17#include <libmnl/libmnl.h>
18#include <linux/netfilter/nf_tables.h>
19#include <libnftnl/rule.h>
20#include <libnftnl/expr.h>
25 enum nft_registers sreg_key;
26 enum nft_registers sreg_data;
27 enum nft_dynset_ops op;
29 struct list_head expr_list;
32 uint32_t dynset_flags;
36nftnl_expr_dynset_set(
struct nftnl_expr *e, uint16_t type,
37 const void *data, uint32_t data_len)
40 struct nftnl_expr *expr, *next;
43 case NFTNL_EXPR_DYNSET_SREG_KEY:
44 memcpy(&dynset->sreg_key, data,
sizeof(dynset->sreg_key));
46 case NFTNL_EXPR_DYNSET_SREG_DATA:
47 memcpy(&dynset->sreg_data, data,
sizeof(dynset->sreg_data));
49 case NFTNL_EXPR_DYNSET_OP:
50 memcpy(&dynset->op, data,
sizeof(dynset->op));
52 case NFTNL_EXPR_DYNSET_TIMEOUT:
53 memcpy(&dynset->timeout, data,
sizeof(dynset->timeout));
55 case NFTNL_EXPR_DYNSET_SET_NAME:
56 dynset->set_name = strdup((
const char *)data);
57 if (!dynset->set_name)
60 case NFTNL_EXPR_DYNSET_SET_ID:
61 memcpy(&dynset->set_id, data,
sizeof(dynset->set_id));
63 case NFTNL_EXPR_DYNSET_EXPR:
64 list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
65 nftnl_expr_free(expr);
68 list_add(&expr->head, &dynset->expr_list);
70 case NFTNL_EXPR_DYNSET_FLAGS:
71 memcpy(&dynset->dynset_flags, data,
sizeof(dynset->dynset_flags));
80nftnl_expr_dynset_get(
const struct nftnl_expr *e, uint16_t type,
84 struct nftnl_expr *expr;
87 case NFTNL_EXPR_DYNSET_SREG_KEY:
88 *data_len =
sizeof(dynset->sreg_key);
89 return &dynset->sreg_key;
90 case NFTNL_EXPR_DYNSET_SREG_DATA:
91 *data_len =
sizeof(dynset->sreg_data);
92 return &dynset->sreg_data;
93 case NFTNL_EXPR_DYNSET_OP:
94 *data_len =
sizeof(dynset->op);
96 case NFTNL_EXPR_DYNSET_TIMEOUT:
97 *data_len =
sizeof(dynset->timeout);
98 return &dynset->timeout;
99 case NFTNL_EXPR_DYNSET_SET_NAME:
100 *data_len = strlen(dynset->set_name) + 1;
101 return dynset->set_name;
102 case NFTNL_EXPR_DYNSET_SET_ID:
103 *data_len =
sizeof(dynset->set_id);
104 return &dynset->set_id;
105 case NFTNL_EXPR_DYNSET_EXPR:
106 list_for_each_entry(expr, &dynset->expr_list, head)
109 case NFTNL_EXPR_DYNSET_FLAGS:
110 *data_len =
sizeof(dynset->dynset_flags);
111 return &dynset->dynset_flags;
116static int nftnl_expr_dynset_cb(
const struct nlattr *attr,
void *data)
118 const struct nlattr **tb = data;
119 int type = mnl_attr_get_type(attr);
121 if (mnl_attr_type_valid(attr, NFTA_SET_MAX) < 0)
125 case NFTA_DYNSET_SREG_KEY:
126 case NFTA_DYNSET_SREG_DATA:
127 case NFTA_DYNSET_SET_ID:
129 case NFTA_DYNSET_FLAGS:
130 if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
133 case NFTA_DYNSET_TIMEOUT:
134 if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
137 case NFTA_DYNSET_SET_NAME:
138 if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
141 case NFTA_DYNSET_EXPR:
142 if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
152nftnl_expr_dynset_build(
struct nlmsghdr *nlh,
const struct nftnl_expr *e)
158 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_KEY))
159 mnl_attr_put_u32(nlh, NFTA_DYNSET_SREG_KEY, htonl(dynset->sreg_key));
160 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_DATA))
161 mnl_attr_put_u32(nlh, NFTA_DYNSET_SREG_DATA, htonl(dynset->sreg_data));
162 if (e->flags & (1 << NFTNL_EXPR_DYNSET_OP))
163 mnl_attr_put_u32(nlh, NFTA_DYNSET_OP, htonl(dynset->op));
164 if (e->flags & (1 << NFTNL_EXPR_DYNSET_TIMEOUT))
165 mnl_attr_put_u64(nlh, NFTA_DYNSET_TIMEOUT, htobe64(dynset->timeout));
166 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SET_NAME))
167 mnl_attr_put_strz(nlh, NFTA_DYNSET_SET_NAME, dynset->set_name);
168 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SET_ID))
169 mnl_attr_put_u32(nlh, NFTA_DYNSET_SET_ID, htonl(dynset->set_id));
170 if (!list_empty(&dynset->expr_list)) {
171 struct nftnl_expr *expr;
173 list_for_each_entry(expr, &dynset->expr_list, head)
176 if (num_exprs == 1) {
177 nest = mnl_attr_nest_start(nlh, NFTA_DYNSET_EXPR);
178 list_for_each_entry(expr, &dynset->expr_list, head)
179 nftnl_expr_build_payload(nlh, expr);
180 mnl_attr_nest_end(nlh, nest);
181 }
else if (num_exprs > 1) {
182 struct nlattr *nest1, *nest2;
184 nest1 = mnl_attr_nest_start(nlh, NFTA_DYNSET_EXPRESSIONS);
185 list_for_each_entry(expr, &dynset->expr_list, head) {
186 nest2 = mnl_attr_nest_start(nlh, NFTA_LIST_ELEM);
187 nftnl_expr_build_payload(nlh, expr);
188 mnl_attr_nest_end(nlh, nest2);
190 mnl_attr_nest_end(nlh, nest1);
193 if (e->flags & (1 << NFTNL_EXPR_DYNSET_FLAGS))
194 mnl_attr_put_u32(nlh, NFTA_DYNSET_FLAGS,
195 htonl(dynset->dynset_flags));
198EXPORT_SYMBOL(nftnl_expr_add_expr);
199void nftnl_expr_add_expr(
struct nftnl_expr *e, uint32_t type,
200 struct nftnl_expr *expr)
204 list_add_tail(&expr->head, &dynset->expr_list);
207EXPORT_SYMBOL(nftnl_expr_expr_foreach);
208int nftnl_expr_expr_foreach(
const struct nftnl_expr *e,
209 int (*cb)(
struct nftnl_expr *e,
void *data),
213 struct nftnl_expr *cur, *tmp;
216 list_for_each_entry_safe(cur, tmp, &dynset->expr_list, head) {
225nftnl_expr_dynset_parse(
struct nftnl_expr *e,
struct nlattr *attr)
228 struct nlattr *tb[NFTA_SET_MAX+1] = {};
229 struct nftnl_expr *expr, *next;
232 if (mnl_attr_parse_nested(attr, nftnl_expr_dynset_cb, tb) < 0)
235 if (tb[NFTA_DYNSET_SREG_KEY]) {
236 dynset->sreg_key = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SREG_KEY]));
237 e->flags |= (1 << NFTNL_EXPR_DYNSET_SREG_KEY);
239 if (tb[NFTA_DYNSET_SREG_DATA]) {
240 dynset->sreg_data = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SREG_DATA]));
241 e->flags |= (1 << NFTNL_EXPR_DYNSET_SREG_DATA);
243 if (tb[NFTA_DYNSET_OP]) {
244 dynset->op = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_OP]));
245 e->flags |= (1 << NFTNL_EXPR_DYNSET_OP);
247 if (tb[NFTA_DYNSET_TIMEOUT]) {
248 dynset->timeout = be64toh(mnl_attr_get_u64(tb[NFTA_DYNSET_TIMEOUT]));
249 e->flags |= (1 << NFTNL_EXPR_DYNSET_TIMEOUT);
251 if (tb[NFTA_DYNSET_SET_NAME]) {
253 strdup(mnl_attr_get_str(tb[NFTA_DYNSET_SET_NAME]));
254 if (!dynset->set_name)
256 e->flags |= (1 << NFTNL_EXPR_DYNSET_SET_NAME);
258 if (tb[NFTA_DYNSET_SET_ID]) {
259 dynset->set_id = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SET_ID]));
260 e->flags |= (1 << NFTNL_EXPR_DYNSET_SET_ID);
262 if (tb[NFTA_DYNSET_EXPR]) {
263 expr = nftnl_expr_parse(tb[NFTA_DYNSET_EXPR]);
267 list_add(&expr->head, &dynset->expr_list);
268 e->flags |= (1 << NFTNL_EXPR_DYNSET_EXPR);
269 }
else if (tb[NFTA_DYNSET_EXPRESSIONS]) {
270 struct nlattr *attr2;
272 mnl_attr_for_each_nested(attr2, tb[NFTA_DYNSET_EXPRESSIONS]) {
273 if (mnl_attr_get_type(attr2) != NFTA_LIST_ELEM)
274 goto out_dynset_expr;
276 expr = nftnl_expr_parse(attr2);
278 goto out_dynset_expr;
280 list_add_tail(&expr->head, &dynset->expr_list);
282 e->flags |= (1 << NFTNL_EXPR_DYNSET_EXPRESSIONS);
284 if (tb[NFTA_DYNSET_FLAGS]) {
285 dynset->dynset_flags = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_FLAGS]));
286 e->flags |= (1 << NFTNL_EXPR_DYNSET_FLAGS);
291 list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
292 nftnl_expr_free(expr);
297static const char *op2str_array[] = {
298 [NFT_DYNSET_OP_ADD] =
"add",
299 [NFT_DYNSET_OP_UPDATE] =
"update",
300 [NFT_DYNSET_OP_DELETE] =
"delete",
303static const char *op2str(
enum nft_dynset_ops op)
305 if (op > NFT_DYNSET_OP_DELETE)
307 return op2str_array[op];
311nftnl_expr_dynset_snprintf(
char *buf,
size_t remain,
312 uint32_t flags,
const struct nftnl_expr *e)
315 struct nftnl_expr *expr;
318 ret = snprintf(buf, remain,
"%s reg_key %u set %s ",
319 op2str(dynset->op), dynset->sreg_key, dynset->set_name);
320 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
322 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_DATA)) {
323 ret = snprintf(buf + offset, remain,
"sreg_data %u ",
325 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
327 if (e->flags & (1 << NFTNL_EXPR_DYNSET_TIMEOUT)) {
328 ret = snprintf(buf + offset, remain,
"timeout %"PRIu64
"ms ",
330 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
332 list_for_each_entry(expr, &dynset->expr_list, head) {
333 ret = snprintf(buf + offset, remain,
"expr [ %s ",
335 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
337 ret = nftnl_expr_snprintf(buf + offset, remain, expr,
338 NFTNL_OUTPUT_DEFAULT,
340 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
342 ret = snprintf(buf + offset, remain,
"] ");
343 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
349static void nftnl_expr_dynset_init(
const struct nftnl_expr *e)
353 INIT_LIST_HEAD(&dynset->expr_list);
356static void nftnl_expr_dynset_free(
const struct nftnl_expr *e)
359 struct nftnl_expr *expr, *next;
361 xfree(dynset->set_name);
362 list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
363 nftnl_expr_free(expr);
366struct expr_ops expr_ops_dynset = {
369 .max_attr = NFTA_DYNSET_MAX,
370 .init = nftnl_expr_dynset_init,
371 .free = nftnl_expr_dynset_free,
372 .set = nftnl_expr_dynset_set,
373 .get = nftnl_expr_dynset_get,
374 .parse = nftnl_expr_dynset_parse,
375 .build = nftnl_expr_dynset_build,
376 .output = nftnl_expr_dynset_snprintf,