libnftnl 1.3.2
object.c
1/* SPDX-License-Identifier: GPL-2.0-or-later */
2/*
3 * (C) 2012-2016 by Pablo Neira Ayuso <pablo@netfilter.org>
4 */
5#include "internal.h"
6
7#include <time.h>
8#include <endian.h>
9#include <stdint.h>
10#include <limits.h>
11#include <stdlib.h>
12#include <string.h>
13#include <netinet/in.h>
14#include <errno.h>
15
16#include <libmnl/libmnl.h>
17#include <linux/netfilter/nfnetlink.h>
18#include <linux/netfilter/nf_tables.h>
19
20#include <libnftnl/object.h>
21#include "obj.h"
22
23static struct obj_ops *obj_ops[__NFT_OBJECT_MAX] = {
24 [NFT_OBJECT_COUNTER] = &obj_ops_counter,
25 [NFT_OBJECT_QUOTA] = &obj_ops_quota,
26 [NFT_OBJECT_CT_HELPER] = &obj_ops_ct_helper,
27 [NFT_OBJECT_LIMIT] = &obj_ops_limit,
28 [NFT_OBJECT_TUNNEL] = &obj_ops_tunnel,
29 [NFT_OBJECT_CT_TIMEOUT] = &obj_ops_ct_timeout,
30 [NFT_OBJECT_SECMARK] = &obj_ops_secmark,
31 [NFT_OBJECT_CT_EXPECT] = &obj_ops_ct_expect,
32 [NFT_OBJECT_SYNPROXY] = &obj_ops_synproxy,
33 [NFT_OBJECT_CONNLIMIT] = &obj_ops_connlimit,
34};
35
36static struct obj_ops *nftnl_obj_ops_lookup(uint32_t type)
37{
38 if (type > NFT_OBJECT_MAX)
39 return NULL;
40
41 return obj_ops[type];
42}
43
44EXPORT_SYMBOL(nftnl_obj_alloc);
45struct nftnl_obj *nftnl_obj_alloc(void)
46{
47 return calloc(1, sizeof(struct nftnl_obj));
48}
49
50EXPORT_SYMBOL(nftnl_obj_free);
51void nftnl_obj_free(const struct nftnl_obj *obj)
52{
53 if (obj->flags & (1 << NFTNL_OBJ_TABLE))
54 xfree(obj->table);
55 if (obj->flags & (1 << NFTNL_OBJ_NAME))
56 xfree(obj->name);
57 if (obj->flags & (1 << NFTNL_OBJ_USERDATA))
58 xfree(obj->user.data);
59 if (obj->flags & (1 << NFTNL_OBJ_TUNNEL_OPTS)) {
60 nftnl_tunnel_opts_free(obj->data.tunnel.tun_opts);
61 xfree(obj->data.tunnel.tun_opts);
62 }
63
64 xfree(obj);
65}
66
67EXPORT_SYMBOL(nftnl_obj_is_set);
68bool nftnl_obj_is_set(const struct nftnl_obj *obj, uint16_t attr)
69{
70 return obj->flags & (1 << attr);
71}
72
73EXPORT_SYMBOL(nftnl_obj_unset);
74void nftnl_obj_unset(struct nftnl_obj *obj, uint16_t attr)
75{
76 if (!(obj->flags & (1 << attr)))
77 return;
78
79 switch (attr) {
80 case NFTNL_OBJ_TABLE:
81 xfree(obj->table);
82 break;
83 case NFTNL_OBJ_NAME:
84 xfree(obj->name);
85 break;
86 case NFTNL_OBJ_USERDATA:
87 xfree(obj->user.data);
88 break;
89 case NFTNL_OBJ_TYPE:
90 case NFTNL_OBJ_FAMILY:
91 case NFTNL_OBJ_USE:
92 case NFTNL_OBJ_HANDLE:
93 break;
94 default:
95 break;
96 }
97
98 obj->flags &= ~(1 << attr);
99}
100
101static uint32_t nftnl_obj_validate[NFTNL_OBJ_MAX + 1] = {
102 [NFTNL_OBJ_TYPE] = sizeof(uint32_t),
103 [NFTNL_OBJ_FAMILY] = sizeof(uint32_t),
104 [NFTNL_OBJ_USE] = sizeof(uint32_t),
105 [NFTNL_OBJ_HANDLE] = sizeof(uint64_t),
106};
107
108EXPORT_SYMBOL(nftnl_obj_set_data);
109int nftnl_obj_set_data(struct nftnl_obj *obj, uint16_t attr,
110 const void *data, uint32_t data_len)
111{
112 if (attr < NFTNL_OBJ_MAX)
113 nftnl_assert_validate(data, nftnl_obj_validate, attr, data_len);
114
115 switch (attr) {
116 case NFTNL_OBJ_TABLE:
117 return nftnl_set_str_attr(&obj->table, &obj->flags,
118 attr, data, data_len);
119 break;
120 case NFTNL_OBJ_NAME:
121 return nftnl_set_str_attr(&obj->name, &obj->flags,
122 attr, data, data_len);
123 case NFTNL_OBJ_TYPE:
124 obj->ops = nftnl_obj_ops_lookup(*((uint32_t *)data));
125 if (!obj->ops)
126 return -1;
127 break;
128 case NFTNL_OBJ_FAMILY:
129 memcpy(&obj->family, data, sizeof(obj->family));
130 break;
131 case NFTNL_OBJ_USE:
132 memcpy(&obj->use, data, sizeof(obj->use));
133 break;
134 case NFTNL_OBJ_HANDLE:
135 memcpy(&obj->handle, data, sizeof(obj->handle));
136 break;
137 case NFTNL_OBJ_USERDATA:
138 if (obj->flags & (1 << NFTNL_OBJ_USERDATA))
139 xfree(obj->user.data);
140
141 obj->user.data = malloc(data_len);
142 if (!obj->user.data)
143 return -1;
144 memcpy(obj->user.data, data, data_len);
145 obj->user.len = data_len;
146 break;
147 default:
148 if (!obj->ops ||
149 attr < NFTNL_OBJ_BASE ||
150 attr > obj->ops->nftnl_max_attr ||
151 !obj->ops->attr_policy)
152 return -1;
153
154 if (obj->ops->attr_policy[attr].maxlen &&
155 obj->ops->attr_policy[attr].maxlen < data_len)
156 return -1;
157
158 if (obj->ops->set(obj, attr, data, data_len) < 0)
159 return -1;
160 }
161 obj->flags |= (1 << attr);
162 return 0;
163}
164
165void nftnl_obj_set(struct nftnl_obj *obj, uint16_t attr, const void *data) __visible;
166void nftnl_obj_set(struct nftnl_obj *obj, uint16_t attr, const void *data)
167{
168 nftnl_obj_set_data(obj, attr, data, nftnl_obj_validate[attr]);
169}
170
171EXPORT_SYMBOL(nftnl_obj_set_u8);
172int nftnl_obj_set_u8(struct nftnl_obj *obj, uint16_t attr, uint8_t val)
173{
174 return nftnl_obj_set_data(obj, attr, &val, sizeof(uint8_t));
175}
176
177EXPORT_SYMBOL(nftnl_obj_set_u16);
178int nftnl_obj_set_u16(struct nftnl_obj *obj, uint16_t attr, uint16_t val)
179{
180 return nftnl_obj_set_data(obj, attr, &val, sizeof(uint16_t));
181}
182
183EXPORT_SYMBOL(nftnl_obj_set_u32);
184int nftnl_obj_set_u32(struct nftnl_obj *obj, uint16_t attr, uint32_t val)
185{
186 return nftnl_obj_set_data(obj, attr, &val, sizeof(uint32_t));
187}
188
189EXPORT_SYMBOL(nftnl_obj_set_u64);
190int nftnl_obj_set_u64(struct nftnl_obj *obj, uint16_t attr, uint64_t val)
191{
192 return nftnl_obj_set_data(obj, attr, &val, sizeof(uint64_t));
193}
194
195EXPORT_SYMBOL(nftnl_obj_set_str);
196int nftnl_obj_set_str(struct nftnl_obj *obj, uint16_t attr, const char *str)
197{
198 return nftnl_obj_set_data(obj, attr, str, strlen(str) + 1);
199}
200
201EXPORT_SYMBOL(nftnl_obj_get_data);
202const void *nftnl_obj_get_data(const struct nftnl_obj *obj, uint16_t attr,
203 uint32_t *data_len)
204{
205 if (!(obj->flags & (1 << attr)))
206 return NULL;
207
208 switch(attr) {
209 case NFTNL_OBJ_TABLE:
210 return obj->table;
211 case NFTNL_OBJ_NAME:
212 return obj->name;
213 case NFTNL_OBJ_TYPE:
214 if (!obj->ops)
215 return NULL;
216
217 *data_len = sizeof(uint32_t);
218 return &obj->ops->type;
219 case NFTNL_OBJ_FAMILY:
220 *data_len = sizeof(uint32_t);
221 return &obj->family;
222 case NFTNL_OBJ_USE:
223 *data_len = sizeof(uint32_t);
224 return &obj->use;
225 case NFTNL_OBJ_HANDLE:
226 *data_len = sizeof(uint64_t);
227 return &obj->handle;
228 case NFTNL_OBJ_USERDATA:
229 *data_len = obj->user.len;
230 return obj->user.data;
231 default:
232 if (obj->ops)
233 return obj->ops->get(obj, attr, data_len);
234 break;
235 }
236 return NULL;
237}
238
239EXPORT_SYMBOL(nftnl_obj_get);
240const void *nftnl_obj_get(const struct nftnl_obj *obj, uint16_t attr)
241{
242 uint32_t data_len;
243 return nftnl_obj_get_data(obj, attr, &data_len);
244}
245
246EXPORT_SYMBOL(nftnl_obj_get_u8);
247uint8_t nftnl_obj_get_u8(const struct nftnl_obj *obj, uint16_t attr)
248{
249 const void *ret = nftnl_obj_get(obj, attr);
250 return ret == NULL ? 0 : *((uint8_t *)ret);
251}
252
253EXPORT_SYMBOL(nftnl_obj_get_u16);
254uint16_t nftnl_obj_get_u16(const struct nftnl_obj *obj, uint16_t attr)
255{
256 const void *ret = nftnl_obj_get(obj, attr);
257 return ret == NULL ? 0 : *((uint16_t *)ret);
258}
259
260EXPORT_SYMBOL(nftnl_obj_get_u32);
261uint32_t nftnl_obj_get_u32(const struct nftnl_obj *obj, uint16_t attr)
262{
263 const void *ret = nftnl_obj_get(obj, attr);
264 return ret == NULL ? 0 : *((uint32_t *)ret);
265}
266
267EXPORT_SYMBOL(nftnl_obj_get_u64);
268uint64_t nftnl_obj_get_u64(const struct nftnl_obj *obj, uint16_t attr)
269{
270 const void *ret = nftnl_obj_get(obj, attr);
271 return ret == NULL ? 0 : *((uint64_t *)ret);
272}
273
274EXPORT_SYMBOL(nftnl_obj_get_str);
275const char *nftnl_obj_get_str(const struct nftnl_obj *obj, uint16_t attr)
276{
277 return nftnl_obj_get(obj, attr);
278}
279
280EXPORT_SYMBOL(nftnl_obj_nlmsg_build_payload);
281void nftnl_obj_nlmsg_build_payload(struct nlmsghdr *nlh,
282 const struct nftnl_obj *obj)
283{
284 if (obj->flags & (1 << NFTNL_OBJ_TABLE))
285 mnl_attr_put_strz(nlh, NFTA_OBJ_TABLE, obj->table);
286 if (obj->flags & (1 << NFTNL_OBJ_NAME))
287 mnl_attr_put_strz(nlh, NFTA_OBJ_NAME, obj->name);
288 if (obj->flags & (1 << NFTNL_OBJ_TYPE))
289 mnl_attr_put_u32(nlh, NFTA_OBJ_TYPE, htonl(obj->ops->type));
290 if (obj->flags & (1 << NFTNL_OBJ_HANDLE))
291 mnl_attr_put_u64(nlh, NFTA_OBJ_HANDLE, htobe64(obj->handle));
292 if (obj->flags & (1 << NFTNL_OBJ_USERDATA))
293 mnl_attr_put(nlh, NFTA_OBJ_USERDATA, obj->user.len, obj->user.data);
294 if (obj->ops) {
295 struct nlattr *nest = mnl_attr_nest_start(nlh, NFTA_OBJ_DATA);
296
297 obj->ops->build(nlh, obj);
298 mnl_attr_nest_end(nlh, nest);
299 }
300}
301
302static int nftnl_obj_parse_attr_cb(const struct nlattr *attr, void *data)
303{
304 const struct nlattr **tb = data;
305 int type = mnl_attr_get_type(attr);
306
307 if (mnl_attr_type_valid(attr, NFTA_OBJ_MAX) < 0)
308 return MNL_CB_OK;
309
310 switch(type) {
311 case NFTA_OBJ_TABLE:
312 case NFTA_OBJ_NAME:
313 if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
314 abi_breakage();
315 break;
316 case NFTA_OBJ_HANDLE:
317 if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
318 abi_breakage();
319 break;
320 case NFTA_OBJ_DATA:
321 if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
322 abi_breakage();
323 break;
324 case NFTA_OBJ_USE:
325 if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
326 abi_breakage();
327 break;
328 case NFTA_OBJ_USERDATA:
329 if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0)
330 abi_breakage();
331 break;
332 }
333
334 tb[type] = attr;
335 return MNL_CB_OK;
336}
337
338EXPORT_SYMBOL(nftnl_obj_nlmsg_parse);
339int nftnl_obj_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_obj *obj)
340{
341 struct nfgenmsg *nfg = mnl_nlmsg_get_payload(nlh);
342 struct nlattr *tb[NFTA_OBJ_MAX + 1] = {};
343 int err;
344
345 if (mnl_attr_parse(nlh, sizeof(*nfg), nftnl_obj_parse_attr_cb, tb) < 0)
346 return -1;
347
348 if (nftnl_parse_str_attr(tb[NFTA_OBJ_TABLE], NFTNL_OBJ_TABLE,
349 &obj->table, &obj->flags) < 0)
350 return -1;
351 if (nftnl_parse_str_attr(tb[NFTA_OBJ_NAME], NFTNL_OBJ_NAME,
352 &obj->name, &obj->flags) < 0)
353 return -1;
354 if (tb[NFTA_OBJ_TYPE]) {
355 uint32_t type = ntohl(mnl_attr_get_u32(tb[NFTA_OBJ_TYPE]));
356
357 obj->ops = nftnl_obj_ops_lookup(type);
358 if (obj->ops)
359 obj->flags |= (1 << NFTNL_OBJ_TYPE);
360 }
361 if (tb[NFTA_OBJ_DATA]) {
362 if (obj->ops) {
363 err = obj->ops->parse(obj, tb[NFTA_OBJ_DATA]);
364 if (err < 0)
365 return err;
366 }
367 }
368 if (tb[NFTA_OBJ_USE]) {
369 obj->use = ntohl(mnl_attr_get_u32(tb[NFTA_OBJ_USE]));
370 obj->flags |= (1 << NFTNL_OBJ_USE);
371 }
372 if (tb[NFTA_OBJ_HANDLE]) {
373 obj->handle = be64toh(mnl_attr_get_u64(tb[NFTA_OBJ_HANDLE]));
374 obj->flags |= (1 << NFTNL_OBJ_HANDLE);
375 }
376 if (tb[NFTA_OBJ_USERDATA]) {
377 nftnl_obj_set_data(obj, NFTNL_OBJ_USERDATA,
378 mnl_attr_get_payload(tb[NFTA_OBJ_USERDATA]),
379 mnl_attr_get_payload_len(tb[NFTA_OBJ_USERDATA]));
380 }
381
382 obj->family = nfg->nfgen_family;
383 obj->flags |= (1 << NFTNL_OBJ_FAMILY);
384
385 return 0;
386}
387
388EXPORT_SYMBOL(nftnl_obj_parse);
389int nftnl_obj_parse(struct nftnl_obj *obj, enum nftnl_parse_type type,
390 const char *data, struct nftnl_parse_err *err)
391{
392 errno = EOPNOTSUPP;
393
394 return -1;
395}
396
397EXPORT_SYMBOL(nftnl_obj_parse_file);
398int nftnl_obj_parse_file(struct nftnl_obj *obj, enum nftnl_parse_type type,
399 FILE *fp, struct nftnl_parse_err *err)
400{
401 errno = EOPNOTSUPP;
402
403 return -1;
404}
405
406static int nftnl_obj_snprintf_dflt(char *buf, size_t remain,
407 const struct nftnl_obj *obj,
408 uint32_t type, uint32_t flags)
409{
410 const char *name = obj->ops ? obj->ops->name : "(unknown)";
411 int ret, offset = 0;
412
413 ret = snprintf(buf, remain, "table %s name %s use %u [ %s ",
414 obj->table, obj->name, obj->use, name);
415 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
416
417 if (obj->ops) {
418 ret = obj->ops->output(buf + offset, remain, flags, obj);
419 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
420 }
421 ret = snprintf(buf + offset, remain, "]");
422 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
423
424 return offset;
425}
426
427static int nftnl_obj_cmd_snprintf(char *buf, size_t remain,
428 const struct nftnl_obj *obj, uint32_t cmd,
429 uint32_t type, uint32_t flags)
430{
431 int ret, offset = 0;
432
433 if (type != NFTNL_OUTPUT_DEFAULT)
434 return -1;
435
436 ret = nftnl_obj_snprintf_dflt(buf + offset, remain, obj, type, flags);
437 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
438 return offset;
439}
440
441EXPORT_SYMBOL(nftnl_obj_snprintf);
442int nftnl_obj_snprintf(char *buf, size_t size, const struct nftnl_obj *obj,
443 uint32_t type, uint32_t flags)
444{
445 if (size)
446 buf[0] = '\0';
447
448 return nftnl_obj_cmd_snprintf(buf, size, obj, nftnl_flag2cmd(flags),
449 type, flags);
450}
451
452static int nftnl_obj_do_snprintf(char *buf, size_t size, const void *obj,
453 uint32_t cmd, uint32_t type, uint32_t flags)
454{
455 return nftnl_obj_snprintf(buf, size, obj, type, flags);
456}
457
458EXPORT_SYMBOL(nftnl_obj_fprintf);
459int nftnl_obj_fprintf(FILE *fp, const struct nftnl_obj *obj, uint32_t type,
460 uint32_t flags)
461{
462 return nftnl_fprintf(fp, obj, NFTNL_CMD_UNSPEC, type, flags,
463 nftnl_obj_do_snprintf);
464}
465
466struct nftnl_obj_list {
467 struct list_head list;
468};
469
470EXPORT_SYMBOL(nftnl_obj_list_alloc);
471struct nftnl_obj_list *nftnl_obj_list_alloc(void)
472{
473 struct nftnl_obj_list *list;
474
475 list = calloc(1, sizeof(struct nftnl_obj_list));
476 if (list == NULL)
477 return NULL;
478
479 INIT_LIST_HEAD(&list->list);
480
481 return list;
482}
483
484EXPORT_SYMBOL(nftnl_obj_list_free);
485void nftnl_obj_list_free(struct nftnl_obj_list *list)
486{
487 struct nftnl_obj *r, *tmp;
488
489 list_for_each_entry_safe(r, tmp, &list->list, head) {
490 list_del(&r->head);
491 nftnl_obj_free(r);
492 }
493 xfree(list);
494}
495
496EXPORT_SYMBOL(nftnl_obj_list_is_empty);
497int nftnl_obj_list_is_empty(struct nftnl_obj_list *list)
498{
499 return list_empty(&list->list);
500}
501
502EXPORT_SYMBOL(nftnl_obj_list_add);
503void nftnl_obj_list_add(struct nftnl_obj *r, struct nftnl_obj_list *list)
504{
505 list_add(&r->head, &list->list);
506}
507
508EXPORT_SYMBOL(nftnl_obj_list_add_tail);
509void nftnl_obj_list_add_tail(struct nftnl_obj *r,
510 struct nftnl_obj_list *list)
511{
512 list_add_tail(&r->head, &list->list);
513}
514
515EXPORT_SYMBOL(nftnl_obj_list_del);
516void nftnl_obj_list_del(struct nftnl_obj *t)
517{
518 list_del(&t->head);
519}
520
521EXPORT_SYMBOL(nftnl_obj_list_foreach);
522int nftnl_obj_list_foreach(struct nftnl_obj_list *table_list,
523 int (*cb)(struct nftnl_obj *t, void *data),
524 void *data)
525{
526 struct nftnl_obj *cur, *tmp;
527 int ret;
528
529 list_for_each_entry_safe(cur, tmp, &table_list->list, head) {
530 ret = cb(cur, data);
531 if (ret < 0)
532 return ret;
533 }
534 return 0;
535}
536
537struct nftnl_obj_list_iter {
538 struct nftnl_obj_list *list;
539 struct nftnl_obj *cur;
540};
541
542EXPORT_SYMBOL(nftnl_obj_list_iter_create);
543struct nftnl_obj_list_iter *
544nftnl_obj_list_iter_create(struct nftnl_obj_list *l)
545{
546 struct nftnl_obj_list_iter *iter;
547
548 iter = calloc(1, sizeof(struct nftnl_obj_list_iter));
549 if (iter == NULL)
550 return NULL;
551
552 iter->list = l;
553 if (nftnl_obj_list_is_empty(l))
554 iter->cur = NULL;
555 else
556 iter->cur = list_entry(l->list.next, struct nftnl_obj, head);
557
558 return iter;
559}
560
561EXPORT_SYMBOL(nftnl_obj_list_iter_next);
562struct nftnl_obj *nftnl_obj_list_iter_next(struct nftnl_obj_list_iter *iter)
563{
564 struct nftnl_obj *r = iter->cur;
565
566 if (r == NULL)
567 return NULL;
568
569 /* get next table, if any */
570 iter->cur = list_entry(iter->cur->head.next, struct nftnl_obj, head);
571 if (&iter->cur->head == iter->list->list.next)
572 return NULL;
573
574 return r;
575}
576
577EXPORT_SYMBOL(nftnl_obj_list_iter_destroy);
578void nftnl_obj_list_iter_destroy(struct nftnl_obj_list_iter *iter)
579{
580 xfree(iter);
581}
nftnl_obj_list_iter
Definition object.c:537
nftnl_obj_list
Definition object.c:466
Generated by doxygen 1.15.0