libnftnl  1.3.1
chain.c
1 /* SPDX-License-Identifier: GPL-2.0-or-later */
2 /*
3  * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
4  *
5  * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
6  */
7 #include "internal.h"
8 
9 #include <time.h>
10 #include <endian.h>
11 #include <stdint.h>
12 #include <stdlib.h>
13 #include <limits.h>
14 #include <string.h>
15 #include <netinet/in.h>
16 #include <errno.h>
17 #include <inttypes.h>
18 
19 #include <libmnl/libmnl.h>
20 #include <linux/netfilter/nfnetlink.h>
21 #include <linux/netfilter/nf_tables.h>
22 #include <linux/netfilter.h>
23 #include <linux/netfilter_arp.h>
24 
25 #include <libnftnl/chain.h>
26 #include <libnftnl/rule.h>
27 
28 struct nftnl_chain {
29  struct list_head head;
30  struct hlist_node hnode;
31 
32  const char *name;
33  const char *type;
34  const char *table;
35  const char *dev;
36  struct nftnl_str_array dev_array;
37  uint32_t family;
38  uint32_t policy;
39  uint32_t hooknum;
40  int32_t prio;
41  uint32_t chain_flags;
42  uint32_t use;
43  uint64_t packets;
44  uint64_t bytes;
45  uint64_t handle;
46  uint32_t flags;
47  uint32_t chain_id;
48 
49  struct {
50  void *data;
51  uint32_t len;
52  } user;
53 
54  struct list_head rule_list;
55 };
56 
57 static const char *nftnl_hooknum2str(int family, int hooknum)
58 {
59  switch (family) {
60  case NFPROTO_IPV4:
61  case NFPROTO_IPV6:
62  case NFPROTO_INET:
63  case NFPROTO_BRIDGE:
64  switch (hooknum) {
65  case NF_INET_PRE_ROUTING:
66  return "prerouting";
67  case NF_INET_LOCAL_IN:
68  return "input";
69  case NF_INET_FORWARD:
70  return "forward";
71  case NF_INET_LOCAL_OUT:
72  return "output";
73  case NF_INET_POST_ROUTING:
74  return "postrouting";
75  }
76  break;
77  case NFPROTO_ARP:
78  switch (hooknum) {
79  case NF_ARP_IN:
80  return "input";
81  case NF_ARP_OUT:
82  return "output";
83  case NF_ARP_FORWARD:
84  return "forward";
85  }
86  break;
87  case NFPROTO_NETDEV:
88  switch (hooknum) {
89  case NF_NETDEV_INGRESS:
90  return "ingress";
91  }
92  break;
93  }
94  return "unknown";
95 }
96 
97 EXPORT_SYMBOL(nftnl_chain_alloc);
98 struct nftnl_chain *nftnl_chain_alloc(void)
99 {
100  struct nftnl_chain *c;
101 
102  c = calloc(1, sizeof(struct nftnl_chain));
103  if (c == NULL)
104  return NULL;
105 
106  INIT_LIST_HEAD(&c->rule_list);
107 
108  return c;
109 }
110 
111 EXPORT_SYMBOL(nftnl_chain_free);
112 void nftnl_chain_free(const struct nftnl_chain *c)
113 {
114  struct nftnl_rule *r, *tmp;
115 
116  list_for_each_entry_safe(r, tmp, &c->rule_list, head)
117  nftnl_rule_free(r);
118 
119  if (c->flags & (1 << NFTNL_CHAIN_NAME))
120  xfree(c->name);
121  if (c->flags & (1 << NFTNL_CHAIN_TABLE))
122  xfree(c->table);
123  if (c->flags & (1 << NFTNL_CHAIN_TYPE))
124  xfree(c->type);
125  if (c->flags & (1 << NFTNL_CHAIN_DEV))
126  xfree(c->dev);
127  if (c->flags & (1 << NFTNL_CHAIN_USERDATA))
128  xfree(c->user.data);
129  if (c->flags & (1 << NFTNL_CHAIN_DEVICES))
130  nftnl_str_array_clear((struct nftnl_str_array *)&c->dev_array);
131  xfree(c);
132 }
133 
134 EXPORT_SYMBOL(nftnl_chain_is_set);
135 bool nftnl_chain_is_set(const struct nftnl_chain *c, uint16_t attr)
136 {
137  return c->flags & (1 << attr);
138 }
139 
140 EXPORT_SYMBOL(nftnl_chain_unset);
141 void nftnl_chain_unset(struct nftnl_chain *c, uint16_t attr)
142 {
143  if (!(c->flags & (1 << attr)))
144  return;
145 
146  switch (attr) {
147  case NFTNL_CHAIN_NAME:
148  xfree(c->name);
149  break;
150  case NFTNL_CHAIN_TABLE:
151  xfree(c->table);
152  break;
153  case NFTNL_CHAIN_USE:
154  break;
155  case NFTNL_CHAIN_TYPE:
156  xfree(c->type);
157  break;
158  case NFTNL_CHAIN_HOOKNUM:
159  case NFTNL_CHAIN_PRIO:
160  case NFTNL_CHAIN_POLICY:
161  case NFTNL_CHAIN_BYTES:
162  case NFTNL_CHAIN_PACKETS:
163  case NFTNL_CHAIN_HANDLE:
164  case NFTNL_CHAIN_FAMILY:
165  case NFTNL_CHAIN_FLAGS:
166  case NFTNL_CHAIN_ID:
167  break;
168  case NFTNL_CHAIN_DEV:
169  xfree(c->dev);
170  break;
171  case NFTNL_CHAIN_DEVICES:
172  nftnl_str_array_clear(&c->dev_array);
173  break;
174  case NFTNL_CHAIN_USERDATA:
175  xfree(c->user.data);
176  break;
177  default:
178  return;
179  }
180 
181  c->flags &= ~(1 << attr);
182 }
183 
184 static uint32_t nftnl_chain_validate[NFTNL_CHAIN_MAX + 1] = {
185  [NFTNL_CHAIN_HOOKNUM] = sizeof(uint32_t),
186  [NFTNL_CHAIN_PRIO] = sizeof(int32_t),
187  [NFTNL_CHAIN_POLICY] = sizeof(uint32_t),
188  [NFTNL_CHAIN_USE] = sizeof(uint32_t),
189  [NFTNL_CHAIN_BYTES] = sizeof(uint64_t),
190  [NFTNL_CHAIN_PACKETS] = sizeof(uint64_t),
191  [NFTNL_CHAIN_HANDLE] = sizeof(uint64_t),
192  [NFTNL_CHAIN_FAMILY] = sizeof(uint32_t),
193  [NFTNL_CHAIN_FLAGS] = sizeof(uint32_t),
194  [NFTNL_CHAIN_ID] = sizeof(uint32_t),
195 };
196 
197 EXPORT_SYMBOL(nftnl_chain_set_data);
198 int nftnl_chain_set_data(struct nftnl_chain *c, uint16_t attr,
199  const void *data, uint32_t data_len)
200 {
201  nftnl_assert_attr_exists(attr, NFTNL_CHAIN_MAX);
202  nftnl_assert_validate(data, nftnl_chain_validate, attr, data_len);
203 
204  switch(attr) {
205  case NFTNL_CHAIN_NAME:
206  return nftnl_set_str_attr(&c->name, &c->flags,
207  attr, data, data_len);
208  case NFTNL_CHAIN_TABLE:
209  return nftnl_set_str_attr(&c->table, &c->flags,
210  attr, data, data_len);
211  case NFTNL_CHAIN_HOOKNUM:
212  memcpy(&c->hooknum, data, sizeof(c->hooknum));
213  break;
214  case NFTNL_CHAIN_PRIO:
215  memcpy(&c->prio, data, sizeof(c->prio));
216  break;
217  case NFTNL_CHAIN_POLICY:
218  memcpy(&c->policy, data, sizeof(c->policy));
219  break;
220  case NFTNL_CHAIN_USE:
221  memcpy(&c->use, data, sizeof(c->use));
222  break;
223  case NFTNL_CHAIN_BYTES:
224  memcpy(&c->bytes, data, sizeof(c->bytes));
225  break;
226  case NFTNL_CHAIN_PACKETS:
227  memcpy(&c->packets, data, sizeof(c->packets));
228  break;
229  case NFTNL_CHAIN_HANDLE:
230  memcpy(&c->handle, data, sizeof(c->handle));
231  break;
232  case NFTNL_CHAIN_FAMILY:
233  memcpy(&c->family, data, sizeof(c->family));
234  break;
235  case NFTNL_CHAIN_TYPE:
236  return nftnl_set_str_attr(&c->type, &c->flags,
237  attr, data, data_len);
238  case NFTNL_CHAIN_DEV:
239  return nftnl_set_str_attr(&c->dev, &c->flags,
240  attr, data, data_len);
241  case NFTNL_CHAIN_DEVICES:
242  if (nftnl_str_array_set(&c->dev_array, data) < 0)
243  return -1;
244  break;
245  case NFTNL_CHAIN_FLAGS:
246  memcpy(&c->chain_flags, data, sizeof(c->chain_flags));
247  break;
248  case NFTNL_CHAIN_ID:
249  memcpy(&c->chain_id, data, sizeof(c->chain_id));
250  break;
251  case NFTNL_CHAIN_USERDATA:
252  if (c->flags & (1 << NFTNL_CHAIN_USERDATA))
253  xfree(c->user.data);
254 
255  c->user.data = malloc(data_len);
256  if (!c->user.data)
257  return -1;
258  memcpy(c->user.data, data, data_len);
259  c->user.len = data_len;
260  break;
261  }
262  c->flags |= (1 << attr);
263  return 0;
264 }
265 
266 void nftnl_chain_set(struct nftnl_chain *c, uint16_t attr, const void *data) __visible;
267 void nftnl_chain_set(struct nftnl_chain *c, uint16_t attr, const void *data)
268 {
269  nftnl_chain_set_data(c, attr, data, nftnl_chain_validate[attr]);
270 }
271 
272 EXPORT_SYMBOL(nftnl_chain_set_u32);
273 void nftnl_chain_set_u32(struct nftnl_chain *c, uint16_t attr, uint32_t data)
274 {
275  nftnl_chain_set_data(c, attr, &data, sizeof(uint32_t));
276 }
277 
278 EXPORT_SYMBOL(nftnl_chain_set_s32);
279 void nftnl_chain_set_s32(struct nftnl_chain *c, uint16_t attr, int32_t data)
280 {
281  nftnl_chain_set_data(c, attr, &data, sizeof(int32_t));
282 }
283 
284 EXPORT_SYMBOL(nftnl_chain_set_u64);
285 void nftnl_chain_set_u64(struct nftnl_chain *c, uint16_t attr, uint64_t data)
286 {
287  nftnl_chain_set_data(c, attr, &data, sizeof(uint64_t));
288 }
289 
290 EXPORT_SYMBOL(nftnl_chain_set_u8);
291 void nftnl_chain_set_u8(struct nftnl_chain *c, uint16_t attr, uint8_t data)
292 {
293  nftnl_chain_set_data(c, attr, &data, sizeof(uint8_t));
294 }
295 
296 EXPORT_SYMBOL(nftnl_chain_set_str);
297 int nftnl_chain_set_str(struct nftnl_chain *c, uint16_t attr, const char *str)
298 {
299  return nftnl_chain_set_data(c, attr, str, strlen(str) + 1);
300 }
301 
302 EXPORT_SYMBOL(nftnl_chain_set_array);
303 int nftnl_chain_set_array(struct nftnl_chain *c, uint16_t attr,
304  const char **data)
305 {
306  return nftnl_chain_set_data(c, attr, data, 0);
307 }
308 
309 EXPORT_SYMBOL(nftnl_chain_get_data);
310 const void *nftnl_chain_get_data(const struct nftnl_chain *c, uint16_t attr,
311  uint32_t *data_len)
312 {
313  if (!(c->flags & (1 << attr)))
314  return NULL;
315 
316  switch(attr) {
317  case NFTNL_CHAIN_NAME:
318  *data_len = strlen(c->name) + 1;
319  return c->name;
320  case NFTNL_CHAIN_TABLE:
321  *data_len = strlen(c->table) + 1;
322  return c->table;
323  case NFTNL_CHAIN_HOOKNUM:
324  *data_len = sizeof(uint32_t);
325  return &c->hooknum;
326  case NFTNL_CHAIN_PRIO:
327  *data_len = sizeof(int32_t);
328  return &c->prio;
329  case NFTNL_CHAIN_POLICY:
330  *data_len = sizeof(uint32_t);
331  return &c->policy;
332  case NFTNL_CHAIN_USE:
333  *data_len = sizeof(uint32_t);
334  return &c->use;
335  case NFTNL_CHAIN_BYTES:
336  *data_len = sizeof(uint64_t);
337  return &c->bytes;
338  case NFTNL_CHAIN_PACKETS:
339  *data_len = sizeof(uint64_t);
340  return &c->packets;
341  case NFTNL_CHAIN_HANDLE:
342  *data_len = sizeof(uint64_t);
343  return &c->handle;
344  case NFTNL_CHAIN_FAMILY:
345  *data_len = sizeof(uint32_t);
346  return &c->family;
347  case NFTNL_CHAIN_TYPE:
348  *data_len = sizeof(uint32_t);
349  return c->type;
350  case NFTNL_CHAIN_DEV:
351  *data_len = strlen(c->dev) + 1;
352  return c->dev;
353  case NFTNL_CHAIN_DEVICES:
354  *data_len = 0;
355  return c->dev_array.array;
356  case NFTNL_CHAIN_FLAGS:
357  *data_len = sizeof(uint32_t);
358  return &c->chain_flags;
359  case NFTNL_CHAIN_ID:
360  *data_len = sizeof(uint32_t);
361  return &c->chain_id;
362  case NFTNL_CHAIN_USERDATA:
363  *data_len = c->user.len;
364  return c->user.data;
365  }
366  return NULL;
367 }
368 
369 EXPORT_SYMBOL(nftnl_chain_get);
370 const void *nftnl_chain_get(const struct nftnl_chain *c, uint16_t attr)
371 {
372  uint32_t data_len;
373  return nftnl_chain_get_data(c, attr, &data_len);
374 }
375 
376 EXPORT_SYMBOL(nftnl_chain_get_str);
377 const char *nftnl_chain_get_str(const struct nftnl_chain *c, uint16_t attr)
378 {
379  return nftnl_chain_get(c, attr);
380 }
381 
382 EXPORT_SYMBOL(nftnl_chain_get_u32);
383 uint32_t nftnl_chain_get_u32(const struct nftnl_chain *c, uint16_t attr)
384 {
385  uint32_t data_len;
386  const uint32_t *val = nftnl_chain_get_data(c, attr, &data_len);
387 
388  nftnl_assert(val, attr, data_len == sizeof(uint32_t));
389 
390  return val ? *val : 0;
391 }
392 
393 EXPORT_SYMBOL(nftnl_chain_get_s32);
394 int32_t nftnl_chain_get_s32(const struct nftnl_chain *c, uint16_t attr)
395 {
396  uint32_t data_len;
397  const int32_t *val = nftnl_chain_get_data(c, attr, &data_len);
398 
399  nftnl_assert(val, attr, data_len == sizeof(int32_t));
400 
401  return val ? *val : 0;
402 }
403 
404 EXPORT_SYMBOL(nftnl_chain_get_u64);
405 uint64_t nftnl_chain_get_u64(const struct nftnl_chain *c, uint16_t attr)
406 {
407  uint32_t data_len;
408  const uint64_t *val = nftnl_chain_get_data(c, attr, &data_len);
409 
410  nftnl_assert(val, attr, data_len == sizeof(int64_t));
411 
412  return val ? *val : 0;
413 }
414 
415 EXPORT_SYMBOL(nftnl_chain_get_u8);
416 uint8_t nftnl_chain_get_u8(const struct nftnl_chain *c, uint16_t attr)
417 {
418  uint32_t data_len;
419  const uint8_t *val = nftnl_chain_get_data(c, attr, &data_len);
420 
421  nftnl_assert(val, attr, data_len == sizeof(int8_t));
422 
423  return val ? *val : 0;
424 }
425 
426 EXPORT_SYMBOL(nftnl_chain_get_array);
427 const char *const *nftnl_chain_get_array(const struct nftnl_chain *c, uint16_t attr)
428 {
429  uint32_t data_len;
430  const char * const *val = nftnl_chain_get_data(c, attr, &data_len);
431 
432  nftnl_assert(val, attr, attr == NFTNL_CHAIN_DEVICES);
433 
434  return val;
435 }
436 
437 EXPORT_SYMBOL(nftnl_chain_nlmsg_build_payload);
438 void nftnl_chain_nlmsg_build_payload(struct nlmsghdr *nlh, const struct nftnl_chain *c)
439 {
440  struct nlattr *nest = NULL;
441  int i;
442 
443  if (c->flags & (1 << NFTNL_CHAIN_TABLE))
444  mnl_attr_put_strz(nlh, NFTA_CHAIN_TABLE, c->table);
445  if (c->flags & (1 << NFTNL_CHAIN_NAME))
446  mnl_attr_put_strz(nlh, NFTA_CHAIN_NAME, c->name);
447 
448  if ((c->flags & (1 << NFTNL_CHAIN_HOOKNUM)) ||
449  (c->flags & (1 << NFTNL_CHAIN_PRIO)) ||
450  (c->flags & (1 << NFTNL_CHAIN_DEV)) ||
451  (c->flags & (1 << NFTNL_CHAIN_DEVICES)))
452  nest = mnl_attr_nest_start(nlh, NFTA_CHAIN_HOOK);
453 
454  if ((c->flags & (1 << NFTNL_CHAIN_HOOKNUM)))
455  mnl_attr_put_u32(nlh, NFTA_HOOK_HOOKNUM, htonl(c->hooknum));
456  if ((c->flags & (1 << NFTNL_CHAIN_PRIO)))
457  mnl_attr_put_u32(nlh, NFTA_HOOK_PRIORITY, htonl(c->prio));
458 
459  if (c->flags & (1 << NFTNL_CHAIN_DEV))
460  mnl_attr_put_strz(nlh, NFTA_HOOK_DEV, c->dev);
461  else if (c->flags & (1 << NFTNL_CHAIN_DEVICES)) {
462  struct nlattr *nest_dev;
463  const char *dev;
464 
465  nest_dev = mnl_attr_nest_start(nlh, NFTA_HOOK_DEVS);
466  nftnl_str_array_foreach(dev, &c->dev_array, i)
467  nftnl_attr_put_ifname(nlh, dev);
468  mnl_attr_nest_end(nlh, nest_dev);
469  }
470 
471  if ((c->flags & (1 << NFTNL_CHAIN_HOOKNUM)) ||
472  (c->flags & (1 << NFTNL_CHAIN_PRIO)) ||
473  (c->flags & (1 << NFTNL_CHAIN_DEV)) ||
474  (c->flags & (1 << NFTNL_CHAIN_DEVICES)))
475  mnl_attr_nest_end(nlh, nest);
476 
477  if (c->flags & (1 << NFTNL_CHAIN_POLICY))
478  mnl_attr_put_u32(nlh, NFTA_CHAIN_POLICY, htonl(c->policy));
479  if (c->flags & (1 << NFTNL_CHAIN_USE))
480  mnl_attr_put_u32(nlh, NFTA_CHAIN_USE, htonl(c->use));
481  if ((c->flags & (1 << NFTNL_CHAIN_PACKETS)) &&
482  (c->flags & (1 << NFTNL_CHAIN_BYTES))) {
483  nest = mnl_attr_nest_start(nlh, NFTA_CHAIN_COUNTERS);
484  mnl_attr_put_u64(nlh, NFTA_COUNTER_PACKETS, be64toh(c->packets));
485  mnl_attr_put_u64(nlh, NFTA_COUNTER_BYTES, be64toh(c->bytes));
486  mnl_attr_nest_end(nlh, nest);
487  }
488  if (c->flags & (1 << NFTNL_CHAIN_HANDLE))
489  mnl_attr_put_u64(nlh, NFTA_CHAIN_HANDLE, be64toh(c->handle));
490  if (c->flags & (1 << NFTNL_CHAIN_TYPE))
491  mnl_attr_put_strz(nlh, NFTA_CHAIN_TYPE, c->type);
492  if (c->flags & (1 << NFTNL_CHAIN_FLAGS))
493  mnl_attr_put_u32(nlh, NFTA_CHAIN_FLAGS, htonl(c->chain_flags));
494  if (c->flags & (1 << NFTNL_CHAIN_ID))
495  mnl_attr_put_u32(nlh, NFTA_CHAIN_ID, htonl(c->chain_id));
496  if (c->flags & (1 << NFTNL_CHAIN_USERDATA))
497  mnl_attr_put(nlh, NFTA_CHAIN_USERDATA, c->user.len, c->user.data);
498 }
499 
500 EXPORT_SYMBOL(nftnl_chain_rule_add);
501 void nftnl_chain_rule_add(struct nftnl_rule *rule, struct nftnl_chain *c)
502 {
503  list_add(&rule->head, &c->rule_list);
504 }
505 
506 EXPORT_SYMBOL(nftnl_chain_rule_del);
507 void nftnl_chain_rule_del(struct nftnl_rule *r)
508 {
509  list_del(&r->head);
510 }
511 
512 EXPORT_SYMBOL(nftnl_chain_rule_add_tail);
513 void nftnl_chain_rule_add_tail(struct nftnl_rule *rule, struct nftnl_chain *c)
514 {
515  list_add_tail(&rule->head, &c->rule_list);
516 }
517 
518 EXPORT_SYMBOL(nftnl_chain_rule_insert_at);
519 void nftnl_chain_rule_insert_at(struct nftnl_rule *rule, struct nftnl_rule *pos)
520 {
521  list_add_tail(&rule->head, &pos->head);
522 }
523 
524 EXPORT_SYMBOL(nftnl_chain_rule_append_at);
525 void nftnl_chain_rule_append_at(struct nftnl_rule *rule, struct nftnl_rule *pos)
526 {
527  list_add(&rule->head, &pos->head);
528 }
529 
530 static int nftnl_chain_parse_attr_cb(const struct nlattr *attr, void *data)
531 {
532  const struct nlattr **tb = data;
533  int type = mnl_attr_get_type(attr);
534 
535  if (mnl_attr_type_valid(attr, NFTA_CHAIN_MAX) < 0)
536  return MNL_CB_OK;
537 
538  switch(type) {
539  case NFTA_CHAIN_NAME:
540  case NFTA_CHAIN_TABLE:
541  case NFTA_CHAIN_TYPE:
542  if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
543  abi_breakage();
544  break;
545  case NFTA_CHAIN_HOOK:
546  case NFTA_CHAIN_COUNTERS:
547  if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
548  abi_breakage();
549  break;
550  case NFTA_CHAIN_POLICY:
551  case NFTA_CHAIN_USE:
552  case NFTA_CHAIN_FLAGS:
553  case NFTA_CHAIN_ID:
554  if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
555  abi_breakage();
556  break;
557  case NFTA_CHAIN_HANDLE:
558  if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
559  abi_breakage();
560  break;
561  case NFTA_CHAIN_USERDATA:
562  if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0)
563  abi_breakage();
564  break;
565  }
566 
567  tb[type] = attr;
568  return MNL_CB_OK;
569 }
570 
571 static int nftnl_chain_parse_counters_cb(const struct nlattr *attr, void *data)
572 {
573  const struct nlattr **tb = data;
574  int type = mnl_attr_get_type(attr);
575 
576  if (mnl_attr_type_valid(attr, NFTA_COUNTER_MAX) < 0)
577  return MNL_CB_OK;
578 
579  switch(type) {
580  case NFTA_COUNTER_BYTES:
581  case NFTA_COUNTER_PACKETS:
582  if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
583  abi_breakage();
584  break;
585  }
586 
587  tb[type] = attr;
588  return MNL_CB_OK;
589 }
590 
591 static int nftnl_chain_parse_counters(struct nlattr *attr, struct nftnl_chain *c)
592 {
593  struct nlattr *tb[NFTA_COUNTER_MAX+1] = {};
594 
595  if (mnl_attr_parse_nested(attr, nftnl_chain_parse_counters_cb, tb) < 0)
596  return -1;
597 
598  if (tb[NFTA_COUNTER_PACKETS]) {
599  c->packets = be64toh(mnl_attr_get_u64(tb[NFTA_COUNTER_PACKETS]));
600  c->flags |= (1 << NFTNL_CHAIN_PACKETS);
601  }
602  if (tb[NFTA_COUNTER_BYTES]) {
603  c->bytes = be64toh(mnl_attr_get_u64(tb[NFTA_COUNTER_BYTES]));
604  c->flags |= (1 << NFTNL_CHAIN_BYTES);
605  }
606 
607  return 0;
608 }
609 
610 static int nftnl_chain_parse_hook_cb(const struct nlattr *attr, void *data)
611 {
612  const struct nlattr **tb = data;
613  int type = mnl_attr_get_type(attr);
614 
615  if (mnl_attr_type_valid(attr, NFTA_HOOK_MAX) < 0)
616  return MNL_CB_OK;
617 
618  switch(type) {
619  case NFTA_HOOK_HOOKNUM:
620  case NFTA_HOOK_PRIORITY:
621  if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
622  abi_breakage();
623  break;
624  case NFTA_HOOK_DEV:
625  if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
626  abi_breakage();
627  break;
628  }
629 
630  tb[type] = attr;
631  return MNL_CB_OK;
632 }
633 
634 static int nftnl_chain_parse_hook(struct nlattr *attr, struct nftnl_chain *c)
635 {
636  struct nlattr *tb[NFTA_HOOK_MAX+1] = {};
637  int ret;
638 
639  if (mnl_attr_parse_nested(attr, nftnl_chain_parse_hook_cb, tb) < 0)
640  return -1;
641 
642  if (tb[NFTA_HOOK_HOOKNUM]) {
643  c->hooknum = ntohl(mnl_attr_get_u32(tb[NFTA_HOOK_HOOKNUM]));
644  c->flags |= (1 << NFTNL_CHAIN_HOOKNUM);
645  }
646  if (tb[NFTA_HOOK_PRIORITY]) {
647  c->prio = ntohl(mnl_attr_get_u32(tb[NFTA_HOOK_PRIORITY]));
648  c->flags |= (1 << NFTNL_CHAIN_PRIO);
649  }
650  if (tb[NFTA_HOOK_DEV]) {
651  if (c->flags & (1 << NFTNL_CHAIN_DEV))
652  xfree(c->dev);
653  c->dev = strdup(mnl_attr_get_str(tb[NFTA_HOOK_DEV]));
654  if (!c->dev)
655  return -1;
656  c->flags |= (1 << NFTNL_CHAIN_DEV);
657  }
658  if (tb[NFTA_HOOK_DEVS]) {
659  ret = nftnl_parse_devs(&c->dev_array, tb[NFTA_HOOK_DEVS]);
660  if (ret < 0)
661  return -1;
662  c->flags |= (1 << NFTNL_CHAIN_DEVICES);
663  }
664 
665  return 0;
666 }
667 
668 EXPORT_SYMBOL(nftnl_chain_nlmsg_parse);
669 int nftnl_chain_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_chain *c)
670 {
671  struct nlattr *tb[NFTA_CHAIN_MAX+1] = {};
672  struct nfgenmsg *nfg = mnl_nlmsg_get_payload(nlh);
673  int ret = 0;
674 
675  if (mnl_attr_parse(nlh, sizeof(*nfg), nftnl_chain_parse_attr_cb, tb) < 0)
676  return -1;
677 
678  if (nftnl_parse_str_attr(tb[NFTA_CHAIN_NAME], NFTNL_CHAIN_NAME,
679  &c->name, &c->flags) < 0)
680  return -1;
681  if (nftnl_parse_str_attr(tb[NFTA_CHAIN_TABLE], NFTNL_CHAIN_TABLE,
682  &c->table, &c->flags) < 0)
683  return -1;
684  if (tb[NFTA_CHAIN_HOOK]) {
685  ret = nftnl_chain_parse_hook(tb[NFTA_CHAIN_HOOK], c);
686  if (ret < 0)
687  return ret;
688  }
689  if (tb[NFTA_CHAIN_POLICY]) {
690  c->policy = ntohl(mnl_attr_get_u32(tb[NFTA_CHAIN_POLICY]));
691  c->flags |= (1 << NFTNL_CHAIN_POLICY);
692  }
693  if (tb[NFTA_CHAIN_USE]) {
694  c->use = ntohl(mnl_attr_get_u32(tb[NFTA_CHAIN_USE]));
695  c->flags |= (1 << NFTNL_CHAIN_USE);
696  }
697  if (tb[NFTA_CHAIN_COUNTERS]) {
698  ret = nftnl_chain_parse_counters(tb[NFTA_CHAIN_COUNTERS], c);
699  if (ret < 0)
700  return ret;
701  }
702  if (tb[NFTA_CHAIN_HANDLE]) {
703  c->handle = be64toh(mnl_attr_get_u64(tb[NFTA_CHAIN_HANDLE]));
704  c->flags |= (1 << NFTNL_CHAIN_HANDLE);
705  }
706  if (nftnl_parse_str_attr(tb[NFTA_CHAIN_TYPE], NFTNL_CHAIN_TYPE,
707  &c->type, &c->flags) < 0)
708  return -1;
709  if (tb[NFTA_CHAIN_FLAGS]) {
710  c->chain_flags = ntohl(mnl_attr_get_u32(tb[NFTA_CHAIN_FLAGS]));
711  c->flags |= (1 << NFTNL_CHAIN_FLAGS);
712  }
713  if (tb[NFTA_CHAIN_ID]) {
714  c->chain_id = ntohl(mnl_attr_get_u32(tb[NFTA_CHAIN_ID]));
715  c->flags |= (1 << NFTNL_CHAIN_ID);
716  }
717  if (tb[NFTA_CHAIN_USERDATA]) {
718  nftnl_chain_set_data(c, NFTNL_CHAIN_USERDATA,
719  mnl_attr_get_payload(tb[NFTA_CHAIN_USERDATA]),
720  mnl_attr_get_payload_len(tb[NFTA_CHAIN_USERDATA]));
721  }
722 
723  c->family = nfg->nfgen_family;
724  c->flags |= (1 << NFTNL_CHAIN_FAMILY);
725 
726  return ret;
727 }
728 
729 static int nftnl_chain_snprintf_default(char *buf, size_t remain,
730  const struct nftnl_chain *c)
731 {
732  int ret, offset = 0, i;
733  const char *dev;
734 
735  ret = snprintf(buf, remain, "%s %s %s use %u",
736  nftnl_family2str(c->family), c->table, c->name, c->use);
737  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
738 
739  if (c->flags & (1 << NFTNL_CHAIN_HOOKNUM)) {
740  ret = snprintf(buf + offset, remain, " type %s hook %s prio %d",
741  c->type, nftnl_hooknum2str(c->family, c->hooknum),
742  c->prio);
743  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
744 
745  if (c->flags & (1 << NFTNL_CHAIN_POLICY)) {
746  ret = snprintf(buf + offset, remain, " policy %s",
747  nftnl_verdict2str(c->policy));
748  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
749  }
750 
751  ret = snprintf(buf + offset, remain,
752  " packets %"PRIu64" bytes %"PRIu64"",
753  c->packets, c->bytes);
754  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
755 
756  if (c->flags & (1 << NFTNL_CHAIN_DEV)) {
757  ret = snprintf(buf + offset, remain, " dev %s ",
758  c->dev);
759  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
760  }
761  if (c->flags & (1 << NFTNL_CHAIN_DEVICES)) {
762  ret = snprintf(buf + offset, remain, " dev { ");
763  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
764 
765  nftnl_str_array_foreach(dev, &c->dev_array, i) {
766  ret = snprintf(buf + offset, remain, " %s ",
767  dev);
768  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
769  }
770  ret = snprintf(buf + offset, remain, " } ");
771  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
772  }
773  if (c->flags & (1 << NFTNL_CHAIN_FLAGS)) {
774  ret = snprintf(buf + offset, remain, " flags %x",
775  c->chain_flags);
776  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
777  }
778  if (c->flags & (1 << NFTNL_CHAIN_ID)) {
779  ret = snprintf(buf + offset, remain, " id %x",
780  c->chain_id);
781  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
782  }
783  }
784 
785  return offset;
786 }
787 
788 static int nftnl_chain_cmd_snprintf(char *buf, size_t remain,
789  const struct nftnl_chain *c, uint32_t cmd,
790  uint32_t type, uint32_t flags)
791 {
792  int ret, offset = 0;
793 
794  if (type != NFTNL_OUTPUT_DEFAULT)
795  return -1;
796 
797  ret = nftnl_chain_snprintf_default(buf + offset, remain, c);
798  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
799  return offset;
800 }
801 
802 EXPORT_SYMBOL(nftnl_chain_snprintf);
803 int nftnl_chain_snprintf(char *buf, size_t size, const struct nftnl_chain *c,
804  uint32_t type, uint32_t flags)
805 {
806  if (size)
807  buf[0] = '\0';
808 
809  return nftnl_chain_cmd_snprintf(buf, size, c, nftnl_flag2cmd(flags),
810  type, flags);
811 }
812 
813 static int nftnl_chain_do_snprintf(char *buf, size_t size, const void *c,
814  uint32_t cmd, uint32_t type, uint32_t flags)
815 {
816  return nftnl_chain_snprintf(buf, size, c, type, flags);
817 }
818 
819 EXPORT_SYMBOL(nftnl_chain_fprintf);
820 int nftnl_chain_fprintf(FILE *fp, const struct nftnl_chain *c, uint32_t type,
821  uint32_t flags)
822 {
823  return nftnl_fprintf(fp, c, NFTNL_CMD_UNSPEC, type, flags,
824  nftnl_chain_do_snprintf);
825 }
826 
827 EXPORT_SYMBOL(nftnl_rule_foreach);
828 int nftnl_rule_foreach(struct nftnl_chain *c,
829  int (*cb)(struct nftnl_rule *r, void *data),
830  void *data)
831 {
832  struct nftnl_rule *cur, *tmp;
833  int ret;
834 
835  list_for_each_entry_safe(cur, tmp, &c->rule_list, head) {
836  ret = cb(cur, data);
837  if (ret < 0)
838  return ret;
839  }
840  return 0;
841 }
842 
843 EXPORT_SYMBOL(nftnl_rule_lookup_byindex);
844 struct nftnl_rule *
845 nftnl_rule_lookup_byindex(struct nftnl_chain *c, uint32_t index)
846 {
847  struct nftnl_rule *r;
848 
849  list_for_each_entry(r, &c->rule_list, head) {
850  if (!index)
851  return r;
852  index--;
853  }
854  return NULL;
855 }
856 
857 struct nftnl_rule_iter {
858  const struct nftnl_chain *c;
859  struct nftnl_rule *cur;
860 };
861 
862 static void nftnl_rule_iter_init(const struct nftnl_chain *c,
863  struct nftnl_rule_iter *iter)
864 {
865  iter->c = c;
866  if (list_empty(&c->rule_list))
867  iter->cur = NULL;
868  else
869  iter->cur = list_entry(c->rule_list.next, struct nftnl_rule,
870  head);
871 }
872 
873 EXPORT_SYMBOL(nftnl_rule_iter_create);
874 struct nftnl_rule_iter *nftnl_rule_iter_create(const struct nftnl_chain *c)
875 {
876  struct nftnl_rule_iter *iter;
877 
878  iter = calloc(1, sizeof(struct nftnl_rule_iter));
879  if (iter == NULL)
880  return NULL;
881 
882  nftnl_rule_iter_init(c, iter);
883 
884  return iter;
885 }
886 
887 EXPORT_SYMBOL(nftnl_rule_iter_next);
888 struct nftnl_rule *nftnl_rule_iter_next(struct nftnl_rule_iter *iter)
889 {
890  struct nftnl_rule *rule = iter->cur;
891 
892  if (rule == NULL)
893  return NULL;
894 
895  /* get next rule, if any */
896  iter->cur = list_entry(iter->cur->head.next, struct nftnl_rule, head);
897  if (&iter->cur->head == iter->c->rule_list.next)
898  return NULL;
899 
900  return rule;
901 }
902 
903 EXPORT_SYMBOL(nftnl_rule_iter_destroy);
904 void nftnl_rule_iter_destroy(struct nftnl_rule_iter *iter)
905 {
906  xfree(iter);
907 }
908 
909 #define CHAIN_NAME_HSIZE 512
910 
911 struct nftnl_chain_list {
912 
913  struct list_head list;
914  struct hlist_head name_hash[CHAIN_NAME_HSIZE];
915 };
916 
917 EXPORT_SYMBOL(nftnl_chain_list_alloc);
918 struct nftnl_chain_list *nftnl_chain_list_alloc(void)
919 {
920  struct nftnl_chain_list *list;
921  int i;
922 
923  list = calloc(1, sizeof(struct nftnl_chain_list));
924  if (list == NULL)
925  return NULL;
926 
927  INIT_LIST_HEAD(&list->list);
928  for (i = 0; i < CHAIN_NAME_HSIZE; i++)
929  INIT_HLIST_HEAD(&list->name_hash[i]);
930 
931  return list;
932 }
933 
934 EXPORT_SYMBOL(nftnl_chain_list_free);
935 void nftnl_chain_list_free(struct nftnl_chain_list *list)
936 {
937  struct nftnl_chain *r, *tmp;
938 
939  list_for_each_entry_safe(r, tmp, &list->list, head) {
940  list_del(&r->head);
941  hlist_del(&r->hnode);
942  nftnl_chain_free(r);
943  }
944  xfree(list);
945 }
946 
947 EXPORT_SYMBOL(nftnl_chain_list_is_empty);
948 int nftnl_chain_list_is_empty(const struct nftnl_chain_list *list)
949 {
950  return list_empty(&list->list);
951 }
952 
953 static uint32_t djb_hash(const char *key)
954 {
955  uint32_t i, hash = 5381;
956 
957  for (i = 0; i < strlen(key); i++)
958  hash = ((hash << 5) + hash) + key[i];
959 
960  return hash;
961 }
962 
963 EXPORT_SYMBOL(nftnl_chain_list_add);
964 void nftnl_chain_list_add(struct nftnl_chain *r, struct nftnl_chain_list *list)
965 {
966  int key = djb_hash(r->name) % CHAIN_NAME_HSIZE;
967 
968  hlist_add_head(&r->hnode, &list->name_hash[key]);
969  list_add(&r->head, &list->list);
970 }
971 
972 EXPORT_SYMBOL(nftnl_chain_list_add_tail);
973 void nftnl_chain_list_add_tail(struct nftnl_chain *r, struct nftnl_chain_list *list)
974 {
975  int key = djb_hash(r->name) % CHAIN_NAME_HSIZE;
976 
977  hlist_add_head(&r->hnode, &list->name_hash[key]);
978  list_add_tail(&r->head, &list->list);
979 }
980 
981 EXPORT_SYMBOL(nftnl_chain_list_del);
982 void nftnl_chain_list_del(struct nftnl_chain *r)
983 {
984  list_del(&r->head);
985  hlist_del(&r->hnode);
986 }
987 
988 EXPORT_SYMBOL(nftnl_chain_list_foreach);
989 int nftnl_chain_list_foreach(struct nftnl_chain_list *chain_list,
990  int (*cb)(struct nftnl_chain *r, void *data),
991  void *data)
992 {
993  struct nftnl_chain *cur, *tmp;
994  int ret;
995 
996  list_for_each_entry_safe(cur, tmp, &chain_list->list, head) {
997  ret = cb(cur, data);
998  if (ret < 0)
999  return ret;
1000  }
1001  return 0;
1002 }
1003 
1004 EXPORT_SYMBOL(nftnl_chain_list_lookup_byname);
1005 struct nftnl_chain *
1006 nftnl_chain_list_lookup_byname(struct nftnl_chain_list *chain_list,
1007  const char *chain)
1008 {
1009  int key = djb_hash(chain) % CHAIN_NAME_HSIZE;
1010  struct nftnl_chain *c;
1011  struct hlist_node *n;
1012 
1013  hlist_for_each_entry(c, n, &chain_list->name_hash[key], hnode) {
1014  if (!strcmp(chain, c->name))
1015  return c;
1016  }
1017  return NULL;
1018 }
1019 
1020 struct nftnl_chain_list_iter {
1021  const struct nftnl_chain_list *list;
1022  struct nftnl_chain *cur;
1023 };
1024 
1025 EXPORT_SYMBOL(nftnl_chain_list_iter_create);
1026 struct nftnl_chain_list_iter *
1027 nftnl_chain_list_iter_create(const struct nftnl_chain_list *l)
1028 {
1029  struct nftnl_chain_list_iter *iter;
1030 
1031  iter = calloc(1, sizeof(struct nftnl_chain_list_iter));
1032  if (iter == NULL)
1033  return NULL;
1034 
1035  iter->list = l;
1036  if (nftnl_chain_list_is_empty(l))
1037  iter->cur = NULL;
1038  else
1039  iter->cur = list_entry(l->list.next, struct nftnl_chain, head);
1040 
1041  return iter;
1042 }
1043 
1044 EXPORT_SYMBOL(nftnl_chain_list_iter_next);
1045 struct nftnl_chain *nftnl_chain_list_iter_next(struct nftnl_chain_list_iter *iter)
1046 {
1047  struct nftnl_chain *r = iter->cur;
1048 
1049  if (r == NULL)
1050  return NULL;
1051 
1052  /* get next chain, if any */
1053  iter->cur = list_entry(iter->cur->head.next, struct nftnl_chain, head);
1054  if (&iter->cur->head == iter->list->list.next)
1055  return NULL;
1056 
1057  return r;
1058 }
1059 
1060 EXPORT_SYMBOL(nftnl_chain_list_iter_destroy);
1061 void nftnl_chain_list_iter_destroy(struct nftnl_chain_list_iter *iter)
1062 {
1063  xfree(iter);
1064 }
nftnl_chain_list
Definition: chain.c:911
nftnl_chain_list_iter
Definition: chain.c:1020
nftnl_rule_iter
Definition: chain.c:857
nftnl_chain
Definition: chain.c:28
Generated by   doxygen 1.8.10