libnftnl 1.2.6
data_reg.c
1/*
2 * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published
6 * by the Free Software Foundation; either version 2 of the License, or
7 * (at your option) any later version.
8 *
9 * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
10 */
11
12#include <stdio.h>
13#include <stdint.h>
14#include <string.h>
15#include <limits.h>
16#include <arpa/inet.h>
17#include <errno.h>
18#include <netinet/in.h>
19
20#include <libmnl/libmnl.h>
21#include <linux/netfilter.h>
22#include <linux/netfilter/nf_tables.h>
23#include <libnftnl/expr.h>
24#include <libnftnl/rule.h>
25#include "internal.h"
26
27static int
28nftnl_data_reg_value_snprintf_default(char *buf, size_t remain,
29 const union nftnl_data_reg *reg,
30 uint32_t flags)
31{
32 const char *pfx = flags & DATA_F_NOPFX ? "" : "0x";
33 int offset = 0, ret, i;
34
35
36
37 for (i = 0; i < div_round_up(reg->len, sizeof(uint32_t)); i++) {
38 ret = snprintf(buf + offset, remain,
39 "%s%.8x ", pfx, reg->val[i]);
40 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
41 }
42
43 return offset;
44}
45
46static int
47nftnl_data_reg_verdict_snprintf_def(char *buf, size_t size,
48 const union nftnl_data_reg *reg,
49 uint32_t flags)
50{
51 int remain = size, offset = 0, ret = 0;
52
53 ret = snprintf(buf, size, "%s ", nftnl_verdict2str(reg->verdict));
54 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
55
56 if (reg->chain != NULL) {
57 ret = snprintf(buf + offset, remain, "-> %s ", reg->chain);
58 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
59 }
60
61 return offset;
62}
63
64int nftnl_data_reg_snprintf(char *buf, size_t size,
65 const union nftnl_data_reg *reg,
66 uint32_t flags, int reg_type)
67{
68 switch(reg_type) {
69 case DATA_VALUE:
70 return nftnl_data_reg_value_snprintf_default(buf, size,
71 reg, flags);
72 case DATA_VERDICT:
73 case DATA_CHAIN:
74 return nftnl_data_reg_verdict_snprintf_def(buf, size,
75 reg, flags);
76 default:
77 return -1;
78 }
79}
80
81static int nftnl_data_parse_cb(const struct nlattr *attr, void *data)
82{
83 const struct nlattr **tb = data;
84 int type = mnl_attr_get_type(attr);
85
86 if (mnl_attr_type_valid(attr, NFTA_DATA_MAX) < 0)
87 return MNL_CB_OK;
88
89 switch(type) {
90 case NFTA_DATA_VALUE:
91 if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0)
92 abi_breakage();
93 break;
94 case NFTA_DATA_VERDICT:
95 if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
96 abi_breakage();
97 break;
98 }
99 tb[type] = attr;
100 return MNL_CB_OK;
101}
102
103static int nftnl_verdict_parse_cb(const struct nlattr *attr, void *data)
104{
105 const struct nlattr **tb = data;
106 int type = mnl_attr_get_type(attr);
107
108 if (mnl_attr_type_valid(attr, NFTA_VERDICT_MAX) < 0)
109 return MNL_CB_OK;
110
111 switch(type) {
112 case NFTA_VERDICT_CODE:
113 case NFTA_VERDICT_CHAIN_ID:
114 if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
115 abi_breakage();
116 break;
117 case NFTA_VERDICT_CHAIN:
118 if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
119 abi_breakage();
120 break;
121 }
122 tb[type] = attr;
123 return MNL_CB_OK;
124}
125
126static int
127nftnl_parse_verdict(union nftnl_data_reg *data, const struct nlattr *attr, int *type)
128{
129 struct nlattr *tb[NFTA_VERDICT_MAX+1];
130
131 if (mnl_attr_parse_nested(attr, nftnl_verdict_parse_cb, tb) < 0)
132 return -1;
133
134 if (!tb[NFTA_VERDICT_CODE])
135 return -1;
136
137 data->verdict = ntohl(mnl_attr_get_u32(tb[NFTA_VERDICT_CODE]));
138
139 switch(data->verdict) {
140 case NF_ACCEPT:
141 case NF_DROP:
142 case NF_QUEUE:
143 case NFT_CONTINUE:
144 case NFT_BREAK:
145 case NFT_RETURN:
146 if (type)
147 *type = DATA_VERDICT;
148 data->len = sizeof(data->verdict);
149 break;
150 case NFT_JUMP:
151 case NFT_GOTO:
152 if (!tb[NFTA_VERDICT_CHAIN])
153 return -1;
154
155 data->chain = strdup(mnl_attr_get_str(tb[NFTA_VERDICT_CHAIN]));
156 if (!data->chain)
157 return -1;
158
159 if (type)
160 *type = DATA_CHAIN;
161 break;
162 default:
163 return -1;
164 }
165
166 return 0;
167}
168
169static int
170__nftnl_parse_data(union nftnl_data_reg *data, const struct nlattr *attr)
171{
172 void *orig = mnl_attr_get_payload(attr);
173 uint32_t data_len = mnl_attr_get_payload_len(attr);
174
175 if (data_len == 0)
176 return -1;
177
178 if (data_len > sizeof(data->val))
179 return -1;
180
181 memcpy(data->val, orig, data_len);
182 data->len = data_len;
183
184 return 0;
185}
186
187int nftnl_parse_data(union nftnl_data_reg *data, struct nlattr *attr, int *type)
188{
189 struct nlattr *tb[NFTA_DATA_MAX+1] = {};
190 int ret = 0;
191
192 if (mnl_attr_parse_nested(attr, nftnl_data_parse_cb, tb) < 0)
193 return -1;
194
195 if (tb[NFTA_DATA_VALUE]) {
196 if (type)
197 *type = DATA_VALUE;
198
199 ret = __nftnl_parse_data(data, tb[NFTA_DATA_VALUE]);
200 if (ret < 0)
201 return ret;
202 }
203 if (tb[NFTA_DATA_VERDICT])
204 ret = nftnl_parse_verdict(data, tb[NFTA_DATA_VERDICT], type);
205
206 return ret;
207}
208
209void nftnl_free_verdict(const union nftnl_data_reg *data)
210{
211 switch(data->verdict) {
212 case NFT_JUMP:
213 case NFT_GOTO:
214 xfree(data->chain);
215 break;
216 default:
217 break;
218 }
219}