = sizeof(dynset->sreg_key);
85 return &dynset->sreg_key;
86 case NFTNL_EXPR_DYNSET_SREG_DATA:
87 *data_len = sizeof(dynset->sreg_data);
88 return &dynset->sreg_data;
89 case NFTNL_EXPR_DYNSET_OP:
90 *data_len = sizeof(dynset->op);
91 return &dynset->op;
92 case NFTNL_EXPR_DYNSET_TIMEOUT:
93 *data_len = sizeof(dynset->timeout);
94 return &dynset->timeout;
95 case NFTNL_EXPR_DYNSET_SET_NAME:
96 *data_len = strlen(dynset->set_name) + 1;
97 return dynset->set_name;
98 case NFTNL_EXPR_DYNSET_SET_ID:
99 *data_len = sizeof(dynset->set_id);
100 return &dynset->set_id;
101 case NFTNL_EXPR_DYNSET_EXPR:
102 list_for_each_entry(expr, &dynset->expr_list, head)
103 break;
104 return expr;
105 case NFTNL_EXPR_DYNSET_FLAGS:
106 *data_len = sizeof(dynset->dynset_flags);
107 return &dynset->dynset_flags;
108 }
109 return NULL;
110}
111
112static int nftnl_expr_dynset_cb(const struct nlattr *attr, void *data)
113{
114 const struct nlattr **tb = data;
115 int type = mnl_attr_get_type(attr);
116
117 if (mnl_attr_type_valid(attr, NFTA_DYNSET_MAX) < 0)
118 return MNL_CB_OK;
119
120 switch (type) {
121 case NFTA_DYNSET_SREG_KEY:
122 case NFTA_DYNSET_SREG_DATA:
123 case NFTA_DYNSET_SET_ID:
124 case NFTA_DYNSET_OP:
125 case NFTA_DYNSET_FLAGS:
126 if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
127 abi_breakage();
128 break;
129 case NFTA_DYNSET_TIMEOUT:
130 if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
131 abi_breakage();
132 break;
133 case NFTA_DYNSET_SET_NAME:
134 if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
135 abi_breakage();
136 break;
137 case NFTA_DYNSET_EXPR:
138 case NFTA_DYNSET_EXPRESSIONS:
139 if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
140 abi_breakage();
141 break;
142 }
143
144 tb[type] = attr;
145 return MNL_CB_OK;
146}
147
148static void
149nftnl_expr_dynset_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
150{
151 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
152 struct nlattr *nest;
153 int num_exprs = 0;
154
155 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_KEY))
156 mnl_attr_put_u32(nlh, NFTA_DYNSET_SREG_KEY, htonl(dynset->sreg_key));
157 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_DATA))
158 mnl_attr_put_u32(nlh, NFTA_DYNSET_SREG_DATA, htonl(dynset->sreg_data));
159 if (e->flags & (1 << NFTNL_EXPR_DYNSET_OP))
160 mnl_attr_put_u32(nlh, NFTA_DYNSET_OP, htonl(dynset->op));
161 if (e->flags & (1 << NFTNL_EXPR_DYNSET_TIMEOUT))
162 mnl_attr_put_u64(nlh, NFTA_DYNSET_TIMEOUT, htobe64(dynset->timeout));
163 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SET_NAME))
164 mnl_attr_put_strz(nlh, NFTA_DYNSET_SET_NAME, dynset->set_name);
165 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SET_ID))
166 mnl_attr_put_u32(nlh, NFTA_DYNSET_SET_ID, htonl(dynset->set_id));
167 if (!list_empty(&dynset->expr_list)) {
168 struct nftnl_expr *expr;
169
170 list_for_each_entry(expr, &dynset->expr_list, head)
171 num_exprs++;
172
173 if (num_exprs == 1) {
174 nest = mnl_attr_nest_start(nlh, NFTA_DYNSET_EXPR);
175 list_for_each_entry(expr, &dynset->expr_list, head)
176 nftnl_expr_build_payload(nlh, expr);
177 mnl_attr_nest_end(nlh, nest);
178 } else if (num_exprs > 1) {
179 struct nlattr *nest1, *nest2;
180
181 nest1 = mnl_attr_nest_start(nlh, NFTA_DYNSET_EXPRESSIONS);
182 list_for_each_entry(expr, &dynset->expr_list, head) {
183 nest2 = mnl_attr_nest_start(nlh, NFTA_LIST_ELEM);
184 nftnl_expr_build_payload(nlh, expr);
185 mnl_attr_nest_end(nlh, nest2);
186 }
187 mnl_attr_nest_end(nlh, nest1);
188 }
189 }
190 if (e->flags & (1 << NFTNL_EXPR_DYNSET_FLAGS))
191 mnl_attr_put_u32(nlh, NFTA_DYNSET_FLAGS,
192 htonl(dynset->dynset_flags));
193}
194
195EXPORT_SYMBOL(nftnl_expr_add_expr);
196void nftnl_expr_add_expr(struct nftnl_expr *e, uint32_t type,
197 struct nftnl_expr *expr)
198{
199 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
200
201 list_add_tail(&expr->head, &dynset->expr_list);
202}
203
204EXPORT_SYMBOL(nftnl_expr_expr_foreach);
205int nftnl_expr_expr_foreach(const struct nftnl_expr *e,
206 int (*cb)(struct nftnl_expr *e, void *data),
207 void *data)
208{
209 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
210 struct nftnl_expr *cur, *tmp;
211 int ret;
212
213 list_for_each_entry_safe(cur, tmp, &dynset->expr_list, head) {
214 ret = cb(cur, data);
215 if (ret < 0)
216 return ret;
217 }
218 return 0;
219}
220
221static int
222nftnl_expr_dynset_parse(struct nftnl_expr *e, struct nlattr *attr)
223{
224 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
225 struct nlattr *tb[NFTA_DYNSET_MAX+1] = {};
226 struct nftnl_expr *expr, *next;
227 int ret = 0;
228
229 if (mnl_attr_parse_nested(attr, nftnl_expr_dynset_cb, tb) < 0)
230 return -1;
231
232 if (tb[NFTA_DYNSET_SREG_KEY]) {
233 dynset->sreg_key = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SREG_KEY]));
234 e->flags |= (1 << NFTNL_EXPR_DYNSET_SREG_KEY);
235 }
236 if (tb[NFTA_DYNSET_SREG_DATA]) {
237 dynset->sreg_data = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SREG_DATA]));
238 e->flags |= (1 << NFTNL_EXPR_DYNSET_SREG_DATA);
239 }
240 if (tb[NFTA_DYNSET_OP]) {
241 dynset->op = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_OP]));
242 e->flags |= (1 << NFTNL_EXPR_DYNSET_OP);
243 }
244 if (tb[NFTA_DYNSET_TIMEOUT]) {
245 dynset->timeout = be64toh(mnl_attr_get_u64(tb[NFTA_DYNSET_TIMEOUT]));
246 e->flags |= (1 << NFTNL_EXPR_DYNSET_TIMEOUT);
247 }
248 if (tb[NFTA_DYNSET_SET_NAME]) {
249 dynset->set_name =
250 strdup(mnl_attr_get_str(tb[NFTA_DYNSET_SET_NAME]));
251 if (!dynset->set_name)
252 return -1;
253 e->flags |= (1 << NFTNL_EXPR_DYNSET_SET_NAME);
254 }
255 if (tb[NFTA_DYNSET_SET_ID]) {
256 dynset->set_id = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SET_ID]));
257 e->flags |= (1 << NFTNL_EXPR_DYNSET_SET_ID);
258 }
259 if (tb[NFTA_DYNSET_EXPR]) {
260 expr = nftnl_expr_parse(tb[NFTA_DYNSET_EXPR]);
261 if (expr == NULL)
262 return -1;
263
264 list_add(&expr->head, &dynset->expr_list);
265 e->flags |= (1 << NFTNL_EXPR_DYNSET_EXPR);
266 } else if (tb[NFTA_DYNSET_EXPRESSIONS]) {
267 struct nlattr *attr2;
268
269 mnl_attr_for_each_nested(attr2, tb[NFTA_DYNSET_EXPRESSIONS]) {
270 if (mnl_attr_get_type(attr2) != NFTA_LIST_ELEM)
271 goto out_dynset_expr;
272
273 expr = nftnl_expr_parse(attr2);
274 if (!expr)
275 goto out_dynset_expr;
276
277 list_add_tail(&expr->head, &dynset->expr_list);
278 }
279 e->flags |= (1 << NFTNL_EXPR_DYNSET_EXPRESSIONS);
280 }
281 if (tb[NFTA_DYNSET_FLAGS]) {
282 dynset->dynset_flags = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_FLAGS]));
283 e->flags |= (1 << NFTNL_EXPR_DYNSET_FLAGS);
284 }
285
286 return ret;
287out_dynset_expr:
288 list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
289 nftnl_expr_free(expr);
290
291 return -1;
292}
293
294static const char *op2str_array[] = {
295 [NFT_DYNSET_OP_ADD] = "add",
296 [NFT_DYNSET_OP_UPDATE] = "update",
297 [NFT_DYNSET_OP_DELETE] = "delete",
298};
299
300static const char *op2str(enum nft_dynset_ops op)
301{
302 if (op > NFT_DYNSET_OP_DELETE)
303 return "unknown";
304 return op2str_array[op];
305}
306
307static int
308nftnl_expr_dynset_snprintf(char *buf, size_t remain,
309 uint32_t flags, const struct nftnl_expr *e)
310{
311 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
312 struct nftnl_expr *expr;
313 int offset = 0, ret;
314
315 ret = snprintf(buf, remain, "%s reg_key %u set %s ",
316 op2str(dynset->op), dynset->sreg_key, dynset->set_name);
317 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
318
319 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_DATA)) {
320 ret = snprintf(buf + offset, remain, "sreg_data %u ",
321 dynset->sreg_data);
322 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
323 }
324 if (e->flags & (1 << NFTNL_EXPR_DYNSET_TIMEOUT)) {
325 ret = snprintf(buf + offset, remain, "timeout %"PRIu64"ms ",
326 dynset->timeout);
327 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
328 }
329 list_for_each_entry(expr, &dynset->expr_list, head) {
330 ret = snprintf(buf + offset, remain, "expr [ %s ",
331 expr->ops->name);
332 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
333
334 ret = nftnl_expr_snprintf(buf + offset, remain, expr,
335 NFTNL_OUTPUT_DEFAULT,
336 NFTNL_OF_EVENT_ANY);
337 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
338
339 ret = snprintf(buf + offset, remain, "] ");
340 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
341 }
342
343 return offset;
344}
345
346static void nftnl_expr_dynset_init(const struct nftnl_expr *e)
347{
348 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
349
350 INIT_LIST_HEAD(&dynset->expr_list);
351}
352
353static void nftnl_expr_dynset_free(const struct nftnl_expr *e)
354{
355 struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
356 struct nftnl_expr *expr, *next;
357
358 xfree(dynset->set_name);
359 list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
360 nftnl_expr_free(expr);
361}
362
363static struct attr_policy dynset_attr_policy[__NFTNL_EXPR_DYNSET_MAX] = {
364 [NFTNL_EXPR_DYNSET_SREG_KEY] = { .maxlen = sizeof(uint32_t) },
365 [NFTNL_EXPR_DYNSET_SREG_DATA] = { .maxlen = sizeof(uint32_t) },
366 [NFTNL_EXPR_DYNSET_OP] = { .maxlen = sizeof(uint32_t) },
367 [NFTNL_EXPR_DYNSET_TIMEOUT] = { .maxlen = sizeof(uint64_t) },
368 [NFTNL_EXPR_DYNSET_SET_NAME] = { .maxlen = NFT_SET_MAXNAMELEN },
369 [NFTNL_EXPR_DYNSET_SET_ID] = { .maxlen = sizeof(uint32_t) },
370 [NFTNL_EXPR_DYNSET_EXPR] = { .maxlen = 0 },
371 [NFTNL_EXPR_DYNSET_EXPRESSIONS] = { .maxlen = 0 },
372 [NFTNL_EXPR_DYNSET_FLAGS] = { .maxlen = sizeof(uint32_t) },
373};
374
375struct expr_ops expr_ops_dynset = {
376 .name = "dynset",
377 .alloc_len = sizeof(struct nftnl_expr_dynset),
378 .nftnl_max_attr = __NFTNL_EXPR_DYNSET_MAX - 1,
379 .attr_policy = dynset_attr_policy,
380 .init = nftnl_expr_dynset_init,
381 .free = nftnl_expr_dynset_free,
382 .set = nftnl_expr_dynset_set,
383 .get = nftnl_expr_dynset_get,
384 .parse = nftnl_expr_dynset_parse,
385 .build = nftnl_expr_dynset_build,
386 .output = nftnl_expr_dynset_snprintf,
387};