13#include <libmnl/libmnl.h>
14#include <linux/netfilter/nfnetlink.h>
15#include <linux/netfilter/nf_tables.h>
16#include <linux/netfilter.h>
17#include <linux/netfilter_arp.h>
19#include <libnftnl/flowtable.h>
22 struct list_head head;
29 const char **dev_array;
30 uint32_t dev_array_len;
37EXPORT_SYMBOL(nftnl_flowtable_alloc);
43EXPORT_SYMBOL(nftnl_flowtable_free);
48 if (c->flags & (1 << NFTNL_FLOWTABLE_NAME))
50 if (c->flags & (1 << NFTNL_FLOWTABLE_TABLE))
52 if (c->flags & (1 << NFTNL_FLOWTABLE_DEVICES)) {
53 for (i = 0; i < c->dev_array_len; i++)
54 xfree(c->dev_array[i]);
61EXPORT_SYMBOL(nftnl_flowtable_is_set);
62bool nftnl_flowtable_is_set(
const struct nftnl_flowtable *c, uint16_t attr)
64 return c->flags & (1 << attr);
67EXPORT_SYMBOL(nftnl_flowtable_unset);
72 if (!(c->flags & (1 << attr)))
76 case NFTNL_FLOWTABLE_NAME:
79 case NFTNL_FLOWTABLE_TABLE:
82 case NFTNL_FLOWTABLE_HOOKNUM:
83 case NFTNL_FLOWTABLE_PRIO:
84 case NFTNL_FLOWTABLE_USE:
85 case NFTNL_FLOWTABLE_FAMILY:
86 case NFTNL_FLOWTABLE_FLAGS:
87 case NFTNL_FLOWTABLE_HANDLE:
89 case NFTNL_FLOWTABLE_DEVICES:
90 for (i = 0; i < c->dev_array_len; i++)
91 xfree(c->dev_array[i]);
98 c->flags &= ~(1 << attr);
101static uint32_t nftnl_flowtable_validate[NFTNL_FLOWTABLE_MAX + 1] = {
102 [NFTNL_FLOWTABLE_HOOKNUM] =
sizeof(uint32_t),
103 [NFTNL_FLOWTABLE_PRIO] =
sizeof(int32_t),
104 [NFTNL_FLOWTABLE_FAMILY] =
sizeof(uint32_t),
105 [NFTNL_FLOWTABLE_FLAGS] =
sizeof(uint32_t),
106 [NFTNL_FLOWTABLE_HANDLE] =
sizeof(uint64_t),
109EXPORT_SYMBOL(nftnl_flowtable_set_data);
111 const void *data, uint32_t data_len)
113 const char **dev_array;
116 nftnl_assert_attr_exists(attr, NFTNL_FLOWTABLE_MAX);
117 nftnl_assert_validate(data, nftnl_flowtable_validate, attr, data_len);
120 case NFTNL_FLOWTABLE_NAME:
121 if (c->flags & (1 << NFTNL_FLOWTABLE_NAME))
124 c->name = strdup(data);
128 case NFTNL_FLOWTABLE_TABLE:
129 if (c->flags & (1 << NFTNL_FLOWTABLE_TABLE))
132 c->table = strdup(data);
136 case NFTNL_FLOWTABLE_HOOKNUM:
137 memcpy(&c->hooknum, data,
sizeof(c->hooknum));
139 case NFTNL_FLOWTABLE_PRIO:
140 memcpy(&c->prio, data,
sizeof(c->prio));
142 case NFTNL_FLOWTABLE_FAMILY:
143 memcpy(&c->family, data,
sizeof(c->family));
145 case NFTNL_FLOWTABLE_DEVICES:
146 dev_array = (
const char **)data;
147 while (dev_array[len] != NULL)
150 if (c->flags & (1 << NFTNL_FLOWTABLE_DEVICES)) {
151 for (i = 0; i < c->dev_array_len; i++)
152 xfree(c->dev_array[i]);
156 c->dev_array = calloc(len + 1,
sizeof(
char *));
160 for (i = 0; i < len; i++)
161 c->dev_array[i] = strdup(dev_array[i]);
163 c->dev_array_len = len;
165 case NFTNL_FLOWTABLE_SIZE:
166 memcpy(&c->size, data,
sizeof(c->size));
168 case NFTNL_FLOWTABLE_FLAGS:
169 memcpy(&c->ft_flags, data,
sizeof(c->ft_flags));
171 case NFTNL_FLOWTABLE_HANDLE:
172 memcpy(&c->handle, data,
sizeof(c->handle));
175 c->flags |= (1 << attr);
179void nftnl_flowtable_set(
struct nftnl_flowtable *c, uint16_t attr,
const void *data) __visible;
180void nftnl_flowtable_set(
struct nftnl_flowtable *c, uint16_t attr,
const void *data)
182 nftnl_flowtable_set_data(c, attr, data, nftnl_flowtable_validate[attr]);
185EXPORT_SYMBOL(nftnl_flowtable_set_u32);
186void nftnl_flowtable_set_u32(
struct nftnl_flowtable *c, uint16_t attr, uint32_t data)
188 nftnl_flowtable_set_data(c, attr, &data,
sizeof(uint32_t));
191EXPORT_SYMBOL(nftnl_flowtable_set_s32);
192void nftnl_flowtable_set_s32(
struct nftnl_flowtable *c, uint16_t attr, int32_t data)
194 nftnl_flowtable_set_data(c, attr, &data,
sizeof(int32_t));
197EXPORT_SYMBOL(nftnl_flowtable_set_str);
198int nftnl_flowtable_set_str(
struct nftnl_flowtable *c, uint16_t attr,
const char *str)
200 return nftnl_flowtable_set_data(c, attr, str, strlen(str) + 1);
203EXPORT_SYMBOL(nftnl_flowtable_set_u64);
204void nftnl_flowtable_set_u64(
struct nftnl_flowtable *c, uint16_t attr, uint64_t data)
206 nftnl_flowtable_set_data(c, attr, &data,
sizeof(uint64_t));
209EXPORT_SYMBOL(nftnl_flowtable_set_array);
213 return nftnl_flowtable_set_data(c, attr, data, 0);
216EXPORT_SYMBOL(nftnl_flowtable_get_data);
218 uint16_t attr, uint32_t *data_len)
220 if (!(c->flags & (1 << attr)))
224 case NFTNL_FLOWTABLE_NAME:
225 *data_len = strlen(c->name) + 1;
227 case NFTNL_FLOWTABLE_TABLE:
228 *data_len = strlen(c->table) + 1;
230 case NFTNL_FLOWTABLE_HOOKNUM:
231 *data_len =
sizeof(uint32_t);
233 case NFTNL_FLOWTABLE_PRIO:
234 *data_len =
sizeof(int32_t);
236 case NFTNL_FLOWTABLE_FAMILY:
237 *data_len =
sizeof(int32_t);
239 case NFTNL_FLOWTABLE_DEVICES:
241 return &c->dev_array[0];
242 case NFTNL_FLOWTABLE_SIZE:
243 *data_len =
sizeof(int32_t);
245 case NFTNL_FLOWTABLE_FLAGS:
246 *data_len =
sizeof(int32_t);
248 case NFTNL_FLOWTABLE_HANDLE:
249 *data_len =
sizeof(uint64_t);
255EXPORT_SYMBOL(nftnl_flowtable_get);
256const void *nftnl_flowtable_get(
const struct nftnl_flowtable *c, uint16_t attr)
259 return nftnl_flowtable_get_data(c, attr, &data_len);
262EXPORT_SYMBOL(nftnl_flowtable_get_str);
263const char *nftnl_flowtable_get_str(
const struct nftnl_flowtable *c, uint16_t attr)
265 return nftnl_flowtable_get(c, attr);
268EXPORT_SYMBOL(nftnl_flowtable_get_u32);
269uint32_t nftnl_flowtable_get_u32(
const struct nftnl_flowtable *c, uint16_t attr)
271 uint32_t data_len = 0;
272 const uint32_t *val = nftnl_flowtable_get_data(c, attr, &data_len);
274 nftnl_assert(val, attr, data_len ==
sizeof(uint32_t));
276 return val ? *val : 0;
279EXPORT_SYMBOL(nftnl_flowtable_get_u64);
280uint64_t nftnl_flowtable_get_u64(
const struct nftnl_flowtable *c, uint16_t attr)
282 uint32_t data_len = 0;
283 const uint64_t *val = nftnl_flowtable_get_data(c, attr, &data_len);
285 nftnl_assert(val, attr, data_len ==
sizeof(uint64_t));
287 return val ? *val : 0;
290EXPORT_SYMBOL(nftnl_flowtable_get_s32);
291int32_t nftnl_flowtable_get_s32(
const struct nftnl_flowtable *c, uint16_t attr)
293 uint32_t data_len = 0;
294 const int32_t *val = nftnl_flowtable_get_data(c, attr, &data_len);
296 nftnl_assert(val, attr, data_len ==
sizeof(int32_t));
298 return val ? *val : 0;
301EXPORT_SYMBOL(nftnl_flowtable_get_array);
302const char *
const *nftnl_flowtable_get_array(
const struct nftnl_flowtable *c, uint16_t attr)
305 const char *
const *val = nftnl_flowtable_get_data(c, attr, &data_len);
307 nftnl_assert(val, attr, attr == NFTNL_FLOWTABLE_DEVICES);
312EXPORT_SYMBOL(nftnl_flowtable_nlmsg_build_payload);
313void nftnl_flowtable_nlmsg_build_payload(
struct nlmsghdr *nlh,
316 struct nlattr *nest = NULL;
319 if (c->flags & (1 << NFTNL_FLOWTABLE_TABLE))
320 mnl_attr_put_strz(nlh, NFTA_FLOWTABLE_TABLE, c->table);
321 if (c->flags & (1 << NFTNL_FLOWTABLE_NAME))
322 mnl_attr_put_strz(nlh, NFTA_FLOWTABLE_NAME, c->name);
324 if (c->flags & (1 << NFTNL_FLOWTABLE_HOOKNUM) ||
325 c->flags & (1 << NFTNL_FLOWTABLE_PRIO) ||
326 c->flags & (1 << NFTNL_FLOWTABLE_DEVICES))
327 nest = mnl_attr_nest_start(nlh, NFTA_FLOWTABLE_HOOK);
329 if (c->flags & (1 << NFTNL_FLOWTABLE_HOOKNUM))
330 mnl_attr_put_u32(nlh, NFTA_FLOWTABLE_HOOK_NUM, htonl(c->hooknum));
331 if (c->flags & (1 << NFTNL_FLOWTABLE_PRIO))
332 mnl_attr_put_u32(nlh, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(c->prio));
334 if (c->flags & (1 << NFTNL_FLOWTABLE_DEVICES)) {
335 struct nlattr *nest_dev;
337 nest_dev = mnl_attr_nest_start(nlh, NFTA_FLOWTABLE_HOOK_DEVS);
338 for (i = 0; i < c->dev_array_len; i++) {
339 mnl_attr_put_strz(nlh, NFTA_DEVICE_NAME,
342 mnl_attr_nest_end(nlh, nest_dev);
346 mnl_attr_nest_end(nlh, nest);
348 if (c->flags & (1 << NFTNL_FLOWTABLE_FLAGS))
349 mnl_attr_put_u32(nlh, NFTA_FLOWTABLE_FLAGS, htonl(c->ft_flags));
350 if (c->flags & (1 << NFTNL_FLOWTABLE_USE))
351 mnl_attr_put_u32(nlh, NFTA_FLOWTABLE_USE, htonl(c->use));
352 if (c->flags & (1 << NFTNL_FLOWTABLE_HANDLE))
353 mnl_attr_put_u64(nlh, NFTA_FLOWTABLE_HANDLE, htobe64(c->handle));
356static int nftnl_flowtable_parse_attr_cb(
const struct nlattr *attr,
void *data)
358 const struct nlattr **tb = data;
359 int type = mnl_attr_get_type(attr);
361 if (mnl_attr_type_valid(attr, NFTA_FLOWTABLE_MAX) < 0)
365 case NFTA_FLOWTABLE_NAME:
366 case NFTA_FLOWTABLE_TABLE:
367 if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
370 case NFTA_FLOWTABLE_HOOK:
371 if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
374 case NFTA_FLOWTABLE_FLAGS:
375 case NFTA_FLOWTABLE_USE:
376 if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
379 case NFTA_FLOWTABLE_HANDLE:
380 if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
389static int nftnl_flowtable_parse_hook_cb(
const struct nlattr *attr,
void *data)
391 const struct nlattr **tb = data;
392 int type = mnl_attr_get_type(attr);
394 if (mnl_attr_type_valid(attr, NFTA_FLOWTABLE_HOOK_MAX) < 0)
398 case NFTA_FLOWTABLE_HOOK_NUM:
399 case NFTA_FLOWTABLE_HOOK_PRIORITY:
400 if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
403 case NFTA_FLOWTABLE_HOOK_DEVS:
404 if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
413static int nftnl_flowtable_parse_devs(
struct nlattr *nest,
416 const char **dev_array, **tmp;
417 int len = 0, size = 8;
420 dev_array = calloc(8,
sizeof(
char *));
424 mnl_attr_for_each_nested(attr, nest) {
425 if (mnl_attr_get_type(attr) != NFTA_DEVICE_NAME)
427 dev_array[len++] = strdup(mnl_attr_get_str(attr));
429 tmp = realloc(dev_array, size * 2 *
sizeof(
char *));
434 memset(&tmp[len], 0, (size - len) *
sizeof(
char *));
439 c->dev_array = dev_array;
440 c->dev_array_len = len;
445 xfree(dev_array[len]);
450static int nftnl_flowtable_parse_hook(
struct nlattr *attr,
struct nftnl_flowtable *c)
452 struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1] = {};
455 if (mnl_attr_parse_nested(attr, nftnl_flowtable_parse_hook_cb, tb) < 0)
458 if (tb[NFTA_FLOWTABLE_HOOK_NUM]) {
459 c->hooknum = ntohl(mnl_attr_get_u32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
460 c->flags |= (1 << NFTNL_FLOWTABLE_HOOKNUM);
462 if (tb[NFTA_FLOWTABLE_HOOK_PRIORITY]) {
463 c->prio = ntohl(mnl_attr_get_u32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
464 c->flags |= (1 << NFTNL_FLOWTABLE_PRIO);
466 if (tb[NFTA_FLOWTABLE_HOOK_DEVS]) {
467 ret = nftnl_flowtable_parse_devs(tb[NFTA_FLOWTABLE_HOOK_DEVS], c);
470 c->flags |= (1 << NFTNL_FLOWTABLE_DEVICES);
476EXPORT_SYMBOL(nftnl_flowtable_nlmsg_parse);
477int nftnl_flowtable_nlmsg_parse(
const struct nlmsghdr *nlh,
struct nftnl_flowtable *c)
479 struct nlattr *tb[NFTA_FLOWTABLE_MAX + 1] = {};
480 struct nfgenmsg *nfg = mnl_nlmsg_get_payload(nlh);
483 if (mnl_attr_parse(nlh,
sizeof(*nfg), nftnl_flowtable_parse_attr_cb, tb) < 0)
486 if (tb[NFTA_FLOWTABLE_NAME]) {
487 if (c->flags & (1 << NFTNL_FLOWTABLE_NAME))
489 c->name = strdup(mnl_attr_get_str(tb[NFTA_FLOWTABLE_NAME]));
492 c->flags |= (1 << NFTNL_FLOWTABLE_NAME);
494 if (tb[NFTA_FLOWTABLE_TABLE]) {
495 if (c->flags & (1 << NFTNL_FLOWTABLE_TABLE))
497 c->table = strdup(mnl_attr_get_str(tb[NFTA_FLOWTABLE_TABLE]));
500 c->flags |= (1 << NFTNL_FLOWTABLE_TABLE);
502 if (tb[NFTA_FLOWTABLE_HOOK]) {
503 ret = nftnl_flowtable_parse_hook(tb[NFTA_FLOWTABLE_HOOK], c);
507 if (tb[NFTA_FLOWTABLE_FLAGS]) {
508 c->ft_flags = ntohl(mnl_attr_get_u32(tb[NFTA_FLOWTABLE_FLAGS]));
509 c->flags |= (1 << NFTNL_FLOWTABLE_FLAGS);
511 if (tb[NFTA_FLOWTABLE_USE]) {
512 c->use = ntohl(mnl_attr_get_u32(tb[NFTA_FLOWTABLE_USE]));
513 c->flags |= (1 << NFTNL_FLOWTABLE_USE);
515 if (tb[NFTA_FLOWTABLE_HANDLE]) {
516 c->handle = be64toh(mnl_attr_get_u64(tb[NFTA_FLOWTABLE_HANDLE]));
517 c->flags |= (1 << NFTNL_FLOWTABLE_HANDLE);
520 c->family = nfg->nfgen_family;
521 c->flags |= (1 << NFTNL_FLOWTABLE_FAMILY);
526static const char *nftnl_hooknum2str(
int family,
int hooknum)
534 case NF_INET_PRE_ROUTING:
536 case NF_INET_LOCAL_IN:
538 case NF_INET_FORWARD:
540 case NF_INET_LOCAL_OUT:
542 case NF_INET_POST_ROUTING:
543 return "postrouting";
558 case NF_NETDEV_INGRESS:
566static inline int nftnl_str2hooknum(
int family,
const char *hook)
570 for (hooknum = 0; hooknum < NF_INET_NUMHOOKS; hooknum++) {
571 if (strcmp(hook, nftnl_hooknum2str(family, hooknum)) == 0)
577EXPORT_SYMBOL(nftnl_flowtable_parse);
578int nftnl_flowtable_parse(
struct nftnl_flowtable *c,
enum nftnl_parse_type type,
579 const char *data,
struct nftnl_parse_err *err)
585EXPORT_SYMBOL(nftnl_flowtable_parse_file);
587 enum nftnl_parse_type type,
588 FILE *fp,
struct nftnl_parse_err *err)
594static int nftnl_flowtable_snprintf_default(
char *buf,
size_t remain,
597 int ret, offset = 0, i;
599 ret = snprintf(buf, remain,
"flow table %s %s use %u size %u flags %x",
600 c->table, c->name, c->use, c->size, c->ft_flags);
601 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
603 if (c->flags & (1 << NFTNL_FLOWTABLE_HOOKNUM)) {
604 ret = snprintf(buf + offset, remain,
" hook %s prio %d ",
605 nftnl_hooknum2str(c->family, c->hooknum),
607 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
609 if (c->flags & (1 << NFTNL_FLOWTABLE_DEVICES)) {
610 ret = snprintf(buf + offset, remain,
" dev { ");
611 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
613 for (i = 0; i < c->dev_array_len; i++) {
614 ret = snprintf(buf + offset, remain,
" %s ",
616 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
618 ret = snprintf(buf + offset, remain,
" } ");
619 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
626static int nftnl_flowtable_cmd_snprintf(
char *buf,
size_t remain,
628 uint32_t cmd, uint32_t type,
633 if (type != NFTNL_OUTPUT_DEFAULT)
636 ret = nftnl_flowtable_snprintf_default(buf + offset, remain, c);
637 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
641EXPORT_SYMBOL(nftnl_flowtable_snprintf);
642int nftnl_flowtable_snprintf(
char *buf,
size_t size,
const struct nftnl_flowtable *c,
643 uint32_t type, uint32_t flags)
648 return nftnl_flowtable_cmd_snprintf(buf, size, c, nftnl_flag2cmd(flags),
652static int nftnl_flowtable_do_snprintf(
char *buf,
size_t size,
const void *c,
653 uint32_t cmd, uint32_t type, uint32_t flags)
655 return nftnl_flowtable_snprintf(buf, size, c, type, flags);
658EXPORT_SYMBOL(nftnl_flowtable_fprintf);
660 uint32_t type, uint32_t flags)
662 return nftnl_fprintf(fp, c, NFTNL_CMD_UNSPEC, type, flags,
663 nftnl_flowtable_do_snprintf);
667 struct list_head list;
670EXPORT_SYMBOL(nftnl_flowtable_list_alloc);
679 INIT_LIST_HEAD(&list->list);
684EXPORT_SYMBOL(nftnl_flowtable_list_free);
689 list_for_each_entry_safe(s, tmp, &list->list, head) {
691 nftnl_flowtable_free(s);
696EXPORT_SYMBOL(nftnl_flowtable_list_is_empty);
699 return list_empty(&list->list);
702EXPORT_SYMBOL(nftnl_flowtable_list_add);
706 list_add(&s->head, &list->list);
709EXPORT_SYMBOL(nftnl_flowtable_list_add_tail);
713 list_add_tail(&s->head, &list->list);
716EXPORT_SYMBOL(nftnl_flowtable_list_del);
722EXPORT_SYMBOL(nftnl_flowtable_list_foreach);
729 list_for_each_entry_safe(cur, tmp, &flowtable_list->list, head) {