diff options
47 files changed, 6204 insertions, 0 deletions
@@ -0,0 +1,339 @@ + GNU GENERAL PUBLIC LICENSE + Version 2, June 1991 + + Copyright (C) 1989, 1991 Free Software Foundation, Inc. + 675 Mass Ave, Cambridge, MA 02139, USA + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The licenses for most software are designed to take away your +freedom to share and change it. By contrast, the GNU General Public +License is intended to guarantee your freedom to share and change free +software--to make sure the software is free for all its users. This +General Public License applies to most of the Free Software +Foundation's software and to any other program whose authors commit to +using it. (Some other Free Software Foundation software is covered by +the GNU Library General Public License instead.) You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +this service if you wish), that you receive source code or can get it +if you want it, that you can change the software or use pieces of it +in new free programs; and that you know you can do these things. + + To protect your rights, we need to make restrictions that forbid +anyone to deny you these rights or to ask you to surrender the rights. +These restrictions translate to certain responsibilities for you if you +distribute copies of the software, or if you modify it. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must give the recipients all the rights that +you have. You must make sure that they, too, receive or can get the +source code. And you must show them these terms so they know their +rights. + + We protect your rights with two steps: (1) copyright the software, and +(2) offer you this license which gives you legal permission to copy, +distribute and/or modify the software. + + Also, for each author's protection and ours, we want to make certain +that everyone understands that there is no warranty for this free +software. If the software is modified by someone else and passed on, we +want its recipients to know that what they have is not the original, so +that any problems introduced by others will not reflect on the original +authors' reputations. + + Finally, any free program is threatened constantly by software +patents. We wish to avoid the danger that redistributors of a free +program will individually obtain patent licenses, in effect making the +program proprietary. To prevent this, we have made it clear that any +patent must be licensed for everyone's free use or not licensed at all. + + The precise terms and conditions for copying, distribution and +modification follow. + + GNU GENERAL PUBLIC LICENSE + TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + + 0. This License applies to any program or other work which contains +a notice placed by the copyright holder saying it may be distributed +under the terms of this General Public License. The "Program", below, +refers to any such program or work, and a "work based on the Program" +means either the Program or any derivative work under copyright law: +that is to say, a work containing the Program or a portion of it, +either verbatim or with modifications and/or translated into another +language. (Hereinafter, translation is included without limitation in +the term "modification".) Each licensee is addressed as "you". + +Activities other than copying, distribution and modification are not +covered by this License; they are outside its scope. The act of +running the Program is not restricted, and the output from the Program +is covered only if its contents constitute a work based on the +Program (independent of having been made by running the Program). +Whether that is true depends on what the Program does. + + 1. You may copy and distribute verbatim copies of the Program's +source code as you receive it, in any medium, provided that you +conspicuously and appropriately publish on each copy an appropriate +copyright notice and disclaimer of warranty; keep intact all the +notices that refer to this License and to the absence of any warranty; +and give any other recipients of the Program a copy of this License +along with the Program. + +You may charge a fee for the physical act of transferring a copy, and +you may at your option offer warranty protection in exchange for a fee. + + 2. You may modify your copy or copies of the Program or any portion +of it, thus forming a work based on the Program, and copy and +distribute such modifications or work under the terms of Section 1 +above, provided that you also meet all of these conditions: + + a) You must cause the modified files to carry prominent notices + stating that you changed the files and the date of any change. + + b) You must cause any work that you distribute or publish, that in + whole or in part contains or is derived from the Program or any + part thereof, to be licensed as a whole at no charge to all third + parties under the terms of this License. + + c) If the modified program normally reads commands interactively + when run, you must cause it, when started running for such + interactive use in the most ordinary way, to print or display an + announcement including an appropriate copyright notice and a + notice that there is no warranty (or else, saying that you provide + a warranty) and that users may redistribute the program under + these conditions, and telling the user how to view a copy of this + License. (Exception: if the Program itself is interactive but + does not normally print such an announcement, your work based on + the Program is not required to print an announcement.) + +These requirements apply to the modified work as a whole. If +identifiable sections of that work are not derived from the Program, +and can be reasonably considered independent and separate works in +themselves, then this License, and its terms, do not apply to those +sections when you distribute them as separate works. But when you +distribute the same sections as part of a whole which is a work based +on the Program, the distribution of the whole must be on the terms of +this License, whose permissions for other licensees extend to the +entire whole, and thus to each and every part regardless of who wrote it. + +Thus, it is not the intent of this section to claim rights or contest +your rights to work written entirely by you; rather, the intent is to +exercise the right to control the distribution of derivative or +collective works based on the Program. + +In addition, mere aggregation of another work not based on the Program +with the Program (or with a work based on the Program) on a volume of +a storage or distribution medium does not bring the other work under +the scope of this License. + + 3. You may copy and distribute the Program (or a work based on it, +under Section 2) in object code or executable form under the terms of +Sections 1 and 2 above provided that you also do one of the following: + + a) Accompany it with the complete corresponding machine-readable + source code, which must be distributed under the terms of Sections + 1 and 2 above on a medium customarily used for software interchange; or, + + b) Accompany it with a written offer, valid for at least three + years, to give any third party, for a charge no more than your + cost of physically performing source distribution, a complete + machine-readable copy of the corresponding source code, to be + distributed under the terms of Sections 1 and 2 above on a medium + customarily used for software interchange; or, + + c) Accompany it with the information you received as to the offer + to distribute corresponding source code. (This alternative is + allowed only for noncommercial distribution and only if you + received the program in object code or executable form with such + an offer, in accord with Subsection b above.) + +The source code for a work means the preferred form of the work for +making modifications to it. For an executable work, complete source +code means all the source code for all modules it contains, plus any +associated interface definition files, plus the scripts used to +control compilation and installation of the executable. However, as a +special exception, the source code distributed need not include +anything that is normally distributed (in either source or binary +form) with the major components (compiler, kernel, and so on) of the +operating system on which the executable runs, unless that component +itself accompanies the executable. + +If distribution of executable or object code is made by offering +access to copy from a designated place, then offering equivalent +access to copy the source code from the same place counts as +distribution of the source code, even though third parties are not +compelled to copy the source along with the object code. + + 4. You may not copy, modify, sublicense, or distribute the Program +except as expressly provided under this License. Any attempt +otherwise to copy, modify, sublicense or distribute the Program is +void, and will automatically terminate your rights under this License. +However, parties who have received copies, or rights, from you under +this License will not have their licenses terminated so long as such +parties remain in full compliance. + + 5. You are not required to accept this License, since you have not +signed it. However, nothing else grants you permission to modify or +distribute the Program or its derivative works. These actions are +prohibited by law if you do not accept this License. Therefore, by +modifying or distributing the Program (or any work based on the +Program), you indicate your acceptance of this License to do so, and +all its terms and conditions for copying, distributing or modifying +the Program or works based on it. + + 6. Each time you redistribute the Program (or any work based on the +Program), the recipient automatically receives a license from the +original licensor to copy, distribute or modify the Program subject to +these terms and conditions. You may not impose any further +restrictions on the recipients' exercise of the rights granted herein. +You are not responsible for enforcing compliance by third parties to +this License. + + 7. If, as a consequence of a court judgment or allegation of patent +infringement or for any other reason (not limited to patent issues), +conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot +distribute so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you +may not distribute the Program at all. For example, if a patent +license would not permit royalty-free redistribution of the Program by +all those who receive copies directly or indirectly through you, then +the only way you could satisfy both it and this License would be to +refrain entirely from distribution of the Program. + +If any portion of this section is held invalid or unenforceable under +any particular circumstance, the balance of the section is intended to +apply and the section as a whole is intended to apply in other +circumstances. + +It is not the purpose of this section to induce you to infringe any +patents or other property right claims or to contest validity of any +such claims; this section has the sole purpose of protecting the +integrity of the free software distribution system, which is +implemented by public license practices. Many people have made +generous contributions to the wide range of software distributed +through that system in reliance on consistent application of that +system; it is up to the author/donor to decide if he or she is willing +to distribute software through any other system and a licensee cannot +impose that choice. + +This section is intended to make thoroughly clear what is believed to +be a consequence of the rest of this License. + + 8. If the distribution and/or use of the Program is restricted in +certain countries either by patents or by copyrighted interfaces, the +original copyright holder who places the Program under this License +may add an explicit geographical distribution limitation excluding +those countries, so that distribution is permitted only in or among +countries not thus excluded. In such case, this License incorporates +the limitation as if written in the body of this License. + + 9. The Free Software Foundation may publish revised and/or new versions +of the General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + +Each version is given a distinguishing version number. If the Program +specifies a version number of this License which applies to it and "any +later version", you have the option of following the terms and conditions +either of that version or of any later version published by the Free +Software Foundation. If the Program does not specify a version number of +this License, you may choose any version ever published by the Free Software +Foundation. + + 10. If you wish to incorporate parts of the Program into other free +programs whose distribution conditions are different, write to the author +to ask for permission. For software which is copyrighted by the Free +Software Foundation, write to the Free Software Foundation; we sometimes +make exceptions for this. Our decision will be guided by the two goals +of preserving the free status of all derivatives of our free software and +of promoting the sharing and reuse of software generally. + + NO WARRANTY + + 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY +FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN +OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES +PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED +OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS +TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE +PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, +REPAIR OR CORRECTION. + + 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR +REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, +INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING +OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED +TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY +YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER +PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE +POSSIBILITY OF SUCH DAMAGES. + + END OF TERMS AND CONDITIONS + + Appendix: How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +convey the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + <one line to give the program's name and a brief idea of what it does.> + Copyright (C) 19yy <name of author> + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + +Also add information on how to contact you by electronic and paper mail. + +If the program is interactive, make it output a short notice like this +when it starts in an interactive mode: + + Gnomovision version 69, Copyright (C) 19yy name of author + Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, the commands you use may +be called something other than `show w' and `show c'; they could even be +mouse-clicks or menu items--whatever suits your program. + +You should also get your employer (if you work as a programmer) or your +school, if any, to sign a "copyright disclaimer" for the program, if +necessary. Here is a sample; alter the names: + + Yoyodyne, Inc., hereby disclaims all copyright interest in the program + `Gnomovision' (which makes passes at compilers) written by James Hacker. + + <signature of Ty Coon>, 1 April 1989 + Ty Coon, President of Vice + +This General Public License does not permit incorporating your program into +proprietary programs. If your program is a subroutine library, you may +consider it more useful to permit linking proprietary applications with the +library. If this is what you want to do, use the GNU Library General +Public License instead of this License. diff --git a/Make_global.am b/Make_global.am new file mode 100644 index 0000000..1654f10 --- /dev/null +++ b/Make_global.am @@ -0,0 +1,24 @@ +# This is _NOT_ the library release version, it's an API version. +# Extracted from Chapter 6 "Library interface versions" of the libtool docs. +# +# <snippet> +# Here are a set of rules to help you update your library version information: +# +# 1. Start with version information of `0:0:0' for each libtool library. +# 2. Update the version information only immediately before a public release +# of your software. More frequent updates are unnecessary, and only guarantee +# that the current interface number gets larger faster. +# 3. If the library source code has changed at all since the last update, +# then increment revision (`c:r:a' becomes `c:r+1:a'). +# 4. If any interfaces have been added, removed, or changed since the last +# update, increment current, and set revision to 0. +# 5. If any interfaces have been added since the last public release, then +# increment age. +# 6. If any interfaces have been removed since the last public release, then +# set age to 0. +# </snippet> +# +LIBVERSION=0:0:0 + +AM_CPPFLAGS = ${regular_CPPFLAGS} -I${top_srcdir}/include ${LIBMNL_CFLAGS} +AM_CFLAGS = ${regular_CFLAGS} ${GCC_FVISIBILITY_HIDDEN} diff --git a/Makefile.am b/Makefile.am new file mode 100644 index 0000000..6999f51 --- /dev/null +++ b/Makefile.am @@ -0,0 +1,9 @@ +include $(top_srcdir)/Make_global.am + +ACLOCAL_AMFLAGS = -I m4 + +SUBDIRS = src include examples +DIST_SUBDIRS = src include examples + +pkgconfigdir = $(libdir)/pkgconfig +pkgconfig_DATA = libnftables.pc diff --git a/configure.ac b/configure.ac new file mode 100644 index 0000000..01c170a --- /dev/null +++ b/configure.ac @@ -0,0 +1,35 @@ +dnl Process this file with autoconf to create configure. + +AC_INIT([libnftables], [1.0.0]) +AC_CONFIG_AUX_DIR([build-aux]) +AC_CANONICAL_HOST +AC_CONFIG_MACRO_DIR([m4]) +AC_CONFIG_HEADERS([config.h]) + +AM_INIT_AUTOMAKE([-Wall foreign tar-pax no-dist-gzip dist-bzip2 + 1.6 subdir-objects]) + +dnl kernel style compile messages +m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])]) + +dnl Dependencies +PKG_CHECK_MODULES([LIBMNL], [libmnl >= 1.0.0]) + +AC_PROG_CC +AM_PROG_CC_C_O +AC_DISABLE_STATIC +LT_INIT +CHECK_GCC_FVISIBILITY +case "$host" in +*-*-linux*) ;; +*) AC_MSG_ERROR([Linux only, dude!]);; +esac + +regular_CPPFLAGS="-D_FILE_OFFSET_BITS=64 -D_REENTRANT" +regular_CFLAGS="-Wall -Waggregate-return -Wmissing-declarations \ + -Wmissing-prototypes -Wshadow -Wstrict-prototypes \ + -Wformat=2 -pipe" +AC_SUBST([regular_CPPFLAGS]) +AC_SUBST([regular_CFLAGS]) +AC_CONFIG_FILES([Makefile src/Makefile include/Makefile include/libnftables/Makefile include/linux/Makefile include/linux/netfilter/Makefile examples/Makefile libnftables.pc doxygen.cfg]) +AC_OUTPUT diff --git a/doxygen.cfg.in b/doxygen.cfg.in new file mode 100644 index 0000000..9582600 --- /dev/null +++ b/doxygen.cfg.in @@ -0,0 +1,184 @@ +DOXYFILE_ENCODING = UTF-8 +PROJECT_NAME = @PACKAGE@ +PROJECT_NUMBER = @VERSION@ +OUTPUT_DIRECTORY = doxygen +CREATE_SUBDIRS = NO +OUTPUT_LANGUAGE = English +BRIEF_MEMBER_DESC = YES +REPEAT_BRIEF = YES +ABBREVIATE_BRIEF = +ALWAYS_DETAILED_SEC = NO +INLINE_INHERITED_MEMB = NO +FULL_PATH_NAMES = NO +STRIP_FROM_PATH = +STRIP_FROM_INC_PATH = +SHORT_NAMES = NO +JAVADOC_AUTOBRIEF = NO +QT_AUTOBRIEF = NO +MULTILINE_CPP_IS_BRIEF = NO +INHERIT_DOCS = YES +SEPARATE_MEMBER_PAGES = NO +TAB_SIZE = 8 +ALIASES = +OPTIMIZE_OUTPUT_FOR_C = YES +OPTIMIZE_OUTPUT_JAVA = NO +OPTIMIZE_FOR_FORTRAN = NO +OPTIMIZE_OUTPUT_VHDL = NO +BUILTIN_STL_SUPPORT = NO +CPP_CLI_SUPPORT = NO +SIP_SUPPORT = NO +DISTRIBUTE_GROUP_DOC = NO +SUBGROUPING = YES +TYPEDEF_HIDES_STRUCT = NO +EXTRACT_ALL = NO +EXTRACT_PRIVATE = NO +EXTRACT_STATIC = NO +EXTRACT_LOCAL_CLASSES = YES +EXTRACT_LOCAL_METHODS = NO +EXTRACT_ANON_NSPACES = NO +HIDE_UNDOC_MEMBERS = NO +HIDE_UNDOC_CLASSES = NO +HIDE_FRIEND_COMPOUNDS = NO +HIDE_IN_BODY_DOCS = NO +INTERNAL_DOCS = NO +CASE_SENSE_NAMES = YES +HIDE_SCOPE_NAMES = NO +SHOW_INCLUDE_FILES = YES +INLINE_INFO = YES +SORT_MEMBER_DOCS = YES +SORT_BRIEF_DOCS = NO +SORT_GROUP_NAMES = NO +SORT_BY_SCOPE_NAME = NO +GENERATE_TODOLIST = YES +GENERATE_TESTLIST = YES +GENERATE_BUGLIST = YES +GENERATE_DEPRECATEDLIST= YES +ENABLED_SECTIONS = +MAX_INITIALIZER_LINES = 30 +SHOW_USED_FILES = YES +SHOW_DIRECTORIES = NO +FILE_VERSION_FILTER = +QUIET = NO +WARNINGS = YES +WARN_IF_UNDOCUMENTED = YES +WARN_IF_DOC_ERROR = YES +WARN_NO_PARAMDOC = NO +WARN_FORMAT = "$file:$line: $text" +WARN_LOGFILE = +INPUT = . +INPUT_ENCODING = UTF-8 +FILE_PATTERNS = *.c libnftables.h +RECURSIVE = YES +EXCLUDE = +EXCLUDE_SYMLINKS = NO +EXCLUDE_PATTERNS = */.git/* .*.d +EXCLUDE_SYMBOLS = EXPORT_SYMBOL nft_table +EXAMPLE_PATH = +EXAMPLE_PATTERNS = +EXAMPLE_RECURSIVE = NO +IMAGE_PATH = +INPUT_FILTER = +FILTER_PATTERNS = +FILTER_SOURCE_FILES = NO +SOURCE_BROWSER = YES +INLINE_SOURCES = NO +STRIP_CODE_COMMENTS = YES +REFERENCED_BY_RELATION = NO +REFERENCES_RELATION = NO +REFERENCES_LINK_SOURCE = YES +USE_HTAGS = NO +VERBATIM_HEADERS = YES +ALPHABETICAL_INDEX = NO +COLS_IN_ALPHA_INDEX = 5 +IGNORE_PREFIX = +GENERATE_HTML = YES +HTML_OUTPUT = html +HTML_FILE_EXTENSION = .html +HTML_HEADER = +HTML_STYLESHEET = +HTML_ALIGN_MEMBERS = YES +GENERATE_HTMLHELP = NO +GENERATE_DOCSET = NO +DOCSET_FEEDNAME = "Doxygen generated docs" +DOCSET_BUNDLE_ID = org.doxygen.Project +HTML_DYNAMIC_SECTIONS = NO +CHM_FILE = +HHC_LOCATION = +GENERATE_CHI = NO +BINARY_TOC = NO +TOC_EXPAND = NO +DISABLE_INDEX = NO +ENUM_VALUES_PER_LINE = 4 +GENERATE_TREEVIEW = NO +TREEVIEW_WIDTH = 250 +GENERATE_LATEX = NO +LATEX_OUTPUT = latex +LATEX_CMD_NAME = latex +MAKEINDEX_CMD_NAME = makeindex +COMPACT_LATEX = NO +PAPER_TYPE = a4wide +EXTRA_PACKAGES = +LATEX_HEADER = +PDF_HYPERLINKS = YES +USE_PDFLATEX = YES +LATEX_BATCHMODE = NO +LATEX_HIDE_INDICES = NO +GENERATE_RTF = NO +RTF_OUTPUT = rtf +COMPACT_RTF = NO +RTF_HYPERLINKS = NO +RTF_STYLESHEET_FILE = +RTF_EXTENSIONS_FILE = +GENERATE_MAN = YES +MAN_OUTPUT = man +MAN_EXTENSION = .3 +MAN_LINKS = NO +GENERATE_XML = NO +XML_OUTPUT = xml +XML_SCHEMA = +XML_DTD = +XML_PROGRAMLISTING = YES +GENERATE_AUTOGEN_DEF = NO +GENERATE_PERLMOD = NO +PERLMOD_LATEX = NO +PERLMOD_PRETTY = YES +PERLMOD_MAKEVAR_PREFIX = +ENABLE_PREPROCESSING = YES +MACRO_EXPANSION = NO +EXPAND_ONLY_PREDEF = NO +SEARCH_INCLUDES = YES +INCLUDE_PATH = +INCLUDE_FILE_PATTERNS = +PREDEFINED = +EXPAND_AS_DEFINED = +SKIP_FUNCTION_MACROS = YES +TAGFILES = +GENERATE_TAGFILE = +ALLEXTERNALS = NO +EXTERNAL_GROUPS = YES +PERL_PATH = /usr/bin/perl +CLASS_DIAGRAMS = YES +MSCGEN_PATH = +HIDE_UNDOC_RELATIONS = YES +HAVE_DOT = YES +CLASS_GRAPH = YES +COLLABORATION_GRAPH = YES +GROUP_GRAPHS = YES +UML_LOOK = NO +TEMPLATE_RELATIONS = NO +INCLUDE_GRAPH = YES +INCLUDED_BY_GRAPH = YES +CALL_GRAPH = NO +CALLER_GRAPH = NO +GRAPHICAL_HIERARCHY = YES +DIRECTORY_GRAPH = YES +DOT_IMAGE_FORMAT = png +DOT_PATH = +DOTFILE_DIRS = +DOT_GRAPH_MAX_NODES = 50 +MAX_DOT_GRAPH_DEPTH = 0 +DOT_TRANSPARENT = YES +DOT_MULTI_TARGETS = NO +GENERATE_LEGEND = YES +DOT_CLEANUP = YES +SEARCHENGINE = NO diff --git a/examples/Makefile.am b/examples/Makefile.am new file mode 100644 index 0000000..1c72ab4 --- /dev/null +++ b/examples/Makefile.am @@ -0,0 +1,38 @@ +include $(top_srcdir)/Make_global.am + +check_PROGRAMS = nft-table-add \ + nft-table-del \ + nft-table-get \ + nft-chain-add \ + nft-chain-del \ + nft-chain-get \ + nft-rule-add \ + nft-rule-del \ + nft-rule-get + +nft_table_add_SOURCES = nft-table-add.c +nft_table_add_LDADD = ../src/libnftables.la ${LIBMNL_LIBS} + +nft_table_del_SOURCES = nft-table-del.c +nft_table_del_LDADD = ../src/libnftables.la ${LIBMNL_LIBS} + +nft_table_get_SOURCES = nft-table-get.c +nft_table_get_LDADD = ../src/libnftables.la ${LIBMNL_LIBS} + +nft_chain_add_SOURCES = nft-chain-add.c +nft_chain_add_LDADD = ../src/libnftables.la ${LIBMNL_LIBS} + +nft_chain_del_SOURCES = nft-chain-del.c +nft_chain_del_LDADD = ../src/libnftables.la ${LIBMNL_LIBS} + +nft_chain_get_SOURCES = nft-chain-get.c +nft_chain_get_LDADD = ../src/libnftables.la ${LIBMNL_LIBS} + +nft_rule_add_SOURCES = nft-rule-add.c +nft_rule_add_LDADD = ../src/libnftables.la ${LIBMNL_LIBS} + +nft_rule_del_SOURCES = nft-rule-del.c +nft_rule_del_LDADD = ../src/libnftables.la ${LIBMNL_LIBS} + +nft_rule_get_SOURCES = nft-rule-get.c +nft_rule_get_LDADD = ../src/libnftables.la ${LIBMNL_LIBS} diff --git a/examples/nft-chain-add.c b/examples/nft-chain-add.c new file mode 100644 index 0000000..4897fc5 --- /dev/null +++ b/examples/nft-chain-add.c @@ -0,0 +1,111 @@ +/* + * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org> + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This software has been sponsored by Sophos Astaro <http://www.sophos.com> + */ + +#include <stdlib.h> +#include <time.h> +#include <string.h> +#include <netinet/in.h> + +#include <linux/netfilter.h> +#include <linux/netfilter/nf_tables.h> + +#include <libmnl/libmnl.h> +#include <libnftables/chain.h> + +int main(int argc, char *argv[]) +{ + struct mnl_socket *nl; + char buf[MNL_SOCKET_BUFFER_SIZE]; + struct nlmsghdr *nlh; + uint32_t portid, seq; + struct nft_chain *t = NULL; + int ret, family, hooknum; + + if (argc != 6) { + fprintf(stderr, "Usage: %s <family> <table> <chain> " + "<hooknum> <prio>\n", + argv[0]); + exit(EXIT_FAILURE); + } + + if (strcmp(argv[1], "ip") == 0) + family = AF_INET; + else if (strcmp(argv[1], "ip6") == 0) + family = AF_INET6; + else if (strcmp(argv[1], "bridge") == 0) + family = AF_BRIDGE; + else { + fprintf(stderr, "Unknown family: ip, ip6, bridge\n"); + exit(EXIT_FAILURE); + } + + if (strcmp(argv[4], "NF_INET_LOCAL_IN") == 0) + hooknum = NF_INET_LOCAL_IN; + else if (strcmp(argv[4], "NF_INET_LOCAL_OUT") == 0) + hooknum = NF_INET_LOCAL_OUT; + else if (strcmp(argv[4], "NF_INET_PRE_ROUTING") == 0) + hooknum = NF_INET_PRE_ROUTING; + else if (strcmp(argv[4], "NF_INET_POST_ROUTING") == 0) + hooknum = NF_INET_POST_ROUTING; + else if (strcmp(argv[4], "NF_INET_FORWARD") == 0) + hooknum = NF_INET_FORWARD; + else { + fprintf(stderr, "Unknown hook: %s\n", argv[4]); + exit(EXIT_FAILURE); + } + + t = nft_chain_alloc(); + if (t == NULL) { + perror("OOM"); + exit(EXIT_FAILURE); + } + seq = time(NULL); + nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_NEWCHAIN, family, + NLM_F_EXCL|NLM_F_ACK, seq); + nft_chain_attr_set(t, NFT_CHAIN_ATTR_TABLE, argv[2]); + nft_chain_attr_set(t, NFT_CHAIN_ATTR_NAME, argv[3]); + nft_chain_attr_set_u32(t, NFT_CHAIN_ATTR_HOOKNUM, hooknum); + nft_chain_attr_set_u32(t, NFT_CHAIN_ATTR_PRIO, atoi(argv[5])); + nft_chain_nlmsg_build_payload(nlh, t); + nft_chain_free(t); + + nl = mnl_socket_open(NETLINK_NETFILTER); + if (nl == NULL) { + perror("mnl_socket_open"); + exit(EXIT_FAILURE); + } + + if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) { + perror("mnl_socket_bind"); + exit(EXIT_FAILURE); + } + portid = mnl_socket_get_portid(nl); + + if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { + perror("mnl_socket_send"); + exit(EXIT_FAILURE); + } + + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + while (ret > 0) { + ret = mnl_cb_run(buf, ret, seq, portid, NULL, NULL); + if (ret <= 0) + break; + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + } + if (ret == -1) { + perror("error"); + exit(EXIT_FAILURE); + } + mnl_socket_close(nl); + + return EXIT_SUCCESS; +} diff --git a/examples/nft-chain-del.c b/examples/nft-chain-del.c new file mode 100644 index 0000000..ddbab3f --- /dev/null +++ b/examples/nft-chain-del.c @@ -0,0 +1,93 @@ +/* + * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org> + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This software has been sponsored by Sophos Astaro <http://www.sophos.com> + */ + +#include <stdlib.h> +#include <time.h> +#include <string.h> +#include <netinet/in.h> + +#include <linux/netfilter.h> +#include <linux/netfilter/nf_tables.h> + +#include <libmnl/libmnl.h> +#include <libnftables/chain.h> + +int main(int argc, char *argv[]) +{ + struct mnl_socket *nl; + char buf[MNL_SOCKET_BUFFER_SIZE]; + struct nlmsghdr *nlh; + uint32_t portid, seq; + struct nft_chain *t = NULL; + int ret, family; + + if (argc != 4) { + fprintf(stderr, "Usage: %s <family> <table> <chain>\n", + argv[0]); + exit(EXIT_FAILURE); + } + + if (strcmp(argv[1], "ip") == 0) + family = AF_INET; + else if (strcmp(argv[1], "ip6") == 0) + family = AF_INET6; + else if (strcmp(argv[1], "bridge") == 0) + family = AF_BRIDGE; + else { + fprintf(stderr, "Unknown family: ip, ip6, bridge\n"); + exit(EXIT_FAILURE); + } + + t = nft_chain_alloc(); + if (t == NULL) { + perror("OOM"); + exit(EXIT_FAILURE); + } + seq = time(NULL); + nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_DELCHAIN, family, + NLM_F_ACK, seq); + nft_chain_attr_set(t, NFT_CHAIN_ATTR_TABLE, argv[2]); + nft_chain_attr_set(t, NFT_CHAIN_ATTR_NAME, argv[3]); + nft_chain_nlmsg_build_payload(nlh, t); + nft_chain_free(t); + + nl = mnl_socket_open(NETLINK_NETFILTER); + if (nl == NULL) { + perror("mnl_socket_open"); + exit(EXIT_FAILURE); + } + + if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) { + perror("mnl_socket_bind"); + exit(EXIT_FAILURE); + } + portid = mnl_socket_get_portid(nl); + + if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { + perror("mnl_socket_send"); + exit(EXIT_FAILURE); + } + + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + while (ret > 0) { + ret = mnl_cb_run(buf, ret, seq, portid, NULL, NULL); + if (ret <= 0) + break; + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + } + if (ret == -1) { + perror("error"); + exit(EXIT_FAILURE); + } + mnl_socket_close(nl); + + return EXIT_SUCCESS; +} diff --git a/examples/nft-chain-get.c b/examples/nft-chain-get.c new file mode 100644 index 0000000..2756c90 --- /dev/null +++ b/examples/nft-chain-get.c @@ -0,0 +1,123 @@ +/* + * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org> + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This software has been sponsored by Sophos Astaro <http://www.sophos.com> + */ + +#include <stdlib.h> +#include <time.h> +#include <string.h> +#include <netinet/in.h> + +#include <linux/netfilter/nf_tables.h> + +#include <libmnl/libmnl.h> +#include <libnftables/chain.h> + +static int table_cb(const struct nlmsghdr *nlh, void *data) +{ + struct nft_chain *t; + char buf[4096]; + + t = nft_chain_alloc(); + if (t == NULL) { + perror("OOM"); + goto err; + } + + if (nft_chain_nlmsg_parse(nlh, t) < 0) { + perror("nft_chain_nlmsg_parse"); + goto err_free; + } + + nft_chain_snprintf(buf, sizeof(buf), t, NFT_CHAIN_O_DEFAULT, 0); + printf("%s", buf); + +err_free: + nft_chain_free(t); +err: + return MNL_CB_OK; +} + +int main(int argc, char *argv[]) +{ + struct mnl_socket *nl; + char buf[MNL_SOCKET_BUFFER_SIZE]; + struct nlmsghdr *nlh; + uint32_t portid, seq; + struct nft_chain *t = NULL; + int ret; + + seq = time(NULL); + + if (argc == 1) { + nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_GETCHAIN, AF_INET, + NLM_F_DUMP, seq); + } else if (argc == 4) { + int family; + + if (strcmp(argv[1], "ip") == 0) + family = AF_INET; + else if (strcmp(argv[1], "ip6") == 0) + family = AF_INET6; + else if (strcmp(argv[1], "bridge") == 0) + family = AF_BRIDGE; + else { + fprintf(stderr, "Unknown family: ip, ip6, bridge\n"); + exit(EXIT_FAILURE); + } + + t = nft_chain_alloc(); + if (t == NULL) { + perror("OOM"); + exit(EXIT_FAILURE); + } + nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_GETCHAIN, family, + NLM_F_ACK, seq); + nft_chain_attr_set(t, NFT_CHAIN_ATTR_TABLE, argv[2]); + nft_chain_attr_set(t, NFT_CHAIN_ATTR_NAME, argv[3]); + nft_chain_nlmsg_build_payload(nlh, t); + nft_chain_free(t); + } else { + fprintf(stderr, "Usage: %s [<family> <table> <chain>]\n", + argv[0]); + exit(EXIT_FAILURE); + } + + nl = mnl_socket_open(NETLINK_NETFILTER); + if (nl == NULL) { + perror("mnl_socket_open"); + exit(EXIT_FAILURE); + } + + if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) { + perror("mnl_socket_bind"); + exit(EXIT_FAILURE); + } + portid = mnl_socket_get_portid(nl); + + if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { + perror("mnl_socket_send"); + exit(EXIT_FAILURE); + } + + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + while (ret > 0) { + ret = mnl_cb_run(buf, ret, seq, portid, table_cb, NULL); + if (ret <= 0) + break; + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + } + if (ret == -1) { + perror("error"); + exit(EXIT_FAILURE); + } + mnl_socket_close(nl); + + return EXIT_SUCCESS; +} diff --git a/examples/nft-rule-add.c b/examples/nft-rule-add.c new file mode 100644 index 0000000..5fbc796 --- /dev/null +++ b/examples/nft-rule-add.c @@ -0,0 +1,199 @@ +/* + * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org> + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This software has been sponsored by Sophos Astaro <http://www.sophos.com> + */ + +#include <stdlib.h> +#include <time.h> +#include <string.h> +#include <stddef.h> /* for offsetof */ +#include <netinet/in.h> +#include <arpa/inet.h> + +#include <linux/netfilter/nf_tables.h> + +#include <libmnl/libmnl.h> +#include <libnftables/rule.h> +#include <libnftables/expr.h> +#include <libnftables/payload.h> + +#include <linux/netfilter_ipv4/ipt_LOG.h> +#include <linux/netfilter/xt_iprange.h> + +#include <netinet/ip.h> + +static void add_target_log(struct nft_rule_expr *e) +{ + struct ipt_log_info *info; + + nft_rule_expr_set(e, NFT_EXPR_TG_NAME, "LOG", strlen("LOG")); + nft_rule_expr_set_u32(e, NFT_EXPR_TG_REV, 0); + + info = calloc(1, sizeof(struct ipt_log_info)); + if (info == NULL) + return; + + sprintf(info->prefix, "test: "); + info->prefix[sizeof(info->prefix)-1] = '\0'; + info->logflags = 0x0f; + info->level = 5; + + nft_rule_expr_set(e, NFT_EXPR_TG_INFO, info, sizeof(*info)); +} + +static void add_expr_target(struct nft_rule *r) +{ + struct nft_rule_expr *expr; + + expr = nft_rule_expr_alloc("target"); + if (expr == NULL) + return; + + add_target_log(expr); + + nft_rule_add_expr(r, expr); +} + +static void add_match_iprange(struct nft_rule_expr *e) +{ + struct xt_iprange_mtinfo *info; + + nft_rule_expr_set(e, NFT_EXPR_MT_NAME, "iprange", strlen("iprange")); + nft_rule_expr_set_u32(e, NFT_EXPR_MT_REV, 1); + + info = calloc(1, sizeof(struct xt_iprange_mtinfo)); + if (info == NULL) + return; + + info->src_min.ip = info->dst_min.ip = inet_addr("127.0.0.1"); + info->src_max.ip = info->dst_max.ip = inet_addr("127.0.0.1"); + info->flags = IPRANGE_SRC; + + nft_rule_expr_set(e, NFT_EXPR_MT_INFO, info, sizeof(*info)); +} + +static void add_expr_match(struct nft_rule *r) +{ + struct nft_rule_expr *expr; + + expr = nft_rule_expr_alloc("match"); + if (expr == NULL) + return; + + add_match_iprange(expr); + + nft_rule_add_expr(r, expr); +} + +#define field_sizeof(t, f) (sizeof(((t *)NULL)->f)) + +static void add_payload2(struct nft_rule_expr *e) +{ + nft_rule_expr_set_u32(e, NFT_EXPR_PAYLOAD_BASE, + NFT_PAYLOAD_NETWORK_HEADER); + nft_rule_expr_set_u32(e, NFT_EXPR_PAYLOAD_DREG, NFT_REG_1); + nft_rule_expr_set_u32(e, NFT_EXPR_PAYLOAD_OFFSET, + offsetof(struct iphdr, protocol)); + nft_rule_expr_set_u32(e, NFT_EXPR_PAYLOAD_LEN, 1); +} + +static void add_payload(struct nft_rule *r) +{ + struct nft_rule_expr *expr; + + expr = nft_rule_expr_alloc("payload"); + if (expr == NULL) + return; + + add_payload2(expr); + + nft_rule_add_expr(r, expr); +} + +int main(int argc, char *argv[]) +{ + struct mnl_socket *nl; + char buf[MNL_SOCKET_BUFFER_SIZE]; + struct nlmsghdr *nlh; + uint32_t portid, seq; + struct nft_rule *r = NULL; + int ret, family; + + if (argc != 4) { + fprintf(stderr, "Usage: %s <family> <table> <chain>\n", + argv[0]); + exit(EXIT_FAILURE); + } + + r = nft_rule_alloc(); + if (r == NULL) { + perror("OOM"); + exit(EXIT_FAILURE); + } + + if (strcmp(argv[1], "ip") == 0) + family = AF_INET; + else if (strcmp(argv[1], "ip6") == 0) + family = AF_INET6; + else if (strcmp(argv[1], "bridge") == 0) + family = AF_BRIDGE; + else { + fprintf(stderr, "Unknown family: ip, ip6, bridge\n"); + exit(EXIT_FAILURE); + } + + nft_rule_attr_set(r, NFT_RULE_ATTR_TABLE, argv[2]); + nft_rule_attr_set(r, NFT_RULE_ATTR_CHAIN, argv[3]); + + add_expr_match(r); + add_expr_target(r); +// add_payload(r); + + char tmp[1024]; + nft_rule_snprintf(tmp, sizeof(tmp), r, 0, 0); + printf("%s\n", tmp); + + seq = time(NULL); + nlh = nft_rule_nlmsg_build_hdr(buf, NFT_MSG_NEWRULE, family, + NLM_F_APPEND|NLM_F_ACK, seq); + nft_rule_nlmsg_build_payload(nlh, r); + nft_rule_free(r); + + nl = mnl_socket_open(NETLINK_NETFILTER); + if (nl == NULL) { + perror("mnl_socket_open"); + exit(EXIT_FAILURE); + } + + if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) { + perror("mnl_socket_bind"); + exit(EXIT_FAILURE); + } + portid = mnl_socket_get_portid(nl); + + if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { + perror("mnl_socket_send"); + exit(EXIT_FAILURE); + } + + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + while (ret > 0) { + ret = mnl_cb_run(buf, ret, seq, portid, NULL, NULL); + if (ret <= 0) + break; + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + } + if (ret == -1) { + perror("error"); + exit(EXIT_FAILURE); + } + mnl_socket_close(nl); + + return EXIT_SUCCESS; +} diff --git a/examples/nft-rule-del.c b/examples/nft-rule-del.c new file mode 100644 index 0000000..4678b4e --- /dev/null +++ b/examples/nft-rule-del.c @@ -0,0 +1,103 @@ +/* + * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org> + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This software has been sponsored by Sophos Astaro <http://www.sophos.com> + */ + +#include <stdlib.h> +#include <time.h> +#include <string.h> +#include <stddef.h> /* for offsetof */ +#include <netinet/in.h> + +#include <linux/netfilter/nf_tables.h> + +#include <libmnl/libmnl.h> +#include <libnftables/rule.h> + +int main(int argc, char *argv[]) +{ + struct mnl_socket *nl; + char buf[MNL_SOCKET_BUFFER_SIZE]; + struct nlmsghdr *nlh; + uint32_t portid, seq; + struct nft_rule *r = NULL; + int ret, family; + + if (argc < 4 || argc > 5) { + fprintf(stderr, "Usage: %s <family> <table> <chain> [<handle>]\n", + argv[0]); + exit(EXIT_FAILURE); + } + + r = nft_rule_alloc(); + if (r == NULL) { + perror("OOM"); + exit(EXIT_FAILURE); + } + + if (strcmp(argv[1], "ip") == 0) + family = AF_INET; + else if (strcmp(argv[1], "ip6") == 0) + family = AF_INET6; + else if (strcmp(argv[1], "bridge") == 0) + family = AF_BRIDGE; + else { + fprintf(stderr, "Unknown family: ip, ip6, bridge\n"); + exit(EXIT_FAILURE); + } + + seq = time(NULL); + nlh = nft_rule_nlmsg_build_hdr(buf, NFT_MSG_DELRULE, family, + NLM_F_ACK, seq); + nft_rule_attr_set(r, NFT_RULE_ATTR_TABLE, argv[2]); + nft_rule_attr_set(r, NFT_RULE_ATTR_CHAIN, argv[3]); + + /* If no handle is specified, delete all rules in the chain */ + if (argc == 5) + nft_rule_attr_set_u16(r, NFT_RULE_ATTR_HANDLE, atoi(argv[4])); + + char tmp[1024]; + nft_rule_snprintf(tmp, sizeof(tmp), r, 0, 0); + printf("%s\n", tmp); + + nft_rule_nlmsg_build_payload(nlh, r); + nft_rule_free(r); + + nl = mnl_socket_open(NETLINK_NETFILTER); + if (nl == NULL) { + perror("mnl_socket_open"); + exit(EXIT_FAILURE); + } + + if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) { + perror("mnl_socket_bind"); + exit(EXIT_FAILURE); + } + portid = mnl_socket_get_portid(nl); + + if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { + perror("mnl_socket_send"); + exit(EXIT_FAILURE); + } + + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + while (ret > 0) { + ret = mnl_cb_run(buf, ret, seq, portid, NULL, NULL); + if (ret <= 0) + break; + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + } + if (ret == -1) { + perror("error"); + exit(EXIT_FAILURE); + } + mnl_socket_close(nl); + + return EXIT_SUCCESS; +} diff --git a/examples/nft-rule-get.c b/examples/nft-rule-get.c new file mode 100644 index 0000000..75043d7 --- /dev/null +++ b/examples/nft-rule-get.c @@ -0,0 +1,99 @@ +/* + * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org> + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This software has been sponsored by Sophos Astaro <http://www.sophos.com> + */ + +#include <stdlib.h> +#include <time.h> +#include <string.h> +#include <netinet/in.h> + +#include <linux/netfilter/nf_tables.h> + +#include <libmnl/libmnl.h> +#include <libnftables/rule.h> + +static int table_cb(const struct nlmsghdr *nlh, void *data) +{ + struct nft_rule *t; + char buf[4096]; + + t = nft_rule_alloc(); + if (t == NULL) { + perror("OOM"); + goto err; + } + + if (nft_rule_nlmsg_parse(nlh, t) < 0) { + perror("nft_rule_nlmsg_parse"); + goto err_free; + } + + nft_rule_snprintf(buf, sizeof(buf), t, NFT_RULE_O_DEFAULT, 0); + printf("%s", buf); + +err_free: + nft_rule_free(t); +err: + return MNL_CB_OK; +} + +int main(int argc, char *argv[]) +{ + struct mnl_socket *nl; + char buf[MNL_SOCKET_BUFFER_SIZE]; + struct nlmsghdr *nlh; + uint32_t portid, seq; + struct nft_rule *t = NULL; + int ret; + + /* XXX requires table, chain and handle attributes for selective get */ + + t = nft_rule_alloc(); + if (t == NULL) { + perror("OOM"); + exit(EXIT_FAILURE); + } + + seq = time(NULL); + nlh = nft_rule_nlmsg_build_hdr(buf, NFT_MSG_GETRULE, AF_INET, + NLM_F_DUMP, seq); + + nl = mnl_socket_open(NETLINK_NETFILTER); + if (nl == NULL) { + perror("mnl_socket_open"); + exit(EXIT_FAILURE); + } + + if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) { + perror("mnl_socket_bind"); + exit(EXIT_FAILURE); + } + portid = mnl_socket_get_portid(nl); + + if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { + perror("mnl_socket_send"); + exit(EXIT_FAILURE); + } + + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + while (ret > 0) { + ret = mnl_cb_run(buf, ret, seq, portid, table_cb, NULL); + if (ret <= 0) + break; + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + } + if (ret == -1) { + perror("error"); + exit(EXIT_FAILURE); + } + mnl_socket_close(nl); + + return EXIT_SUCCESS; +} diff --git a/examples/nft-table-add.c b/examples/nft-table-add.c new file mode 100644 index 0000000..f59049c --- /dev/null +++ b/examples/nft-table-add.c @@ -0,0 +1,92 @@ +/* + * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org> + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This software has been sponsored by Sophos Astaro <http://www.sophos.com> + */ + +#include <stdlib.h> +#include <time.h> +#include <string.h> +#include <netinet/in.h> + +#include <linux/netfilter/nf_tables.h> + +#include <libmnl/libmnl.h> +#include <libnftables/table.h> + +int main(int argc, char *argv[]) +{ + struct mnl_socket *nl; + char buf[MNL_SOCKET_BUFFER_SIZE]; + struct nlmsghdr *nlh; + uint32_t portid, seq, family; + struct nft_table *t = NULL; + int ret; + + if (argc != 3) { + fprintf(stderr, "%s <family> <name>\n", argv[0]); + exit(EXIT_FAILURE); + } + + t = nft_table_alloc(); + if (t == NULL) { + perror("OOM"); + exit(EXIT_FAILURE); + } + + seq = time(NULL); + if (strcmp(argv[1], "ip") == 0) + family = AF_INET; + else if (strcmp(argv[1], "ip6") == 0) + family = AF_INET6; + else if (strcmp(argv[1], "bridge") == 0) + family = AF_BRIDGE; + else { + fprintf(stderr, "Unknown family: ip, ip6, bridge\n"); + exit(EXIT_FAILURE); + } + + nft_table_attr_set(t, NFT_TABLE_ATTR_NAME, argv[2]); + + nlh = nft_table_nlmsg_build_hdr(buf, NFT_MSG_NEWTABLE, family, + NLM_F_ACK, seq); + nft_table_nlmsg_build_payload(nlh, t); + nft_table_free(t); + + nl = mnl_socket_open(NETLINK_NETFILTER); + if (nl == NULL) { + perror("mnl_socket_open"); + exit(EXIT_FAILURE); + } + + if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) { + perror("mnl_socket_bind"); + exit(EXIT_FAILURE); + } + portid = mnl_socket_get_portid(nl); + + if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { + perror("mnl_socket_send"); + exit(EXIT_FAILURE); + } + + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + while (ret > 0) { + ret = mnl_cb_run(buf, ret, seq, portid, NULL, NULL); + if (ret <= 0) + break; + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + } + if (ret == -1) { + perror("error"); + exit(EXIT_FAILURE); + } + mnl_socket_close(nl); + + return EXIT_SUCCESS; +} diff --git a/examples/nft-table-del.c b/examples/nft-table-del.c new file mode 100644 index 0000000..2a73a27 --- /dev/null +++ b/examples/nft-table-del.c @@ -0,0 +1,92 @@ +/* + * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org> + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This software has been sponsored by Sophos Astaro <http://www.sophos.com> + */ + +#include <stdlib.h> +#include <time.h> +#include <string.h> +#include <netinet/in.h> + +#include <linux/netfilter/nf_tables.h> + +#include <libmnl/libmnl.h> +#include <libnftables/table.h> + +int main(int argc, char *argv[]) +{ + struct mnl_socket *nl; + char buf[MNL_SOCKET_BUFFER_SIZE]; + struct nlmsghdr *nlh; + uint32_t portid, seq, family; + struct nft_table *t = NULL; + int ret; + + if (argc != 3) { + fprintf(stderr, "%s <family> <name>\n", argv[0]); + exit(EXIT_FAILURE); + } + + t = nft_table_alloc(); + if (t == NULL) { + perror("OOM"); + exit(EXIT_FAILURE); + } + + seq = time(NULL); + if (strcmp(argv[1], "ip") == 0) + family = AF_INET; + else if (strcmp(argv[1], "ip6") == 0) + family = AF_INET6; + else if (strcmp(argv[1], "bridge") == 0) + family = AF_BRIDGE; + else { + fprintf(stderr, "Unknown family: ip, ip6, bridge\n"); + exit(EXIT_FAILURE); + } + + nlh = nft_table_nlmsg_build_hdr(buf, NFT_MSG_DELTABLE, family, + NLM_F_ACK, seq); + nft_table_attr_set(t, NFT_TABLE_ATTR_NAME, argv[2]); + + nft_table_nlmsg_build_payload(nlh, t); + nft_table_free(t); + + nl = mnl_socket_open(NETLINK_NETFILTER); + if (nl == NULL) { + perror("mnl_socket_open"); + exit(EXIT_FAILURE); + } + + if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) { + perror("mnl_socket_bind"); + exit(EXIT_FAILURE); + } + portid = mnl_socket_get_portid(nl); + + if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { + perror("mnl_socket_send"); + exit(EXIT_FAILURE); + } + + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + while (ret > 0) { + ret = mnl_cb_run(buf, ret, seq, portid, NULL, NULL); + if (ret <= 0) + break; + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + } + if (ret == -1) { + perror("error"); + exit(EXIT_FAILURE); + } + mnl_socket_close(nl); + + return EXIT_SUCCESS; +} diff --git a/examples/nft-table-get.c b/examples/nft-table-get.c new file mode 100644 index 0000000..219c188 --- /dev/null +++ b/examples/nft-table-get.c @@ -0,0 +1,107 @@ +/* + * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org> + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This software has been sponsored by Sophos Astaro <http://www.sophos.com> + */ + +#include <stdlib.h> +#include <time.h> +#include <string.h> +#include <netinet/in.h> + +#include <linux/netfilter/nf_tables.h> + +#include <libmnl/libmnl.h> +#include <libnftables/table.h> + +static int table_cb(const struct nlmsghdr *nlh, void *data) +{ + struct nft_table *t; + char buf[4096]; + + t = nft_table_alloc(); + if (t == NULL) { + perror("OOM"); + goto err; + } + + if (nft_table_nlmsg_parse(nlh, t) < 0) { + perror("nft_table_nlmsg_parse"); + goto err_free; + } + + nft_table_snprintf(buf, sizeof(buf), t, NFT_TABLE_O_DEFAULT, 0); + printf("%s", buf); + +err_free: + nft_table_free(t); +err: + return MNL_CB_OK; +} + +int main(int argc, char *argv[]) +{ + struct mnl_socket *nl; + char buf[MNL_SOCKET_BUFFER_SIZE]; + struct nlmsghdr *nlh; + uint32_t portid, seq; + struct nft_table *t = NULL; + int ret; + + if (argc == 2) { + t = nft_table_alloc(); + if (t == NULL) { + perror("OOM"); + exit(EXIT_FAILURE); + } + } + + seq = time(NULL); + if (t == NULL) { + nlh = nft_table_nlmsg_build_hdr(buf, NFT_MSG_GETTABLE, AF_INET, + NLM_F_DUMP, seq); + } else { + nlh = nft_table_nlmsg_build_hdr(buf, NFT_MSG_GETTABLE, AF_INET, + NLM_F_ACK, seq); + nft_table_attr_set(t, NFT_TABLE_ATTR_NAME, argv[1]); + nft_table_nlmsg_build_payload(nlh, t); + nft_table_free(t); + } + + nl = mnl_socket_open(NETLINK_NETFILTER); + if (nl == NULL) { + perror("mnl_socket_open"); + exit(EXIT_FAILURE); + } + + if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) { + perror("mnl_socket_bind"); + exit(EXIT_FAILURE); + } + portid = mnl_socket_get_portid(nl); + + if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { + perror("mnl_socket_send"); + exit(EXIT_FAILURE); + } + + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + while (ret > 0) { + ret = mnl_cb_run(buf, ret, seq, portid, table_cb, NULL); + if (ret <= 0) + break; + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + } + if (ret == -1) { + perror("error"); + exit(EXIT_FAILURE); + } + mnl_socket_close(nl); + + return EXIT_SUCCESS; +} diff --git a/include/Makefile.am b/include/Makefile.am new file mode 100644 index 0000000..10332b7 --- /dev/null +++ b/include/Makefile.am @@ -0,0 +1,3 @@ +SUBDIRS = libnftables linux + +noinst_HEADERS = linux_list.h diff --git a/include/libnftables/Makefile.am b/include/libnftables/Makefile.am new file mode 100644 index 0000000..47f837f --- /dev/null +++ b/include/libnftables/Makefile.am @@ -0,0 +1,4 @@ +pkginclude_HEADERS = table.h \ + chain.h \ + rule.h \ + expr.h diff --git a/include/libnftables/chain.h b/include/libnftables/chain.h new file mode 100644 index 0000000..4325fad --- /dev/null +++ b/include/libnftables/chain.h @@ -0,0 +1,66 @@ +#ifndef _CHAIN_H_ +#define _CHAIN_H_ + +#include <stdint.h> + +#ifdef __cplusplus +extern "C" { +#endif + +struct nft_chain; + +struct nft_chain *nft_chain_alloc(void); +void nft_chain_free(struct nft_chain *); + +enum { + NFT_CHAIN_ATTR_NAME = 0, + NFT_CHAIN_ATTR_FAMILY, + NFT_CHAIN_ATTR_TABLE, + NFT_CHAIN_ATTR_HOOKNUM, + NFT_CHAIN_ATTR_PRIO = 4, + NFT_CHAIN_ATTR_POLICY, + NFT_CHAIN_ATTR_USE, + NFT_CHAIN_ATTR_BYTES, + NFT_CHAIN_ATTR_PACKETS = 8, +}; + +void nft_chain_attr_set(struct nft_chain *t, uint16_t attr, void *data); +void nft_chain_attr_set_u32(struct nft_chain *t, uint16_t attr, uint32_t data); +void nft_chain_attr_set_s32(struct nft_chain *t, uint16_t attr, int32_t data); +void nft_chain_attr_set_u64(struct nft_chain *t, uint16_t attr, uint64_t data); + +void *nft_chain_attr_get(struct nft_chain *c, uint16_t attr); +const char *nft_chain_attr_get_str(struct nft_chain *c, uint16_t attr); +uint32_t nft_chain_attr_get_u32(struct nft_chain *c, uint16_t attr); +int32_t nft_chain_attr_get_s32(struct nft_chain *c, uint16_t attr); +uint64_t nft_chain_attr_get_u64(struct nft_chain *c, uint16_t attr); + +void nft_chain_nlmsg_build_payload(struct nlmsghdr *nlh, const struct nft_chain *t); + +enum { + NFT_CHAIN_O_DEFAULT = 0, +}; + +int nft_chain_snprintf(char *buf, size_t size, struct nft_chain *t, uint32_t type, uint32_t flags); + +struct nlmsghdr *nft_chain_nlmsg_build_hdr(char *buf, uint16_t cmd, uint16_t family, uint16_t type, uint32_t seq); +int nft_chain_nlmsg_parse(const struct nlmsghdr *nlh, struct nft_chain *t); + +struct nft_chain_list; + +struct nft_chain_list *nft_chain_list_alloc(void); +void nft_chain_list_free(struct nft_chain_list *list); + +void nft_chain_list_add(struct nft_chain *r, struct nft_chain_list *list); + +struct nft_chain_list_iter; + +struct nft_chain_list_iter *nft_chain_list_iter_create(struct nft_chain_list *l); +struct nft_chain *nft_chain_list_iter_next(struct nft_chain_list_iter *iter); +void nft_chain_list_iter_destroy(struct nft_chain_list_iter *iter); + +#ifdef __cplusplus +} /* extern "C" */ +#endif + +#endif /* _CHAIN_H_ */ diff --git a/include/libnftables/expr.h b/include/libnftables/expr.h new file mode 100644 index 0000000..09cd2e0 --- /dev/null +++ b/include/libnftables/expr.h @@ -0,0 +1,80 @@ +#ifndef _RULE_EXPR_H_ +#define _RULE_EXPR_H_ + +#ifdef __cplusplus +extern "C" { +#endif + +struct nft_rule_expr; + +enum { + NFT_RULE_EXPR_ATTR_NAME = 0, + NFT_RULE_EXPR_ATTR_BASE, +}; + +struct nft_rule_expr *nft_rule_expr_alloc(const char *name); +void nft_rule_expr_free(struct nft_rule_expr *expr); + +void nft_rule_expr_set(struct nft_rule_expr *expr, uint16_t type, const void *data, size_t data_len); +void nft_rule_expr_set_u8(struct nft_rule_expr *expr, uint16_t type, uint8_t data); +void nft_rule_expr_set_u32(struct nft_rule_expr *expr, uint16_t type, uint32_t data); +void nft_rule_expr_set_u64(struct nft_rule_expr *expr, uint16_t type, uint64_t data); +void nft_rule_expr_set_str(struct nft_rule_expr *expr, uint16_t type, char *str); + +const void *nft_rule_expr_get(struct nft_rule_expr *expr, uint16_t type, size_t *data_len); +uint8_t nft_rule_expr_get_u8(struct nft_rule_expr *expr, uint16_t type); +uint32_t nft_rule_expr_get_u32(struct nft_rule_expr *expr, uint16_t type); +uint64_t nft_rule_expr_get_u64(struct nft_rule_expr *expr, uint16_t type); +const char *nft_rule_expr_get_str(struct nft_rule_expr *expr, uint16_t type); + +struct list_head *nft_rule_expr_list_head(struct nft_rule_expr *expr); + +void nft_rule_expr_build_payload(struct nlmsghdr *nlh, struct nft_rule_expr *expr); + +enum { + NFT_EXPR_PAYLOAD_DREG = NFT_RULE_EXPR_ATTR_BASE, + NFT_EXPR_PAYLOAD_BASE, + NFT_EXPR_PAYLOAD_OFFSET, + NFT_EXPR_PAYLOAD_LEN, +}; + +enum { + NFT_EXPR_META_KEY = NFT_RULE_EXPR_ATTR_BASE, + NFT_EXPR_META_DREG, +}; + +enum { + NFT_EXPR_CMP_SREG = NFT_RULE_EXPR_ATTR_BASE, + NFT_EXPR_CMP_OP, + NFT_EXPR_CMP_DATA, +}; + +enum { + NFT_EXPR_IMM_DREG = NFT_RULE_EXPR_ATTR_BASE, + NFT_EXPR_IMM_DATA, + NFT_EXPR_IMM_VERDICT, + NFT_EXPR_IMM_CHAIN, +}; + +enum { + NFT_EXPR_CTR_PACKETS = NFT_RULE_EXPR_ATTR_BASE, + NFT_EXPR_CTR_BYTES, +}; + +enum { + NFT_EXPR_TG_NAME = NFT_RULE_EXPR_ATTR_BASE, + NFT_EXPR_TG_REV, + NFT_EXPR_TG_INFO, +}; + +enum { + NFT_EXPR_MT_NAME = NFT_RULE_EXPR_ATTR_BASE, + NFT_EXPR_MT_REV, + NFT_EXPR_MT_INFO, +}; + +#ifdef __cplusplus +} /* extern "C" */ +#endif + +#endif diff --git a/include/libnftables/rule.h b/include/libnftables/rule.h new file mode 100644 index 0000000..a75d08e --- /dev/null +++ b/include/libnftables/rule.h @@ -0,0 +1,65 @@ +#ifndef _RULE_H_ +#define _RULE_H_ + +#include <stdint.h> + +#ifdef __cplusplus +extern "C" { +#endif + +struct nft_rule; +struct nft_rule_expr; + +struct nft_rule *nft_rule_alloc(void); +void nft_rule_free(struct nft_rule *); + +enum { + NFT_RULE_ATTR_FAMILY = 0, + NFT_RULE_ATTR_TABLE, + NFT_RULE_ATTR_CHAIN, + NFT_RULE_ATTR_HANDLE, +}; + +void nft_rule_attr_set(struct nft_rule *r, uint16_t attr, void *data); +void nft_rule_attr_set_u16(struct nft_rule *r, uint16_t attr, uint16_t val); +void nft_rule_attr_set_str(struct nft_rule *r, uint16_t attr, char *str); + +void *nft_rule_attr_get(struct nft_rule *r, uint16_t attr); +const char *nft_rule_attr_get_str(struct nft_rule *r, uint16_t attr); +uint16_t nft_rule_attr_get_u16(struct nft_rule *r, uint16_t attr); + +void nft_rule_add_expr(struct nft_rule *r, struct nft_rule_expr *expr); + +void nft_rule_nlmsg_build_payload(struct nlmsghdr *nlh, struct nft_rule *t); + +enum { + NFT_RULE_O_DEFAULT = 0, +}; + +int nft_rule_snprintf(char *buf, size_t size, struct nft_rule *t, uint32_t type, uint32_t flags); + +struct nlmsghdr *nft_rule_nlmsg_build_hdr(char *buf, uint16_t cmd, uint16_t family, uint16_t type, uint32_t seq); +int nft_rule_nlmsg_parse(const struct nlmsghdr *nlh, struct nft_rule *t); + +struct nft_rule_expr_iter; + +struct nft_rule_expr_iter *nft_rule_expr_iter_create(struct nft_rule *r); +struct nft_rule_expr *nft_rule_expr_iter_next(struct nft_rule_expr_iter *iter); +void nft_rule_expr_iter_destroy(struct nft_rule_expr_iter *iter); + +struct nft_rule_list *nft_rule_list_alloc(void); +void nft_rule_list_free(struct nft_rule_list *list); +void nft_rule_list_add(struct nft_rule *r, struct nft_rule_list *list); + +struct nft_rule_list_iter; + +struct nft_rule_list_iter *nft_rule_list_iter_create(struct nft_rule_list *l); +struct nft_rule *nft_rule_list_iter_cur(struct nft_rule_list_iter *iter); +struct nft_rule *nft_rule_list_iter_next(struct nft_rule_list_iter *iter); +void nft_rule_list_iter_destroy(struct nft_rule_list_iter *iter); + +#ifdef __cplusplus +} /* extern "C" */ +#endif + +#endif /* _RULE_H_ */ diff --git a/include/libnftables/table.h b/include/libnftables/table.h new file mode 100644 index 0000000..de34c42 --- /dev/null +++ b/include/libnftables/table.h @@ -0,0 +1,51 @@ +#ifndef _TABLE_H_ +#define _TABLE_H_ + +#include <stdint.h> + +#ifdef __cplusplus +extern "C" { +#endif + +struct nft_table; + +struct nft_table *nft_table_alloc(void); +void nft_table_free(struct nft_table *); + +enum { + NFT_TABLE_ATTR_NAME = 0, + NFT_TABLE_ATTR_FAMILY, +}; + +void nft_table_attr_set(struct nft_table *t, uint16_t attr, void *data); +const void *nft_table_attr_get(struct nft_table *t, uint16_t attr); + +void nft_table_nlmsg_build_payload(struct nlmsghdr *nlh, const struct nft_table *t); + +enum { + NFT_TABLE_O_DEFAULT = 0, +}; + +int nft_table_snprintf(char *buf, size_t size, struct nft_table *t, uint32_t type, uint32_t flags); + +struct nlmsghdr *nft_table_nlmsg_build_hdr(char *buf, uint16_t cmd, uint16_t family, uint16_t type, uint32_t seq); +int nft_table_nlmsg_parse(const struct nlmsghdr *nlh, struct nft_table *t); + +struct nft_table_list; + +struct nft_table_list *nft_table_list_alloc(void); +void nft_table_list_free(struct nft_table_list *list); + +void nft_table_list_add(struct nft_table *r, struct nft_table_list *list); + +struct nft_table_list_iter; + +struct nft_table_list_iter *nft_table_list_iter_create(struct nft_table_list *l); +struct nft_table *nft_table_list_iter_next(struct nft_table_list_iter *iter); +void nft_table_list_iter_destroy(struct nft_table_list_iter *iter); + +#ifdef __cplusplus +} /* extern "C" */ +#endif + +#endif /* _TABLE_H_ */ diff --git a/include/linux/Makefile.am b/include/linux/Makefile.am new file mode 100644 index 0000000..38eb109 --- /dev/null +++ b/include/linux/Makefile.am @@ -0,0 +1 @@ +SUBDIRS = netfilter diff --git a/include/linux/netfilter/Makefile.am b/include/linux/netfilter/Makefile.am new file mode 100644 index 0000000..51fb1ae --- /dev/null +++ b/include/linux/netfilter/Makefile.am @@ -0,0 +1 @@ +noinst_HEADERS = nfnetlink.h nf_tables.h diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h new file mode 100644 index 0000000..791072b --- /dev/null +++ b/include/linux/netfilter/nf_tables.h @@ -0,0 +1,421 @@ +#ifndef _LINUX_NF_TABLES_H +#define _LINUX_NF_TABLES_H + +enum nft_registers { + NFT_REG_VERDICT, + NFT_REG_1, + NFT_REG_2, + NFT_REG_3, + NFT_REG_4, + __NFT_REG_MAX +}; +#define NFT_REG_MAX (__NFT_REG_MAX - 1) + +enum nft_verdicts { + NFT_CONTINUE = -1, + NFT_BREAK = -2, + NFT_JUMP = -3, + NFT_GOTO = -4, + NFT_RETURN = -5, +}; + +enum nf_tables_msg_types { + NFT_MSG_NEWTABLE, + NFT_MSG_GETTABLE, + NFT_MSG_DELTABLE, + NFT_MSG_NEWCHAIN, + NFT_MSG_GETCHAIN, + NFT_MSG_DELCHAIN, + NFT_MSG_NEWRULE, + NFT_MSG_GETRULE, + NFT_MSG_DELRULE, + NFT_MSG_NEWSET, + NFT_MSG_GETSET, + NFT_MSG_DELSET, + NFT_MSG_NEWSETELEM, + NFT_MSG_GETSETELEM, + NFT_MSG_DELSETELEM, + NFT_MSG_MAX, +}; + +enum nft_list_attributes { + NFTA_LIST_UNPEC, + NFTA_LIST_ELEM, + __NFTA_LIST_MAX +}; +#define NFTA_LIST_MAX (__NFTA_LIST_MAX - 1) + +enum nft_hook_attributes { + NFTA_HOOK_UNSPEC, + NFTA_HOOK_HOOKNUM, + NFTA_HOOK_PRIORITY, + __NFTA_HOOK_MAX +}; +#define NFTA_HOOK_MAX (__NFTA_HOOK_MAX - 1) + +enum nft_table_attributes { + NFTA_TABLE_UNSPEC, + NFTA_TABLE_NAME, + __NFTA_TABLE_MAX +}; +#define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1) + +enum nft_chain_attributes { + NFTA_CHAIN_UNSPEC, + NFTA_CHAIN_TABLE, + NFTA_CHAIN_NAME, + NFTA_CHAIN_HOOK, + NFTA_CHAIN_POLICY, + NFTA_CHAIN_USE, + NFTA_CHAIN_COUNTERS, + __NFTA_CHAIN_MAX +}; +#define NFTA_CHAIN_MAX (__NFTA_CHAIN_MAX - 1) + +enum nft_rule_attributes { + NFTA_RULE_UNSPEC, + NFTA_RULE_TABLE, + NFTA_RULE_CHAIN, + NFTA_RULE_HANDLE, + NFTA_RULE_EXPRESSIONS, + __NFTA_RULE_MAX +}; +#define NFTA_RULE_MAX (__NFTA_RULE_MAX - 1) + +/** + * enum nft_set_flags - nf_tables set flags + * + * @NFT_SET_ANONYMOUS: name allocation, automatic cleanup on unlink + * @NFT_SET_CONSTANT: set contents may not change while bound + * @NFT_SET_INTERVAL: set contains intervals + * @NFT_SET_MAP: set is used as a dictionary + */ +enum nft_set_flags { + NFT_SET_ANONYMOUS = 0x1, + NFT_SET_CONSTANT = 0x2, + NFT_SET_INTERVAL = 0x4, + NFT_SET_MAP = 0x8, +}; + +/** + * enum nft_set_attributes - nf_tables set netlink attributes + * + * @NFTA_SET_TABLE: table name (NLA_STRING) + * @NFTA_SET_NAME: set name (NLA_STRING) + * @NFTA_SET_FLAGS: bitmask of enum nft_set_flags (NLA_U32) + * @NFTA_SET_KEY_TYPE: key data type, informational purpose only (NLA_U32) + * @NFTA_SET_KEY_LEN: key data length (NLA_U32) + * @NFTA_SET_DATA_TYPE: mapping data type (NLA_U32) + * @NFTA_SET_DATA_LEN: mapping data length (NLA_U32) + */ +enum nft_set_attributes { + NFTA_SET_UNSPEC, + NFTA_SET_TABLE, + NFTA_SET_NAME, + NFTA_SET_FLAGS, + NFTA_SET_KEY_TYPE, + NFTA_SET_KEY_LEN, + NFTA_SET_DATA_TYPE, + NFTA_SET_DATA_LEN, + __NFTA_SET_MAX +}; +#define NFTA_SET_MAX (__NFTA_SET_MAX - 1) + +/** + * enum nft_set_elem_flags - nf_tables set element flags + * + * @NFT_SET_ELEM_INTERVAL_END: element ends the previous interval + */ +enum nft_set_elem_flags { + NFT_SET_ELEM_INTERVAL_END = 0x1, +}; + +/** + * enum nft_set_elem_attributes - nf_tables set element netlink attributes + * + * @NFTA_SET_ELEM_KEY: key value (NLA_NESTED: nft_data) + * @NFTA_SET_ELEM_DATA: data value of mapping (NLA_NESTED: nft_data_attributes) + * @NFTA_SET_ELEM_FLAGS: bitmask of nft_set_elem_flags (NLA_U32) + */ +enum nft_set_elem_attributes { + NFTA_SET_ELEM_UNSPEC, + NFTA_SET_ELEM_KEY, + NFTA_SET_ELEM_DATA, + NFTA_SET_ELEM_FLAGS, + __NFTA_SET_ELEM_MAX +}; +#define NFTA_SET_ELEM_MAX (__NFTA_SET_ELEM_MAX - 1) + +/** + * enum nft_set_elem_list_attributes - nf_tables set element list netlink attributes + * + * @NFTA_SET_ELEM_LIST_TABLE: table of the set to be changed (NLA_STRING) + * @NFTA_SET_ELEM_LIST_SET: name of the set to be changed (NLA_STRING) + * @NFTA_SET_ELEM_LIST_ELEMENTS: list of set elements (NLA_NESTED: nft_set_elem_attributes) + */ +enum nft_set_elem_list_attributes { + NFTA_SET_ELEM_LIST_UNSPEC, + NFTA_SET_ELEM_LIST_TABLE, + NFTA_SET_ELEM_LIST_SET, + NFTA_SET_ELEM_LIST_ELEMENTS, + __NFTA_SET_ELEM_LIST_MAX +}; +#define NFTA_SET_ELEM_LIST_MAX (__NFTA_SET_ELEM_LIST_MAX - 1) + +/** + * enum nft_data_types - nf_tables data types + * + * @NFT_DATA_VALUE: generic data + * @NFT_DATA_VERDICT: netfilter verdict + * + * The type of data is usually determined by the kernel directly and is not + * explicitly specified by userspace. The only difference are sets, where + * userspace specifies the key and mapping data types. + * + * The values 0xffffff00-0xffffffff are reserved for internally used types. + * The remaining range can be freely used by userspace to encode types, all + * values are equivalent to NFT_DATA_VALUE. + */ +enum nft_data_types { + NFT_DATA_VALUE, + NFT_DATA_VERDICT = 0xffffff00U, +}; + +#define NFT_DATA_RESERVED_MASK 0xffffff00U + +enum nft_data_attributes { + NFTA_DATA_UNSPEC, + NFTA_DATA_VALUE, + NFTA_DATA_VERDICT, + __NFTA_DATA_MAX +}; +#define NFTA_DATA_MAX (__NFTA_DATA_MAX - 1) + +enum nft_verdict_attributes { + NFTA_VERDICT_UNSPEC, + NFTA_VERDICT_CODE, + NFTA_VERDICT_CHAIN, + __NFTA_VERDICT_MAX +}; +#define NFTA_VERDICT_MAX (__NFTA_VERDICT_MAX - 1) + +enum nft_expr_attributes { + NFTA_EXPR_UNSPEC, + NFTA_EXPR_NAME, + NFTA_EXPR_DATA, + __NFTA_EXPR_MAX +}; +#define NFTA_EXPR_MAX (__NFTA_EXPR_MAX - 1) + +enum nft_immediate_attributes { + NFTA_IMMEDIATE_UNSPEC, + NFTA_IMMEDIATE_DREG, + NFTA_IMMEDIATE_DATA, + __NFTA_IMMEDIATE_MAX +}; +#define NFTA_IMMEDIATE_MAX (__NFTA_IMMEDIATE_MAX - 1) + +enum nft_bitwise_attributes { + NFTA_BITWISE_UNSPEC, + NFTA_BITWISE_SREG, + NFTA_BITWISE_DREG, + NFTA_BITWISE_LEN, + NFTA_BITWISE_MASK, + NFTA_BITWISE_XOR, + __NFTA_BITWISE_MAX +}; +#define NFTA_BITWISE_MAX (__NFTA_BITWISE_MAX - 1) + +enum nft_byteorder_ops { + NFT_BYTEORDER_NTOH, + NFT_BYTEORDER_HTON, +}; + +enum nft_byteorder_attributes { + NFTA_BYTEORDER_UNSPEC, + NFTA_BYTEORDER_SREG, + NFTA_BYTEORDER_DREG, + NFTA_BYTEORDER_OP, + NFTA_BYTEORDER_LEN, + NFTA_BYTEORDER_SIZE, + __NFTA_BYTEORDER_MAX +}; +#define NFTA_BYTEORDER_MAX (__NFTA_BYTEORDER_MAX - 1) + +enum nft_cmp_ops { + NFT_CMP_EQ, + NFT_CMP_NEQ, + NFT_CMP_LT, + NFT_CMP_LTE, + NFT_CMP_GT, + NFT_CMP_GTE, +}; + +enum nft_cmp_attributes { + NFTA_CMP_UNSPEC, + NFTA_CMP_SREG, + NFTA_CMP_OP, + NFTA_CMP_DATA, + __NFTA_CMP_MAX +}; +#define NFTA_CMP_MAX (__NFTA_CMP_MAX - 1) + +enum nft_lookup_attributes { + NFTA_LOOKUP_UNSPEC, + NFTA_LOOKUP_SET, + NFTA_LOOKUP_SREG, + NFTA_LOOKUP_DREG, + __NFTA_LOOKUP_MAX +}; +#define NFTA_LOOKUP_MAX (__NFTA_LOOKUP_MAX - 1) + +enum nft_payload_bases { + NFT_PAYLOAD_LL_HEADER, + NFT_PAYLOAD_NETWORK_HEADER, + NFT_PAYLOAD_TRANSPORT_HEADER, +}; + +enum nft_payload_attributes { + NFTA_PAYLOAD_UNSPEC, + NFTA_PAYLOAD_DREG, + NFTA_PAYLOAD_BASE, + NFTA_PAYLOAD_OFFSET, + NFTA_PAYLOAD_LEN, + __NFTA_PAYLOAD_MAX +}; +#define NFTA_PAYLOAD_MAX (__NFTA_PAYLOAD_MAX - 1) + +enum nft_exthdr_attributes { + NFTA_EXTHDR_UNSPEC, + NFTA_EXTHDR_DREG, + NFTA_EXTHDR_TYPE, + NFTA_EXTHDR_OFFSET, + NFTA_EXTHDR_LEN, + __NFTA_EXTHDR_MAX +}; +#define NFTA_EXTHDR_MAX (__NFTA_EXTHDR_MAX - 1) + +enum nft_meta_keys { + NFT_META_LEN, + NFT_META_PROTOCOL, + NFT_META_PRIORITY, + NFT_META_MARK, + NFT_META_IIF, + NFT_META_OIF, + NFT_META_IIFNAME, + NFT_META_OIFNAME, + NFT_META_IIFTYPE, + NFT_META_OIFTYPE, + NFT_META_SKUID, + NFT_META_SKGID, + NFT_META_NFTRACE, + NFT_META_RTCLASSID, + NFT_META_SECMARK, +}; + +enum nft_meta_attributes { + NFTA_META_UNSPEC, + NFTA_META_DREG, + NFTA_META_KEY, + __NFTA_META_MAX +}; +#define NFTA_META_MAX (__NFTA_META_MAX - 1) + +enum nft_ct_keys { + NFT_CT_STATE, + NFT_CT_DIRECTION, + NFT_CT_STATUS, + NFT_CT_MARK, + NFT_CT_SECMARK, + NFT_CT_EXPIRATION, + NFT_CT_HELPER, + NFT_CT_PROTOCOL, + NFT_CT_SRC, + NFT_CT_DST, + NFT_CT_PROTO_SRC, + NFT_CT_PROTO_DST, +}; + +enum nft_ct_attributes { + NFTA_CT_UNSPEC, + NFTA_CT_DREG, + NFTA_CT_KEY, + NFTA_CT_DIRECTION, + __NFTA_CT_MAX +}; +#define NFTA_CT_MAX (__NFTA_CT_MAX - 1) + +enum nft_limit_attributes { + NFTA_LIMIT_UNSPEC, + NFTA_LIMIT_RATE, + NFTA_LIMIT_DEPTH, + __NFTA_LIMIT_MAX +}; +#define NFTA_LIMIT_MAX (__NFTA_LIMIT_MAX - 1) + +enum nft_counter_attributes { + NFTA_COUNTER_UNSPEC, + NFTA_COUNTER_BYTES, + NFTA_COUNTER_PACKETS, + __NFTA_COUNTER_MAX +}; +#define NFTA_COUNTER_MAX (__NFTA_COUNTER_MAX - 1) + +enum nft_log_attributes { + NFTA_LOG_UNSPEC, + NFTA_LOG_GROUP, + NFTA_LOG_PREFIX, + NFTA_LOG_SNAPLEN, + NFTA_LOG_QTHRESHOLD, + __NFTA_LOG_MAX +}; +#define NFTA_LOG_MAX (__NFTA_LOG_MAX - 1) + +enum nft_reject_types { + NFT_REJECT_ICMP_UNREACH, + NFT_REJECT_TCP_RST, +}; + +enum nft_reject_attributes { + NFTA_REJECT_UNSPEC, + NFTA_REJECT_TYPE, + NFTA_REJECT_ICMP_CODE, + __NFTA_REJECT_MAX +}; +#define NFTA_REJECT_MAX (__NFTA_REJECT_MAX - 1) + +enum nft_nat_types { + NFT_NAT_SNAT, + NFT_NAT_DNAT, +}; + +enum nft_nat_attributes { + NFTA_NAT_UNSPEC, + NFTA_NAT_TYPE, + NFTA_NAT_ADDR_MIN, + NFTA_NAT_ADDR_MAX, + NFTA_NAT_PROTO_MIN, + NFTA_NAT_PROTO_MAX, + __NFTA_NAT_MAX +}; +#define NFTA_NAT_MAX (__NFTA_NAT_MAX - 1) + +enum nft_target_attributes { + NFTA_TARGET_UNSPEC, + NFTA_TARGET_NAME, + NFTA_TARGET_REV, + NFTA_TARGET_INFO, + __NFTA_TARGET_MAX +}; +#define NFTA_TARGET_MAX (__NFTA_TARGET_MAX - 1) + +enum nft_match_attributes { + NFTA_MATCH_UNSPEC, + NFTA_MATCH_NAME, + NFTA_MATCH_REV, + NFTA_MATCH_INFO, + __NFTA_MATCH_MAX +}; +#define NFTA_MATCH_MAX (__NFTA_MATCH_MAX - 1) + +#endif /* _LINUX_NF_TABLES_H */ diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h new file mode 100644 index 0000000..0d2e4fb --- /dev/null +++ b/include/linux/netfilter/nfnetlink.h @@ -0,0 +1,99 @@ +#ifndef _NFNETLINK_H +#define _NFNETLINK_H +#include <linux/types.h> +#include <linux/netfilter/nfnetlink_compat.h> + +enum nfnetlink_groups { + NFNLGRP_NONE, +#define NFNLGRP_NONE NFNLGRP_NONE + NFNLGRP_CONNTRACK_NEW, +#define NFNLGRP_CONNTRACK_NEW NFNLGRP_CONNTRACK_NEW + NFNLGRP_CONNTRACK_UPDATE, +#define NFNLGRP_CONNTRACK_UPDATE NFNLGRP_CONNTRACK_UPDATE + NFNLGRP_CONNTRACK_DESTROY, +#define NFNLGRP_CONNTRACK_DESTROY NFNLGRP_CONNTRACK_DESTROY + NFNLGRP_CONNTRACK_EXP_NEW, +#define NFNLGRP_CONNTRACK_EXP_NEW NFNLGRP_CONNTRACK_EXP_NEW + NFNLGRP_CONNTRACK_EXP_UPDATE, +#define NFNLGRP_CONNTRACK_EXP_UPDATE NFNLGRP_CONNTRACK_EXP_UPDATE + NFNLGRP_CONNTRACK_EXP_DESTROY, +#define NFNLGRP_CONNTRACK_EXP_DESTROY NFNLGRP_CONNTRACK_EXP_DESTROY + NFNLGRP_NFTABLES, +#define NFNLGRP_NFTABLES NFNLGRP_NFTABLES + __NFNLGRP_MAX, +}; +#define NFNLGRP_MAX (__NFNLGRP_MAX - 1) + +/* General form of address family dependent message. + */ +struct nfgenmsg { + __u8 nfgen_family; /* AF_xxx */ + __u8 version; /* nfnetlink version */ + __be16 res_id; /* resource id */ +}; + +#define NFNETLINK_V0 0 + +/* netfilter netlink message types are split in two pieces: + * 8 bit subsystem, 8bit operation. + */ + +#define NFNL_SUBSYS_ID(x) ((x & 0xff00) >> 8) +#define NFNL_MSG_TYPE(x) (x & 0x00ff) + +/* No enum here, otherwise __stringify() trick of MODULE_ALIAS_NFNL_SUBSYS() + * won't work anymore */ +#define NFNL_SUBSYS_NONE 0 +#define NFNL_SUBSYS_CTNETLINK 1 +#define NFNL_SUBSYS_CTNETLINK_EXP 2 +#define NFNL_SUBSYS_QUEUE 3 +#define NFNL_SUBSYS_ULOG 4 +#define NFNL_SUBSYS_OSF 5 +#define NFNL_SUBSYS_IPSET 6 +#define NFNL_SUBSYS_ACCT 7 +#define NFNL_SUBSYS_CTNETLINK_TIMEOUT 8 +#define NFNL_SUBSYS_CTHELPER 9 +#define NFNL_SUBSYS_NFTABLES 10 +#define NFNL_SUBSYS_COUNT 11 + +#ifdef __KERNEL__ + +#include <linux/netlink.h> +#include <linux/capability.h> +#include <net/netlink.h> + +struct nfnl_callback { + int (*call)(struct sock *nl, struct sk_buff *skb, + const struct nlmsghdr *nlh, + const struct nlattr * const cda[]); + int (*call_rcu)(struct sock *nl, struct sk_buff *skb, + const struct nlmsghdr *nlh, + const struct nlattr * const cda[]); + const struct nla_policy *policy; /* netlink attribute policy */ + const u_int16_t attr_count; /* number of nlattr's */ +}; + +struct nfnetlink_subsystem { + const char *name; + __u8 subsys_id; /* nfnetlink subsystem ID */ + __u8 cb_count; /* number of callbacks */ + const struct nfnl_callback *cb; /* callback for individual types */ +}; + +extern int nfnetlink_subsys_register(const struct nfnetlink_subsystem *n); +extern int nfnetlink_subsys_unregister(const struct nfnetlink_subsystem *n); + +extern int nfnetlink_has_listeners(struct net *net, unsigned int group); +extern int nfnetlink_send(struct sk_buff *skb, struct net *net, u32 pid, unsigned int group, + int echo, gfp_t flags); +extern int nfnetlink_set_err(struct net *net, u32 pid, u32 group, int error); +extern int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u_int32_t pid, int flags); + +extern void nfnl_lock(void); +extern void nfnl_unlock(void); + +#define MODULE_ALIAS_NFNL_SUBSYS(subsys) \ + MODULE_ALIAS("nfnetlink-subsys-" __stringify(subsys)) + +#endif /* __KERNEL__ */ +#endif /* _NFNETLINK_H */ diff --git a/include/linux_list.h b/include/linux_list.h new file mode 100644 index 0000000..de182a4 --- /dev/null +++ b/include/linux_list.h @@ -0,0 +1,727 @@ +#ifndef _LINUX_LIST_H +#define _LINUX_LIST_H + +#include <stddef.h> + +#undef offsetof +#define offsetof(TYPE, MEMBER) ((size_t) &((TYPE *)0)->MEMBER) + +/** + * container_of - cast a member of a structure out to the containing structure + * + * @ptr: the pointer to the member. + * @type: the type of the container struct this is embedded in. + * @member: the name of the member within the struct. + * + */ +#define container_of(ptr, type, member) ({ \ + typeof( ((type *)0)->member ) *__mptr = (ptr); \ + (type *)( (char *)__mptr - offsetof(type,member) );}) + +/* + * Check at compile time that something is of a particular type. + * Always evaluates to 1 so you may use it easily in comparisons. + */ +#define typecheck(type,x) \ +({ type __dummy; \ + typeof(x) __dummy2; \ + (void)(&__dummy == &__dummy2); \ + 1; \ +}) + +#define prefetch(x) 1 + +/* empty define to make this work in userspace -HW */ +#ifndef smp_wmb +#define smp_wmb() +#endif + +/* + * These are non-NULL pointers that will result in page faults + * under normal circumstances, used to verify that nobody uses + * non-initialized list entries. + */ +#define LIST_POISON1 ((void *) 0x00100100) +#define LIST_POISON2 ((void *) 0x00200200) + +/* + * Simple doubly linked list implementation. + * + * Some of the internal functions ("__xxx") are useful when + * manipulating whole lists rather than single entries, as + * sometimes we already know the next/prev entries and we can + * generate better code by using them directly rather than + * using the generic single-entry routines. + */ + +struct list_head { + struct list_head *next, *prev; +}; + +#define LIST_HEAD_INIT(name) { &(name), &(name) } + +#define LIST_HEAD(name) \ + struct list_head name = LIST_HEAD_INIT(name) + +#define INIT_LIST_HEAD(ptr) do { \ + (ptr)->next = (ptr); (ptr)->prev = (ptr); \ +} while (0) + +/* + * Insert a new entry between two known consecutive entries. + * + * This is only for internal list manipulation where we know + * the prev/next entries already! + */ +static inline void __list_add(struct list_head *new, + struct list_head *prev, + struct list_head *next) +{ + next->prev = new; + new->next = next; + new->prev = prev; + prev->next = new; +} + +/** + * list_add - add a new entry + * @new: new entry to be added + * @head: list head to add it after + * + * Insert a new entry after the specified head. + * This is good for implementing stacks. + */ +static inline void list_add(struct list_head *new, struct list_head *head) +{ + __list_add(new, head, head->next); +} + +/** + * list_add_tail - add a new entry + * @new: new entry to be added + * @head: list head to add it before + * + * Insert a new entry before the specified head. + * This is useful for implementing queues. + */ +static inline void list_add_tail(struct list_head *new, struct list_head *head) +{ + __list_add(new, head->prev, head); +} + +/* + * Insert a new entry between two known consecutive entries. + * + * This is only for internal list manipulation where we know + * the prev/next entries already! + */ +static inline void __list_add_rcu(struct list_head * new, + struct list_head * prev, struct list_head * next) +{ + new->next = next; + new->prev = prev; + smp_wmb(); + next->prev = new; + prev->next = new; +} + +/** + * list_add_rcu - add a new entry to rcu-protected list + * @new: new entry to be added + * @head: list head to add it after + * + * Insert a new entry after the specified head. + * This is good for implementing stacks. + * + * The caller must take whatever precautions are necessary + * (such as holding appropriate locks) to avoid racing + * with another list-mutation primitive, such as list_add_rcu() + * or list_del_rcu(), running on this same list. + * However, it is perfectly legal to run concurrently with + * the _rcu list-traversal primitives, such as + * list_for_each_entry_rcu(). + */ +static inline void list_add_rcu(struct list_head *new, struct list_head *head) +{ + __list_add_rcu(new, head, head->next); +} + +/** + * list_add_tail_rcu - add a new entry to rcu-protected list + * @new: new entry to be added + * @head: list head to add it before + * + * Insert a new entry before the specified head. + * This is useful for implementing queues. + * + * The caller must take whatever precautions are necessary + * (such as holding appropriate locks) to avoid racing + * with another list-mutation primitive, such as list_add_tail_rcu() + * or list_del_rcu(), running on this same list. + * However, it is perfectly legal to run concurrently with + * the _rcu list-traversal primitives, such as + * list_for_each_entry_rcu(). + */ +static inline void list_add_tail_rcu(struct list_head *new, + struct list_head *head) +{ + __list_add_rcu(new, head->prev, head); +} + +/* + * Delete a list entry by making the prev/next entries + * point to each other. + * + * This is only for internal list manipulation where we know + * the prev/next entries already! + */ +static inline void __list_del(struct list_head * prev, struct list_head * next) +{ + next->prev = prev; + prev->next = next; +} + +/** + * list_del - deletes entry from list. + * @entry: the element to delete from the list. + * Note: list_empty on entry does not return true after this, the entry is + * in an undefined state. + */ +static inline void list_del(struct list_head *entry) +{ + __list_del(entry->prev, entry->next); + entry->next = LIST_POISON1; + entry->prev = LIST_POISON2; +} + +/** + * list_del_rcu - deletes entry from list without re-initialization + * @entry: the element to delete from the list. + * + * Note: list_empty on entry does not return true after this, + * the entry is in an undefined state. It is useful for RCU based + * lockfree traversal. + * + * In particular, it means that we can not poison the forward + * pointers that may still be used for walking the list. + * + * The caller must take whatever precautions are necessary + * (such as holding appropriate locks) to avoid racing + * with another list-mutation primitive, such as list_del_rcu() + * or list_add_rcu(), running on this same list. + * However, it is perfectly legal to run concurrently with + * the _rcu list-traversal primitives, such as + * list_for_each_entry_rcu(). + * + * Note that the caller is not permitted to immediately free + * the newly deleted entry. Instead, either synchronize_kernel() + * or call_rcu() must be used to defer freeing until an RCU + * grace period has elapsed. + */ +static inline void list_del_rcu(struct list_head *entry) +{ + __list_del(entry->prev, entry->next); + entry->prev = LIST_POISON2; +} + +/** + * list_del_init - deletes entry from list and reinitialize it. + * @entry: the element to delete from the list. + */ +static inline void list_del_init(struct list_head *entry) +{ + __list_del(entry->prev, entry->next); + INIT_LIST_HEAD(entry); +} + +/** + * list_move - delete from one list and add as another's head + * @list: the entry to move + * @head: the head that will precede our entry + */ +static inline void list_move(struct list_head *list, struct list_head *head) +{ + __list_del(list->prev, list->next); + list_add(list, head); +} + +/** + * list_move_tail - delete from one list and add as another's tail + * @list: the entry to move + * @head: the head that will follow our entry + */ +static inline void list_move_tail(struct list_head *list, + struct list_head *head) +{ + __list_del(list->prev, list->next); + list_add_tail(list, head); +} + +/** + * list_empty - tests whether a list is empty + * @head: the list to test. + */ +static inline int list_empty(const struct list_head *head) +{ + return head->next == head; +} + +/** + * list_empty_careful - tests whether a list is + * empty _and_ checks that no other CPU might be + * in the process of still modifying either member + * + * NOTE: using list_empty_careful() without synchronization + * can only be safe if the only activity that can happen + * to the list entry is list_del_init(). Eg. it cannot be used + * if another CPU could re-list_add() it. + * + * @head: the list to test. + */ +static inline int list_empty_careful(const struct list_head *head) +{ + struct list_head *next = head->next; + return (next == head) && (next == head->prev); +} + +static inline void __list_splice(struct list_head *list, + struct list_head *head) +{ + struct list_head *first = list->next; + struct list_head *last = list->prev; + struct list_head *at = head->next; + + first->prev = head; + head->next = first; + + last->next = at; + at->prev = last; +} + +/** + * list_splice - join two lists + * @list: the new list to add. + * @head: the place to add it in the first list. + */ +static inline void list_splice(struct list_head *list, struct list_head *head) +{ + if (!list_empty(list)) + __list_splice(list, head); +} + +/** + * list_splice_init - join two lists and reinitialise the emptied list. + * @list: the new list to add. + * @head: the place to add it in the first list. + * + * The list at @list is reinitialised + */ +static inline void list_splice_init(struct list_head *list, + struct list_head *head) +{ + if (!list_empty(list)) { + __list_splice(list, head); + INIT_LIST_HEAD(list); + } +} + +/** + * list_entry - get the struct for this entry + * @ptr: the &struct list_head pointer. + * @type: the type of the struct this is embedded in. + * @member: the name of the list_struct within the struct. + */ +#define list_entry(ptr, type, member) \ + container_of(ptr, type, member) + +/** + * list_for_each - iterate over a list + * @pos: the &struct list_head to use as a loop counter. + * @head: the head for your list. + */ +#define list_for_each(pos, head) \ + for (pos = (head)->next, prefetch(pos->next); pos != (head); \ + pos = pos->next, prefetch(pos->next)) + +/** + * __list_for_each - iterate over a list + * @pos: the &struct list_head to use as a loop counter. + * @head: the head for your list. + * + * This variant differs from list_for_each() in that it's the + * simplest possible list iteration code, no prefetching is done. + * Use this for code that knows the list to be very short (empty + * or 1 entry) most of the time. + */ +#define __list_for_each(pos, head) \ + for (pos = (head)->next; pos != (head); pos = pos->next) + +/** + * list_for_each_prev - iterate over a list backwards + * @pos: the &struct list_head to use as a loop counter. + * @head: the head for your list. + */ +#define list_for_each_prev(pos, head) \ + for (pos = (head)->prev, prefetch(pos->prev); pos != (head); \ + pos = pos->prev, prefetch(pos->prev)) + +/** + * list_for_each_safe - iterate over a list safe against removal of list entry + * @pos: the &struct list_head to use as a loop counter. + * @n: another &struct list_head to use as temporary storage + * @head: the head for your list. + */ +#define list_for_each_safe(pos, n, head) \ + for (pos = (head)->next, n = pos->next; pos != (head); \ + pos = n, n = pos->next) + +/** + * list_for_each_entry - iterate over list of given type + * @pos: the type * to use as a loop counter. + * @head: the head for your list. + * @member: the name of the list_struct within the struct. + */ +#define list_for_each_entry(pos, head, member) \ + for (pos = list_entry((head)->next, typeof(*pos), member), \ + prefetch(pos->member.next); \ + &pos->member != (head); \ + pos = list_entry(pos->member.next, typeof(*pos), member), \ + prefetch(pos->member.next)) + +/** + * list_for_each_entry_reverse - iterate backwards over list of given type. + * @pos: the type * to use as a loop counter. + * @head: the head for your list. + * @member: the name of the list_struct within the struct. + */ +#define list_for_each_entry_reverse(pos, head, member) \ + for (pos = list_entry((head)->prev, typeof(*pos), member), \ + prefetch(pos->member.prev); \ + &pos->member != (head); \ + pos = list_entry(pos->member.prev, typeof(*pos), member), \ + prefetch(pos->member.prev)) + +/** + * list_prepare_entry - prepare a pos entry for use as a start point in + * list_for_each_entry_continue + * @pos: the type * to use as a start point + * @head: the head of the list + * @member: the name of the list_struct within the struct. + */ +#define list_prepare_entry(pos, head, member) \ + ((pos) ? : list_entry(head, typeof(*pos), member)) + +/** + * list_for_each_entry_continue - iterate over list of given type + * continuing after existing point + * @pos: the type * to use as a loop counter. + * @head: the head for your list. + * @member: the name of the list_struct within the struct. + */ +#define list_for_each_entry_continue(pos, head, member) \ + for (pos = list_entry(pos->member.next, typeof(*pos), member), \ + prefetch(pos->member.next); \ + &pos->member != (head); \ + pos = list_entry(pos->member.next, typeof(*pos), member), \ + prefetch(pos->member.next)) + +/** + * list_for_each_entry_safe - iterate over list of given type safe against removal of list entry + * @pos: the type * to use as a loop counter. + * @n: another type * to use as temporary storage + * @head: the head for your list. + * @member: the name of the list_struct within the struct. + */ +#define list_for_each_entry_safe(pos, n, head, member) \ + for (pos = list_entry((head)->next, typeof(*pos), member), \ + n = list_entry(pos->member.next, typeof(*pos), member); \ + &pos->member != (head); \ + pos = n, n = list_entry(n->member.next, typeof(*n), member)) + +/** + * list_for_each_rcu - iterate over an rcu-protected list + * @pos: the &struct list_head to use as a loop counter. + * @head: the head for your list. + * + * This list-traversal primitive may safely run concurrently with + * the _rcu list-mutation primitives such as list_add_rcu() + * as long as the traversal is guarded by rcu_read_lock(). + */ +#define list_for_each_rcu(pos, head) \ + for (pos = (head)->next, prefetch(pos->next); pos != (head); \ + pos = pos->next, ({ smp_read_barrier_depends(); 0;}), prefetch(pos->next)) + +#define __list_for_each_rcu(pos, head) \ + for (pos = (head)->next; pos != (head); \ + pos = pos->next, ({ smp_read_barrier_depends(); 0;})) + +/** + * list_for_each_safe_rcu - iterate over an rcu-protected list safe + * against removal of list entry + * @pos: the &struct list_head to use as a loop counter. + * @n: another &struct list_head to use as temporary storage + * @head: the head for your list. + * + * This list-traversal primitive may safely run concurrently with + * the _rcu list-mutation primitives such as list_add_rcu() + * as long as the traversal is guarded by rcu_read_lock(). + */ +#define list_for_each_safe_rcu(pos, n, head) \ + for (pos = (head)->next, n = pos->next; pos != (head); \ + pos = n, ({ smp_read_barrier_depends(); 0;}), n = pos->next) + +/** + * list_for_each_entry_rcu - iterate over rcu list of given type + * @pos: the type * to use as a loop counter. + * @head: the head for your list. + * @member: the name of the list_struct within the struct. + * + * This list-traversal primitive may safely run concurrently with + * the _rcu list-mutation primitives such as list_add_rcu() + * as long as the traversal is guarded by rcu_read_lock(). + */ +#define list_for_each_entry_rcu(pos, head, member) \ + for (pos = list_entry((head)->next, typeof(*pos), member), \ + prefetch(pos->member.next); \ + &pos->member != (head); \ + pos = list_entry(pos->member.next, typeof(*pos), member), \ + ({ smp_read_barrier_depends(); 0;}), \ + prefetch(pos->member.next)) + + +/** + * list_for_each_continue_rcu - iterate over an rcu-protected list + * continuing after existing point. + * @pos: the &struct list_head to use as a loop counter. + * @head: the head for your list. + * + * This list-traversal primitive may safely run concurrently with + * the _rcu list-mutation primitives such as list_add_rcu() + * as long as the traversal is guarded by rcu_read_lock(). + */ +#define list_for_each_continue_rcu(pos, head) \ + for ((pos) = (pos)->next, prefetch((pos)->next); (pos) != (head); \ + (pos) = (pos)->next, ({ smp_read_barrier_depends(); 0;}), prefetch((pos)->next)) + +/* + * Double linked lists with a single pointer list head. + * Mostly useful for hash tables where the two pointer list head is + * too wasteful. + * You lose the ability to access the tail in O(1). + */ + +struct hlist_head { + struct hlist_node *first; +}; + +struct hlist_node { + struct hlist_node *next, **pprev; +}; + +#define HLIST_HEAD_INIT { .first = NULL } +#define HLIST_HEAD(name) struct hlist_head name = { .first = NULL } +#define INIT_HLIST_HEAD(ptr) ((ptr)->first = NULL) +#define INIT_HLIST_NODE(ptr) ((ptr)->next = NULL, (ptr)->pprev = NULL) + +static inline int hlist_unhashed(const struct hlist_node *h) +{ + return !h->pprev; +} + +static inline int hlist_empty(const struct hlist_head *h) +{ + return !h->first; +} + +static inline void __hlist_del(struct hlist_node *n) +{ + struct hlist_node *next = n->next; + struct hlist_node **pprev = n->pprev; + *pprev = next; + if (next) + next->pprev = pprev; +} + +static inline void hlist_del(struct hlist_node *n) +{ + __hlist_del(n); + n->next = LIST_POISON1; + n->pprev = LIST_POISON2; +} + +/** + * hlist_del_rcu - deletes entry from hash list without re-initialization + * @n: the element to delete from the hash list. + * + * Note: list_unhashed() on entry does not return true after this, + * the entry is in an undefined state. It is useful for RCU based + * lockfree traversal. + * + * In particular, it means that we can not poison the forward + * pointers that may still be used for walking the hash list. + * + * The caller must take whatever precautions are necessary + * (such as holding appropriate locks) to avoid racing + * with another list-mutation primitive, such as hlist_add_head_rcu() + * or hlist_del_rcu(), running on this same list. + * However, it is perfectly legal to run concurrently with + * the _rcu list-traversal primitives, such as + * hlist_for_each_entry(). + */ +static inline void hlist_del_rcu(struct hlist_node *n) +{ + __hlist_del(n); + n->pprev = LIST_POISON2; +} + +static inline void hlist_del_init(struct hlist_node *n) +{ + if (n->pprev) { + __hlist_del(n); + INIT_HLIST_NODE(n); + } +} + +#define hlist_del_rcu_init hlist_del_init + +static inline void hlist_add_head(struct hlist_node *n, struct hlist_head *h) +{ + struct hlist_node *first = h->first; + n->next = first; + if (first) + first->pprev = &n->next; + h->first = n; + n->pprev = &h->first; +} + + +/** + * hlist_add_head_rcu - adds the specified element to the specified hlist, + * while permitting racing traversals. + * @n: the element to add to the hash list. + * @h: the list to add to. + * + * The caller must take whatever precautions are necessary + * (such as holding appropriate locks) to avoid racing + * with another list-mutation primitive, such as hlist_add_head_rcu() + * or hlist_del_rcu(), running on this same list. + * However, it is perfectly legal to run concurrently with + * the _rcu list-traversal primitives, such as + * hlist_for_each_entry(), but only if smp_read_barrier_depends() + * is used to prevent memory-consistency problems on Alpha CPUs. + * Regardless of the type of CPU, the list-traversal primitive + * must be guarded by rcu_read_lock(). + * + * OK, so why don't we have an hlist_for_each_entry_rcu()??? + */ +static inline void hlist_add_head_rcu(struct hlist_node *n, + struct hlist_head *h) +{ + struct hlist_node *first = h->first; + n->next = first; + n->pprev = &h->first; + smp_wmb(); + if (first) + first->pprev = &n->next; + h->first = n; +} + +/* next must be != NULL */ +static inline void hlist_add_before(struct hlist_node *n, + struct hlist_node *next) +{ + n->pprev = next->pprev; + n->next = next; + next->pprev = &n->next; + *(n->pprev) = n; +} + +static inline void hlist_add_after(struct hlist_node *n, + struct hlist_node *next) +{ + next->next = n->next; + n->next = next; + next->pprev = &n->next; + + if(next->next) + next->next->pprev = &next->next; +} + +#define hlist_entry(ptr, type, member) container_of(ptr,type,member) + +#define hlist_for_each(pos, head) \ + for (pos = (head)->first; pos && ({ prefetch(pos->next); 1; }); \ + pos = pos->next) + +#define hlist_for_each_safe(pos, n, head) \ + for (pos = (head)->first; pos && ({ n = pos->next; 1; }); \ + pos = n) + +/** + * hlist_for_each_entry - iterate over list of given type + * @tpos: the type * to use as a loop counter. + * @pos: the &struct hlist_node to use as a loop counter. + * @head: the head for your list. + * @member: the name of the hlist_node within the struct. + */ +#define hlist_for_each_entry(tpos, pos, head, member) \ + for (pos = (head)->first; \ + pos && ({ prefetch(pos->next); 1;}) && \ + ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1;}); \ + pos = pos->next) + +/** + * hlist_for_each_entry_continue - iterate over a hlist continuing after existing point + * @tpos: the type * to use as a loop counter. + * @pos: the &struct hlist_node to use as a loop counter. + * @member: the name of the hlist_node within the struct. + */ +#define hlist_for_each_entry_continue(tpos, pos, member) \ + for (pos = (pos)->next; \ + pos && ({ prefetch(pos->next); 1;}) && \ + ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1;}); \ + pos = pos->next) + +/** + * hlist_for_each_entry_from - iterate over a hlist continuing from existing point + * @tpos: the type * to use as a loop counter. + * @pos: the &struct hlist_node to use as a loop counter. + * @member: the name of the hlist_node within the struct. + */ +#define hlist_for_each_entry_from(tpos, pos, member) \ + for (; pos && ({ prefetch(pos->next); 1;}) && \ + ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1;}); \ + pos = pos->next) + +/** + * hlist_for_each_entry_safe - iterate over list of given type safe against removal of list entry + * @tpos: the type * to use as a loop counter. + * @pos: the &struct hlist_node to use as a loop counter. + * @n: another &struct hlist_node to use as temporary storage + * @head: the head for your list. + * @member: the name of the hlist_node within the struct. + */ +#define hlist_for_each_entry_safe(tpos, pos, n, head, member) \ + for (pos = (head)->first; \ + pos && ({ n = pos->next; 1; }) && \ + ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1;}); \ + pos = n) + +/** + * hlist_for_each_entry_rcu - iterate over rcu list of given type + * @pos: the type * to use as a loop counter. + * @pos: the &struct hlist_node to use as a loop counter. + * @head: the head for your list. + * @member: the name of the hlist_node within the struct. + * + * This list-traversal primitive may safely run concurrently with + * the _rcu list-mutation primitives such as hlist_add_rcu() + * as long as the traversal is guarded by rcu_read_lock(). + */ +#define hlist_for_each_entry_rcu(tpos, pos, head, member) \ + for (pos = (head)->first; \ + pos && ({ prefetch(pos->next); 1;}) && \ + ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1;}); \ + pos = pos->next, ({ smp_read_barrier_depends(); 0; }) ) + +#endif diff --git a/libnftables.pc.in b/libnftables.pc.in new file mode 100644 index 0000000..0c6d57e --- /dev/null +++ b/libnftables.pc.in @@ -0,0 +1,15 @@ +# libnftables pkg-config file + +prefix=@prefix@ +exec_prefix=@exec_prefix@ +libdir=@libdir@ +includedir=@includedir@ + +Name: libnftables +Description: Netfilter nf_tables infrastructure library +URL: http://netfilter.org/projects/libnftables/ +Version: @VERSION@ +Requires: +Conflicts: +Libs: -L${libdir} -lnftables +Cflags: -I${includedir} diff --git a/m4/.gitignore b/m4/.gitignore new file mode 100644 index 0000000..64d9bbc --- /dev/null +++ b/m4/.gitignore @@ -0,0 +1,2 @@ +/libtool.m4 +/lt*.m4 diff --git a/m4/gcc4_visibility.m4 b/m4/gcc4_visibility.m4 new file mode 100644 index 0000000..214d3f3 --- /dev/null +++ b/m4/gcc4_visibility.m4 @@ -0,0 +1,21 @@ + +# GCC 4.x -fvisibility=hidden + +AC_DEFUN([CHECK_GCC_FVISIBILITY], [ + AC_LANG_PUSH([C]) + saved_CFLAGS="$CFLAGS" + CFLAGS="$saved_CFLAGS -fvisibility=hidden" + AC_CACHE_CHECK([whether compiler accepts -fvisibility=hidden], + [ac_cv_fvisibility_hidden], AC_COMPILE_IFELSE( + [AC_LANG_SOURCE()], + [ac_cv_fvisibility_hidden=yes], + [ac_cv_fvisibility_hidden=no] + )) + if test "$ac_cv_fvisibility_hidden" = "yes"; then + AC_DEFINE([HAVE_VISIBILITY_HIDDEN], [1], + [True if compiler supports -fvisibility=hidden]) + AC_SUBST([GCC_FVISIBILITY_HIDDEN], [-fvisibility=hidden]) + fi + CFLAGS="$saved_CFLAGS" + AC_LANG_POP([C]) +]) diff --git a/src/Makefile.am b/src/Makefile.am new file mode 100644 index 0000000..b1c1044 --- /dev/null +++ b/src/Makefile.am @@ -0,0 +1,21 @@ +include $(top_srcdir)/Make_global.am +lib_LTLIBRARIES = libnftables.la + +libnftables_la_LIBADD = ${LIBMNL_LIBS} +libnftables_la_LDFLAGS = -Wl,--version-script=$(srcdir)/libnftables.map \ + -version-info $(LIBVERSION) +libnftables_la_SOURCES = table.c \ + chain.c \ + rule.c \ + expr.c \ + expr_ops.c \ + expr/cmp.c \ + expr/counter.c \ + expr/data_reg.c \ + expr/immediate.c \ + expr/match.c \ + expr/meta.c \ + expr/payload.c \ + expr/target.c \ + libnftables.map \ + internal.h diff --git a/src/chain.c b/src/chain.c new file mode 100644 index 0000000..fd95a64 --- /dev/null +++ b/src/chain.c @@ -0,0 +1,484 @@ +/* + * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This code has been sponsored by Sophos Astaro <http://www.sophos.com> + */ +#include "internal.h" + +#include <time.h> +#include <endian.h> +#include <stdint.h> +#include <stdlib.h> +#include <string.h> +#include <netinet/in.h> + +#include <libmnl/libmnl.h> +#include <linux/netfilter/nfnetlink.h> +#include <linux/netfilter/nf_tables.h> + +#include <libnftables/chain.h> + +struct nft_chain { + struct list_head head; + + char *name; + char *table; + uint8_t family; + uint32_t policy; + uint32_t hooknum; + int32_t prio; + uint32_t use; + uint64_t packets; + uint64_t bytes; + uint32_t flags; +}; + +struct nft_chain *nft_chain_alloc(void) +{ + return calloc(1, sizeof(struct nft_chain)); +} +EXPORT_SYMBOL(nft_chain_alloc); + +void nft_chain_free(struct nft_chain *c) +{ + if (c->name != NULL) + free(c->name); + if (c->table != NULL) + free(c->table); + + free(c); +} +EXPORT_SYMBOL(nft_chain_free); + +void nft_chain_attr_set(struct nft_chain *c, uint16_t attr, void *data) +{ + switch(attr) { + case NFT_CHAIN_ATTR_NAME: + if (c->name) + free(c->name); + + c->name = strdup(data); + break; + case NFT_CHAIN_ATTR_TABLE: + if (c->table) + free(c->table); + + c->table = strdup(data); + break; + case NFT_CHAIN_ATTR_HOOKNUM: + memcpy(&c->hooknum, data, sizeof(c->hooknum)); + break; + case NFT_CHAIN_ATTR_PRIO: + memcpy(&c->prio, data, sizeof(c->prio)); + break; + case NFT_CHAIN_ATTR_POLICY: + c->policy = *((uint32_t *)data); + break; + case NFT_CHAIN_ATTR_USE: + /* cannot be set, ignore it */ + return; + case NFT_CHAIN_ATTR_BYTES: + c->bytes = *((uint64_t *)data); + break; + case NFT_CHAIN_ATTR_PACKETS: + c->bytes = *((uint64_t *)data); + break; + default: + return; + } + c->flags |= (1 << attr); +} +EXPORT_SYMBOL(nft_chain_attr_set); + +void nft_chain_attr_set_u32(struct nft_chain *c, uint16_t attr, uint32_t data) +{ + nft_chain_attr_set(c, attr, &data); +} +EXPORT_SYMBOL(nft_chain_attr_set_u32); + +void nft_chain_attr_set_s32(struct nft_chain *c, uint16_t attr, int32_t data) +{ + nft_chain_attr_set(c, attr, &data); +} +EXPORT_SYMBOL(nft_chain_attr_set_s32); + +void nft_chain_attr_set_u64(struct nft_chain *c, uint16_t attr, uint64_t data) +{ + nft_chain_attr_set(c, attr, &data); +} +EXPORT_SYMBOL(nft_chain_attr_set_u64); + +void *nft_chain_attr_get(struct nft_chain *c, uint16_t attr) +{ + switch(attr) { + case NFT_CHAIN_ATTR_NAME: + if (c->flags & (1 << NFT_CHAIN_ATTR_NAME)) + return c->name; + else + return NULL; + break; + case NFT_CHAIN_ATTR_TABLE: + if (c->flags & (1 << NFT_CHAIN_ATTR_TABLE)) + return c->table; + else + return NULL; + case NFT_CHAIN_ATTR_HOOKNUM: + if (c->flags & (1 << NFT_CHAIN_ATTR_HOOKNUM)) + return &c->hooknum; + else + return NULL; + break; + case NFT_CHAIN_ATTR_PRIO: + if (c->flags & (1 << NFT_CHAIN_ATTR_PRIO)) + return &c->prio; + else + return NULL; + break; + case NFT_CHAIN_ATTR_POLICY: + if (c->flags & (1 << NFT_CHAIN_ATTR_POLICY)) + return &c->policy; + else + return NULL; + break; + case NFT_CHAIN_ATTR_USE: + if (c->flags & (1 << NFT_CHAIN_ATTR_USE)) + return &c->use; + else + return NULL; + break; + case NFT_CHAIN_ATTR_BYTES: + if (c->flags & (1 << NFT_CHAIN_ATTR_BYTES)) + return &c->bytes; + else + return NULL; + break; + case NFT_CHAIN_ATTR_PACKETS: + if (c->flags & (1 << NFT_CHAIN_ATTR_PACKETS)) + return &c->packets; + else + return NULL; + break; + default: + return NULL; + } +} +EXPORT_SYMBOL(nft_chain_attr_get); + +const char *nft_chain_attr_get_str(struct nft_chain *c, uint16_t attr) +{ + return nft_chain_attr_get(c, attr); +} +EXPORT_SYMBOL(nft_chain_attr_get_str); + +uint32_t nft_chain_attr_get_u32(struct nft_chain *c, uint16_t attr) +{ + uint32_t *val = nft_chain_attr_get(c, attr); + return val ? *val : 0; +} +EXPORT_SYMBOL(nft_chain_attr_get_u32); + +int32_t nft_chain_attr_get_s32(struct nft_chain *c, uint16_t attr) +{ + int32_t *val = nft_chain_attr_get(c, attr); + return val ? *val : 0; +} +EXPORT_SYMBOL(nft_chain_attr_get_s32); + +uint64_t nft_chain_attr_get_u64(struct nft_chain *c, uint16_t attr) +{ + uint64_t *val = nft_chain_attr_get(c, attr); + return val ? *val : 0; +} +EXPORT_SYMBOL(nft_chain_attr_get_u64); + +struct nlmsghdr * +nft_chain_nlmsg_build_hdr(char *buf, uint16_t cmd, uint16_t family, + uint16_t type, uint32_t seq) +{ + struct nlmsghdr *nlh; + struct nfgenmsg *nfh; + + nlh = mnl_nlmsg_put_header(buf); + nlh->nlmsg_type = (NFNL_SUBSYS_NFTABLES << 8) | cmd; + nlh->nlmsg_flags = NLM_F_REQUEST | type; + nlh->nlmsg_seq = seq; + + nfh = mnl_nlmsg_put_extra_header(nlh, sizeof(struct nfgenmsg)); + nfh->nfgen_family = family; + nfh->version = NFNETLINK_V0; + nfh->res_id = 0; + + return nlh; +} +EXPORT_SYMBOL(nft_chain_nlmsg_build_hdr); + +void nft_chain_nlmsg_build_payload(struct nlmsghdr *nlh, const struct nft_chain *c) +{ + if (c->flags & (1 << NFT_CHAIN_ATTR_TABLE)) + mnl_attr_put_strz(nlh, NFTA_CHAIN_TABLE, c->table); + if (c->flags & (1 << NFT_CHAIN_ATTR_NAME)) + mnl_attr_put_strz(nlh, NFTA_CHAIN_NAME, c->name); + if ((c->flags & (1 << NFT_CHAIN_ATTR_HOOKNUM)) && + (c->flags & (1 << NFT_CHAIN_ATTR_PRIO))) { + struct nlattr *nest; + + nest = mnl_attr_nest_start(nlh, NFTA_CHAIN_HOOK); + mnl_attr_put_u32(nlh, NFTA_HOOK_HOOKNUM, htonl(c->hooknum)); + mnl_attr_put_u32(nlh, NFTA_HOOK_PRIORITY, htonl(c->prio)); + mnl_attr_nest_end(nlh, nest); + } + if (c->flags & (1 << NFT_CHAIN_ATTR_POLICY)) + mnl_attr_put_u32(nlh, NFTA_CHAIN_POLICY, htonl(c->policy)); + if ((c->flags & (1 << NFT_CHAIN_ATTR_PACKETS)) && + (c->flags & (1 << NFT_CHAIN_ATTR_BYTES))) { + struct nlattr *nest; + + nest = mnl_attr_nest_start(nlh, NFTA_CHAIN_COUNTERS); + mnl_attr_put_u64(nlh, NFTA_COUNTER_PACKETS, be64toh(c->packets)); + mnl_attr_put_u64(nlh, NFTA_COUNTER_BYTES, be64toh(c->bytes)); + mnl_attr_nest_end(nlh, nest); + } +} +EXPORT_SYMBOL(nft_chain_nlmsg_build_payload); + +static int nft_chain_parse_attr_cb(const struct nlattr *attr, void *data) +{ + const struct nlattr **tb = data; + int type = mnl_attr_get_type(attr); + + if (mnl_attr_type_valid(attr, NFTA_CHAIN_MAX) < 0) + return MNL_CB_OK; + + switch(type) { + case NFTA_CHAIN_NAME: + case NFTA_CHAIN_TABLE: + if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + case NFTA_CHAIN_HOOK: + case NFTA_CHAIN_COUNTERS: + if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + case NFTA_CHAIN_POLICY: + case NFTA_CHAIN_USE: + if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + } + + tb[type] = attr; + return MNL_CB_OK; +} + +static int nft_chain_parse_counters_cb(const struct nlattr *attr, void *data) +{ + const struct nlattr **tb = data; + int type = mnl_attr_get_type(attr); + + if (mnl_attr_type_valid(attr, NFTA_COUNTER_MAX) < 0) + return MNL_CB_OK; + + switch(type) { + case NFTA_COUNTER_BYTES: + case NFTA_COUNTER_PACKETS: + if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + } + + tb[type] = attr; + return MNL_CB_OK; +} + +static int nft_chain_parse_counters(struct nlattr *attr, struct nft_chain *c) +{ + struct nlattr *tb[NFTA_COUNTER_MAX+1] = {}; + + if (mnl_attr_parse_nested(attr, nft_chain_parse_counters_cb, tb) < 0) + return -1; + + if (tb[NFTA_COUNTER_PACKETS]) { + c->packets = be64toh(mnl_attr_get_u64(tb[NFTA_COUNTER_PACKETS])); + c->flags |= (1 << NFT_CHAIN_ATTR_PACKETS); + } + if (tb[NFTA_COUNTER_BYTES]) { + c->bytes = be64toh(mnl_attr_get_u64(tb[NFTA_COUNTER_BYTES])); + c->flags |= (1 << NFT_CHAIN_ATTR_BYTES); + } + + return 0; +} +static int nft_chain_parse_hook_cb(const struct nlattr *attr, void *data) +{ + const struct nlattr **tb = data; + int type = mnl_attr_get_type(attr); + + if (mnl_attr_type_valid(attr, NFTA_HOOK_MAX) < 0) + return MNL_CB_OK; + + switch(type) { + case NFTA_HOOK_HOOKNUM: + case NFTA_HOOK_PRIORITY: + if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + } + + tb[type] = attr; + return MNL_CB_OK; +} + +static int nft_chain_parse_hook(struct nlattr *attr, struct nft_chain *c) +{ + struct nlattr *tb[NFTA_HOOK_MAX+1] = {}; + + if (mnl_attr_parse_nested(attr, nft_chain_parse_hook_cb, tb) < 0) + return -1; + + if (tb[NFTA_HOOK_HOOKNUM]) { + c->hooknum = ntohl(mnl_attr_get_u32(tb[NFTA_HOOK_HOOKNUM])); + c->flags |= (1 << NFT_CHAIN_ATTR_HOOKNUM); + } + if (tb[NFTA_HOOK_PRIORITY]) { + c->prio = ntohl(mnl_attr_get_u32(tb[NFTA_HOOK_PRIORITY])); + c->flags |= (1 << NFT_CHAIN_ATTR_PRIO); + } + + return 0; +} + +int nft_chain_nlmsg_parse(const struct nlmsghdr *nlh, struct nft_chain *c) +{ + struct nlattr *tb[NFTA_CHAIN_MAX+1] = {}; + struct nfgenmsg *nfg = mnl_nlmsg_get_payload(nlh); + int ret = 0; + + mnl_attr_parse(nlh, sizeof(*nfg), nft_chain_parse_attr_cb, tb); + if (tb[NFTA_CHAIN_NAME]) { + c->name = strdup(mnl_attr_get_str(tb[NFTA_CHAIN_NAME])); + c->flags |= (1 << NFT_CHAIN_ATTR_NAME); + } + if (tb[NFTA_CHAIN_TABLE]) { + c->table = strdup(mnl_attr_get_str(tb[NFTA_CHAIN_TABLE])); + c->flags |= (1 << NFT_CHAIN_ATTR_TABLE); + } + if (tb[NFTA_CHAIN_HOOK]) + ret = nft_chain_parse_hook(tb[NFTA_CHAIN_HOOK], c); + if (tb[NFTA_CHAIN_POLICY]) { + c->policy = ntohl(mnl_attr_get_u32(tb[NFTA_CHAIN_POLICY])); + c->flags |= (1 << NFT_CHAIN_ATTR_POLICY); + } + if (tb[NFTA_CHAIN_USE]) { + c->use = ntohl(mnl_attr_get_u32(tb[NFTA_CHAIN_USE])); + c->flags |= (1 << NFT_CHAIN_ATTR_USE); + } + if (tb[NFTA_CHAIN_COUNTERS]) + ret = nft_chain_parse_counters(tb[NFTA_CHAIN_COUNTERS], c); + + c->family = nfg->nfgen_family; + + return ret; +} +EXPORT_SYMBOL(nft_chain_nlmsg_parse); + +int nft_chain_snprintf(char *buf, size_t size, struct nft_chain *c, + uint32_t type, uint32_t flags) +{ + return snprintf(buf, size, "family=%u table=%s chain=%s " + "hook=%u prio=%d policy=%d use=%d " + "packets=%lu bytes=%lu\n", + c->family, c->table, c->name, c->hooknum, + c->prio, c->policy, c->use, c->packets, c->bytes); +} +EXPORT_SYMBOL(nft_chain_snprintf); + +struct nft_chain_list { + struct list_head list; +}; + +struct nft_chain_list *nft_chain_list_alloc(void) +{ + struct nft_chain_list *list; + + list = calloc(1, sizeof(struct nft_chain_list)); + if (list == NULL) + return NULL; + + INIT_LIST_HEAD(&list->list); + + return list; +} +EXPORT_SYMBOL(nft_chain_list_alloc); + +void nft_chain_list_free(struct nft_chain_list *list) +{ + struct nft_chain *r, *tmp; + + list_for_each_entry_safe(r, tmp, &list->list, head) { + list_del(&r->head); + nft_chain_free(r); + } + free(list); +} +EXPORT_SYMBOL(nft_chain_list_free); + +void nft_chain_list_add(struct nft_chain *r, struct nft_chain_list *list) +{ + list_add_tail(&r->head, &list->list); +} +EXPORT_SYMBOL(nft_chain_list_add); + +struct nft_chain_list_iter { + struct nft_chain_list *list; + struct nft_chain *cur; +}; + +struct nft_chain_list_iter *nft_chain_list_iter_create(struct nft_chain_list *l) +{ + struct nft_chain_list_iter *iter; + + iter = calloc(1, sizeof(struct nft_chain_list_iter)); + if (iter == NULL) + return NULL; + + iter->list = l; + iter->cur = list_entry(l->list.next, struct nft_chain, head); + + return iter; +} +EXPORT_SYMBOL(nft_chain_list_iter_create); + +struct nft_chain *nft_chain_list_iter_next(struct nft_chain_list_iter *iter) +{ + struct nft_chain *r = iter->cur; + + /* get next chain, if any */ + iter->cur = list_entry(iter->cur->head.next, struct nft_chain, head); + if (&iter->cur->head == iter->list->list.next) + return NULL; + + return r; +} +EXPORT_SYMBOL(nft_chain_list_iter_next); + +void nft_chain_list_iter_destroy(struct nft_chain_list_iter *iter) +{ + free(iter); +} +EXPORT_SYMBOL(nft_chain_list_iter_destroy); diff --git a/src/expr.c b/src/expr.c new file mode 100644 index 0000000..0b06aed --- /dev/null +++ b/src/expr.c @@ -0,0 +1,189 @@ +/* + * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This code has been sponsored by Sophos Astaro <http://www.sophos.com> + */ +#include "internal.h" +#include "expr_ops.h" + +#include <time.h> +#include <endian.h> +#include <stdint.h> +#include <stdlib.h> +#include <string.h> +#include <netinet/in.h> + +#include <libmnl/libmnl.h> +#include <linux/netfilter/nfnetlink.h> +#include <linux/netfilter/nf_tables.h> + +#include <libnftables/expr.h> + +#include "linux_list.h" + +struct nft_rule_expr *nft_rule_expr_alloc(const char *name) +{ + struct nft_rule_expr *expr; + struct expr_ops *ops; + + ops = nft_expr_ops_lookup(name); + if (ops == NULL) + return NULL; + + expr = calloc(1, sizeof(struct nft_rule_expr) + ops->alloc_len); + if (expr == NULL) + return NULL; + + /* Manually set expression name attribute */ + expr->flags |= (1 << NFT_RULE_EXPR_ATTR_NAME); + expr->ops = ops; + + return expr; +} +EXPORT_SYMBOL(nft_rule_expr_alloc); + +void nft_rule_expr_free(struct nft_rule_expr *expr) +{ + free(expr); +} +EXPORT_SYMBOL(nft_rule_expr_free); + +void +nft_rule_expr_set(struct nft_rule_expr *expr, uint16_t type, + const void *data, size_t data_len) +{ + switch(type) { + case NFT_RULE_EXPR_ATTR_NAME: /* cannot be modified */ + return; + default: + if (expr->ops->set(expr, type, data, data_len) < 0) + return; + } + expr->flags |= (1 << type); +} +EXPORT_SYMBOL(nft_rule_expr_set); + +void +nft_rule_expr_set_u8(struct nft_rule_expr *expr, uint16_t type, uint8_t data) +{ + nft_rule_expr_set(expr, type, &data, sizeof(uint8_t)); +} +EXPORT_SYMBOL(nft_rule_expr_set_u8); + +void +nft_rule_expr_set_u32(struct nft_rule_expr *expr, uint16_t type, uint32_t data) +{ + nft_rule_expr_set(expr, type, &data, sizeof(uint32_t)); +} +EXPORT_SYMBOL(nft_rule_expr_set_u32); + +void +nft_rule_expr_set_u64(struct nft_rule_expr *expr, uint16_t type, uint64_t data) +{ + nft_rule_expr_set(expr, type, &data, sizeof(uint64_t)); +} +EXPORT_SYMBOL(nft_rule_expr_set_u64); + +void +nft_rule_expr_set_str(struct nft_rule_expr *expr, uint16_t type, char *str) +{ + nft_rule_expr_set(expr, type, str, strlen(str)+1); +} +EXPORT_SYMBOL(nft_rule_expr_set_str); + +const void *nft_rule_expr_get(struct nft_rule_expr *expr, uint16_t type, size_t *data_len) +{ + const void *ret = NULL; + + switch(type) { + case NFT_RULE_EXPR_ATTR_NAME: + if (!(expr->flags & (1 << NFT_RULE_EXPR_ATTR_NAME))) + return NULL; + + ret = expr->ops->name; + break; + default: + ret = expr->ops->get(expr, type, data_len); + break; + } + + return ret; +} +EXPORT_SYMBOL(nft_rule_expr_get); + +uint8_t nft_rule_expr_get_u8(struct nft_rule_expr *expr, uint16_t type) +{ + const void *data; + size_t data_len; + + data = nft_rule_expr_get(expr, type, &data_len); + if (data == NULL) + return 0; + + if (data_len != sizeof(uint8_t)) + return 0; + + return *((uint8_t *)data); +} +EXPORT_SYMBOL(nft_rule_expr_get_u8); + +uint32_t nft_rule_expr_get_u32(struct nft_rule_expr *expr, uint16_t type) +{ + const void *data; + size_t data_len; + + data = nft_rule_expr_get(expr, type, &data_len); + if (data == NULL) + return 0; + + if (data_len != sizeof(uint32_t)) + return 0; + + return *((uint32_t *)data); +} +EXPORT_SYMBOL(nft_rule_expr_get_u32); + +uint64_t nft_rule_expr_get_u64(struct nft_rule_expr *expr, uint16_t type) +{ + const void *data; + size_t data_len; + + data = nft_rule_expr_get(expr, type, &data_len); + if (data == NULL) + return 0; + + if (data_len != sizeof(uint64_t)) + return 0; + + return *((uint64_t *)data); +} +EXPORT_SYMBOL(nft_rule_expr_get_u64); + +const char *nft_rule_expr_get_str(struct nft_rule_expr *expr, uint16_t type) +{ + size_t data_len; + + return (const char *)nft_rule_expr_get(expr, type, &data_len); +} +EXPORT_SYMBOL(nft_rule_expr_get_str); + +void +nft_rule_expr_build_payload(struct nlmsghdr *nlh, struct nft_rule_expr *expr) +{ + struct nlattr *nest1, *nest2; + + nest1 = mnl_attr_nest_start(nlh, NFTA_LIST_ELEM); + mnl_attr_put_strz(nlh, NFTA_EXPR_NAME, expr->ops->name); + + nest2 = mnl_attr_nest_start(nlh, NFTA_EXPR_DATA); + expr->ops->build(nlh, expr); + mnl_attr_nest_end(nlh, nest2); + + mnl_attr_nest_end(nlh, nest1); +} +EXPORT_SYMBOL(nft_rule_expr_build_payload); diff --git a/src/expr/cmp.c b/src/expr/cmp.c new file mode 100644 index 0000000..cabaddd --- /dev/null +++ b/src/expr/cmp.c @@ -0,0 +1,194 @@ +/* + * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This code has been sponsored by Sophos Astaro <http://www.sophos.com> + */ + +#include "internal.h" + +#include <stdio.h> +#include <stdint.h> +#include <string.h> +#include <arpa/inet.h> + +#include <libmnl/libmnl.h> +#include <linux/netfilter/nf_tables.h> +#include <libnftables/expr.h> +#include "expr_ops.h" +#include "data_reg.h" + +struct nft_expr_cmp { + union nft_data_reg data; + uint8_t sreg; /* enum nft_registers */ + uint8_t op; /* enum nft_cmp_ops */ +}; + +static int +nft_rule_expr_cmp_set(struct nft_rule_expr *e, uint16_t type, + const void *data, size_t data_len) +{ + struct nft_expr_cmp *cmp = (struct nft_expr_cmp *)e->data; + + switch(type) { + case NFT_EXPR_CMP_SREG: + cmp->sreg = *((uint32_t *)data); + break; + case NFT_EXPR_CMP_OP: + cmp->op = *((uint32_t *)data); + break; + case NFT_EXPR_CMP_DATA: + memcpy(&cmp->data.val, data, data_len); + cmp->data.len = data_len; + break; + default: + return -1; + } + return 0; +} + +static const void * +nft_rule_expr_cmp_get(struct nft_rule_expr *e, uint16_t type, size_t *data_len) +{ + struct nft_expr_cmp *cmp = (struct nft_expr_cmp *)e->data; + + switch(type) { + case NFT_EXPR_CMP_SREG: + if (e->flags & (1 << NFT_EXPR_CMP_SREG)) { + *data_len = sizeof(cmp->sreg); + return &cmp->sreg; + } else + return NULL; + break; + case NFT_EXPR_CMP_OP: + if (e->flags & (1 << NFT_EXPR_CMP_OP)) { + *data_len = sizeof(cmp->op); + return &cmp->op; + } else + return NULL; + break; + case NFT_EXPR_CMP_DATA: + if (e->flags & (1 << NFT_EXPR_CMP_DATA)) { + *data_len = cmp->data.len; + return &cmp->data.val; + } else + return NULL; + break; + default: + break; + } + return NULL; +} + +static int nft_rule_expr_cmp_cb(const struct nlattr *attr, void *data) +{ + const struct nlattr **tb = data; + int type = mnl_attr_get_type(attr); + + if (mnl_attr_type_valid(attr, NFTA_CMP_MAX) < 0) + return MNL_CB_OK; + + switch(type) { + case NFTA_CMP_SREG: + case NFTA_CMP_OP: + if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + case NFTA_CMP_DATA: + if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + } + + tb[type] = attr; + return MNL_CB_OK; +} + +static void +nft_rule_expr_cmp_build(struct nlmsghdr *nlh, struct nft_rule_expr *e) +{ + struct nft_expr_cmp *cmp = (struct nft_expr_cmp *)e->data; + + if (e->flags & (1 << NFT_EXPR_CMP_SREG)) + mnl_attr_put_u32(nlh, NFTA_CMP_SREG, htonl(cmp->sreg)); + if (e->flags & (1 << NFT_EXPR_CMP_OP)) + mnl_attr_put_u32(nlh, NFTA_CMP_OP, htonl(cmp->op)); + if (e->flags & (1 << NFT_EXPR_CMP_DATA)) { + struct nlattr *nest; + + nest = mnl_attr_nest_start(nlh, NFTA_CMP_DATA); + mnl_attr_put(nlh, NFTA_DATA_VALUE, cmp->data.len, cmp->data.val); + mnl_attr_nest_end(nlh, nest); + } +} + +static int +nft_rule_expr_cmp_parse(struct nft_rule_expr *e, struct nlattr *attr) +{ + struct nft_expr_cmp *cmp = (struct nft_expr_cmp *)e->data; + struct nlattr *tb[NFTA_CMP_MAX+1] = {}; + int ret = 0; + + if (mnl_attr_parse_nested(attr, nft_rule_expr_cmp_cb, tb) < 0) + return -1; + + if (tb[NFTA_CMP_SREG]) { + cmp->sreg = ntohl(mnl_attr_get_u32(tb[NFTA_CMP_SREG])); + e->flags |= (1 << NFTA_CMP_SREG); + } + if (tb[NFTA_CMP_OP]) { + cmp->op = ntohl(mnl_attr_get_u32(tb[NFTA_CMP_OP])); + e->flags |= (1 << NFTA_CMP_OP); + } + if (tb[NFTA_CMP_DATA]) { + ret = nft_parse_data(&cmp->data, tb[NFTA_CMP_DATA], NULL); + e->flags |= (1 << NFTA_CMP_DATA); + } + + return ret; +} + +static char *expr_cmp_str[] = { + [NFT_CMP_EQ] = "eq", + [NFT_CMP_NEQ] = "neq", + [NFT_CMP_LT] = "lt", + [NFT_CMP_LTE] = "lte", + [NFT_CMP_GT] = "gt", + [NFT_CMP_GTE] = "gte", +}; + +static int +nft_rule_expr_cmp_snprintf(char *buf, size_t size, struct nft_rule_expr *e) +{ + struct nft_expr_cmp *cmp = (struct nft_expr_cmp *)e->data; + int len = size, offset = 0, ret, i; + + ret = snprintf(buf, len, "sreg=%u op=%s data=", + cmp->sreg, expr_cmp_str[cmp->op]); + SNPRINTF_BUFFER_SIZE(ret, size, len, offset); + + for (i=0; i<cmp->data.len/sizeof(uint32_t); i++) { + ret = snprintf(buf+offset, len, "%.8x ", cmp->data.val[i]); + SNPRINTF_BUFFER_SIZE(ret, size, len, offset); + } + return offset; +} + +struct expr_ops expr_ops_cmp = { + .name = "cmp", + .alloc_len = sizeof(struct nft_expr_cmp), + .max_attr = NFTA_CMP_MAX, + .set = nft_rule_expr_cmp_set, + .get = nft_rule_expr_cmp_get, + .parse = nft_rule_expr_cmp_parse, + .build = nft_rule_expr_cmp_build, + .snprintf = nft_rule_expr_cmp_snprintf, +}; diff --git a/src/expr/counter.c b/src/expr/counter.c new file mode 100644 index 0000000..26b7d6f --- /dev/null +++ b/src/expr/counter.c @@ -0,0 +1,145 @@ +/* + * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This code has been sponsored by Sophos Astaro <http://www.sophos.com> + */ + +#include <stdio.h> +#include <stdint.h> +#include <arpa/inet.h> + +#include <linux/netfilter/nf_tables.h> + +#include "internal.h" +#include <libmnl/libmnl.h> +#include <libnftables/expr.h> +#include "expr_ops.h" + +struct nft_expr_counter { + uint64_t pkts; + uint64_t bytes; +}; + +static int +nft_rule_expr_counter_set(struct nft_rule_expr *e, uint16_t type, + const void *data, size_t data_len) +{ + struct nft_expr_counter *ctr = (struct nft_expr_counter *)e->data; + + switch(type) { + case NFT_EXPR_CTR_BYTES: + ctr->bytes = *((uint64_t *)data); + break; + case NFT_EXPR_CTR_PACKETS: + ctr->pkts = *((uint64_t *)data); + break; + default: + return -1; + } + return 0; +} + +static const void * +nft_rule_expr_counter_get(struct nft_rule_expr *e, uint16_t type, size_t *data_len) +{ + struct nft_expr_counter *ctr = (struct nft_expr_counter *)e->data; + + switch(type) { + case NFT_EXPR_CTR_BYTES: + if (e->flags & (1 << NFT_EXPR_CTR_BYTES)) { + *data_len = sizeof(ctr->bytes); + return &ctr->bytes; + } else + return NULL; + break; + case NFT_EXPR_CTR_PACKETS: + if (e->flags & (1 << NFT_EXPR_CTR_PACKETS)) { + *data_len = sizeof(ctr->pkts); + return &ctr->pkts; + } else + return NULL; + break; + default: + break; + } + return NULL; +} + +static int nft_rule_expr_counter_cb(const struct nlattr *attr, void *data) +{ + const struct nlattr **tb = data; + int type = mnl_attr_get_type(attr); + + if (mnl_attr_type_valid(attr, NFTA_COUNTER_MAX) < 0) + return MNL_CB_OK; + + switch(type) { + case NFTA_COUNTER_BYTES: + case NFTA_COUNTER_PACKETS: + if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + } + + tb[type] = attr; + return MNL_CB_OK; +} + +static void +nft_rule_expr_counter_build(struct nlmsghdr *nlh, struct nft_rule_expr *e) +{ + struct nft_expr_counter *ctr = (struct nft_expr_counter *)e->data; + + if (e->flags & (1 << NFT_EXPR_CTR_BYTES)) + mnl_attr_put_u64(nlh, NFTA_COUNTER_BYTES, htobe64(ctr->bytes)); + if (e->flags & (1 << NFT_EXPR_CTR_PACKETS)) + mnl_attr_put_u64(nlh, NFTA_COUNTER_PACKETS, htobe64(ctr->pkts)); +} + +static int +nft_rule_expr_counter_parse(struct nft_rule_expr *e, struct nlattr *attr) +{ + struct nft_expr_counter *ctr = (struct nft_expr_counter *)e->data; + struct nlattr *tb[NFTA_COUNTER_MAX+1] = {}; + + if (mnl_attr_parse_nested(attr, nft_rule_expr_counter_cb, tb) < 0) + return -1; + + if (tb[NFTA_COUNTER_BYTES]) { + ctr->bytes = be64toh(mnl_attr_get_u64(tb[NFTA_COUNTER_BYTES])); + e->flags |= (1 << NFT_EXPR_CTR_BYTES); + } + if (tb[NFTA_COUNTER_PACKETS]) { + ctr->pkts = be64toh(mnl_attr_get_u64(tb[NFTA_COUNTER_PACKETS])); + e->flags |= (1 << NFT_EXPR_CTR_PACKETS); + } + + return 0; +} + +static int +nft_rule_expr_counter_snprintf(char *buf, size_t len, struct nft_rule_expr *e) +{ + struct nft_expr_counter *ctr = (struct nft_expr_counter *)e->data; + + return snprintf(buf, len, "pkts=%lu bytes=%lu ", + ctr->pkts, ctr->bytes); +} + +struct expr_ops expr_ops_counter = { + .name = "counter", + .alloc_len = sizeof(struct nft_expr_counter), + .max_attr = NFTA_COUNTER_MAX, + .set = nft_rule_expr_counter_set, + .get = nft_rule_expr_counter_get, + .parse = nft_rule_expr_counter_parse, + .build = nft_rule_expr_counter_build, + .snprintf = nft_rule_expr_counter_snprintf, +}; diff --git a/src/expr/data_reg.c b/src/expr/data_reg.c new file mode 100644 index 0000000..5b14695 --- /dev/null +++ b/src/expr/data_reg.c @@ -0,0 +1,158 @@ +/* + * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This code has been sponsored by Sophos Astaro <http://www.sophos.com> + */ + +#include <stdio.h> +#include <stdint.h> +#include <string.h> +#include <arpa/inet.h> + +#include <libmnl/libmnl.h> +#include <linux/netfilter.h> +#include <linux/netfilter/nf_tables.h> +#include <libnftables/expr.h> +#include "expr_ops.h" +#include "data_reg.h" +#include "internal.h" + +static int nft_data_parse_cb(const struct nlattr *attr, void *data) +{ + const struct nlattr **tb = data; + int type = mnl_attr_get_type(attr); + + if (mnl_attr_type_valid(attr, NFTA_DATA_MAX) < 0) + return MNL_CB_OK; + + switch(type) { + case NFTA_DATA_VALUE: + if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + case NFTA_DATA_VERDICT: + if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + } + tb[type] = attr; + return MNL_CB_OK; +} + +static int nft_verdict_parse_cb(const struct nlattr *attr, void *data) +{ + const struct nlattr **tb = data; + int type = mnl_attr_get_type(attr); + + if (mnl_attr_type_valid(attr, NFTA_VERDICT_MAX) < 0) + return MNL_CB_OK; + + switch(type) { + case NFTA_VERDICT_CODE: + if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + case NFTA_VERDICT_CHAIN: + if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + } + tb[type] = attr; + return MNL_CB_OK; +} + +static int +nft_parse_verdict(union nft_data_reg *data, const struct nlattr *attr, int *type) +{ + struct nlattr *tb[NFTA_VERDICT_MAX+1]; + + if (mnl_attr_parse_nested(attr, nft_verdict_parse_cb, tb) < 0) { + perror("mnl_attr_parse_nested"); + return -1; + } + + if (!tb[NFTA_VERDICT_CODE]) + return -1; + + data->verdict = ntohl(mnl_attr_get_u32(tb[NFTA_VERDICT_CODE])); + + switch(data->verdict) { + case NF_ACCEPT: + case NF_DROP: + case NF_QUEUE: + case NFT_CONTINUE: + case NFT_BREAK: + case NFT_RETURN: + if (type) + *type = DATA_VERDICT; + data->len = sizeof(data->verdict); + break; + case NFT_JUMP: + case NFT_GOTO: + if (!tb[NFTA_VERDICT_CHAIN]) + return -1; + + data->chain = strdup(mnl_attr_get_str(tb[NFTA_VERDICT_CHAIN])); + if (type) + *type = DATA_CHAIN; + break; + default: + return -1; + } + + return 0; +} + +static int +__nft_parse_data(union nft_data_reg *data, const struct nlattr *attr) +{ + void *orig = mnl_attr_get_payload(attr); + size_t data_len = mnl_attr_get_payload_len(attr); + + if (data_len == 0) + return -1; + + if (data_len > sizeof(uint32_t) * 4) + return -1; + + memcpy(data->val, orig, data_len); + data->len = data_len; + + return 0; +} + +int nft_parse_data(union nft_data_reg *data, struct nlattr *attr, int *type) +{ + struct nlattr *tb[NFTA_DATA_MAX+1] = {}; + int ret = 0; + + if (mnl_attr_parse_nested(attr, nft_data_parse_cb, tb) < 0) { + perror("mnl_attr_parse_nested"); + return -1; + } + if (tb[NFTA_DATA_VALUE]) { + if (type) + *type = DATA_VALUE; + + ret = __nft_parse_data(data, tb[NFTA_DATA_VALUE]); + if (ret < 0) + return ret; + } + if (tb[NFTA_DATA_VERDICT]) + ret = nft_parse_verdict(data, tb[NFTA_DATA_VERDICT], type); + + return ret; +} diff --git a/src/expr/data_reg.h b/src/expr/data_reg.h new file mode 100644 index 0000000..00eab63 --- /dev/null +++ b/src/expr/data_reg.h @@ -0,0 +1,23 @@ +#ifndef _DATA_H_ +#define _DATA_H_ + +enum { + DATA_VALUE, + DATA_VERDICT, + DATA_CHAIN, +}; + +union nft_data_reg { + struct { + uint32_t val[4]; + size_t len; + }; + struct { + int verdict; + char *chain; + }; +}; + +int nft_parse_data(union nft_data_reg *data, struct nlattr *attr, int *type); + +#endif diff --git a/src/expr/immediate.c b/src/expr/immediate.c new file mode 100644 index 0000000..68c27ec --- /dev/null +++ b/src/expr/immediate.c @@ -0,0 +1,215 @@ +/* + * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This code has been sponsored by Sophos Astaro <http://www.sophos.com> + */ + +#include <stdio.h> +#include <stdint.h> +#include <string.h> +#include <arpa/inet.h> + +#include "internal.h" +#include <libmnl/libmnl.h> +#include <linux/netfilter/nf_tables.h> +#include <libnftables/expr.h> +#include "expr_ops.h" +#include "data_reg.h" + +struct nft_expr_immediate { + union nft_data_reg data; + enum nft_registers dreg; +}; + +static int +nft_rule_expr_immediate_set(struct nft_rule_expr *e, uint16_t type, + const void *data, size_t data_len) +{ + struct nft_expr_immediate *imm = (struct nft_expr_immediate *)e->data; + + switch(type) { + case NFT_EXPR_IMM_DREG: + imm->dreg = *((uint32_t *)data); + break; + case NFT_EXPR_IMM_DATA: + memcpy(&imm->data.val, data, data_len); + imm->data.len = data_len; + break; + case NFT_EXPR_IMM_VERDICT: + imm->data.verdict = *((uint32_t *)data); + break; + case NFT_EXPR_IMM_CHAIN: + if (imm->data.chain) + free(imm->data.chain); + + imm->data.chain = strdup(data); + break; + default: + return -1; + } + return 0; +} + +static const void * +nft_rule_expr_immediate_get(struct nft_rule_expr *e, uint16_t type, + size_t *data_len) +{ + struct nft_expr_immediate *imm = (struct nft_expr_immediate *)e->data; + + switch(type) { + case NFT_EXPR_IMM_DREG: + if (e->flags & (1 << NFT_EXPR_IMM_DREG)) { + *data_len = sizeof(imm->dreg); + return &imm->dreg; + } else + return NULL; + break; + case NFT_EXPR_IMM_DATA: + if (e->flags & (1 << NFT_EXPR_IMM_DATA)) { + *data_len = imm->data.len; + return &imm->data.val; + } else + return NULL; + break; + case NFT_EXPR_IMM_VERDICT: + if (e->flags & (1 << NFT_EXPR_IMM_VERDICT)) { + *data_len = sizeof(imm->data.verdict); + return &imm->data.verdict; + } else + return NULL; + break; + case NFT_EXPR_IMM_CHAIN: + if (e->flags & (1 << NFT_EXPR_IMM_CHAIN)) { + *data_len = strlen(imm->data.chain)+1; + return imm->data.chain; + } else + return NULL; + break; + default: + break; + } + return NULL; +} + +static int nft_rule_expr_immediate_cb(const struct nlattr *attr, void *data) +{ + const struct nlattr **tb = data; + int type = mnl_attr_get_type(attr); + + if (mnl_attr_type_valid(attr, NFTA_IMMEDIATE_MAX) < 0) + return MNL_CB_OK; + + switch(type) { + case NFTA_IMMEDIATE_DREG: + if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + case NFTA_IMMEDIATE_DATA: + if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + } + + tb[type] = attr; + return MNL_CB_OK; +} + +static void +nft_rule_expr_immediate_build(struct nlmsghdr *nlh, struct nft_rule_expr *e) +{ + struct nft_expr_immediate *imm = (struct nft_expr_immediate *)e->data; + + if (e->flags & (1 << NFT_EXPR_IMM_DREG)) + mnl_attr_put_u32(nlh, NFTA_IMMEDIATE_DREG, htonl(imm->dreg)); + + /* Sane configurations allows you to set ONLY one of these two below */ + if (e->flags & (1 << NFT_EXPR_IMM_DATA)) { + struct nlattr *nest; + + nest = mnl_attr_nest_start(nlh, NFTA_IMMEDIATE_DATA); + mnl_attr_put(nlh, NFTA_DATA_VALUE, imm->data.len, imm->data.val); + mnl_attr_nest_end(nlh, nest); + + } else if (e->flags & (1 << NFT_EXPR_IMM_VERDICT)) { + struct nlattr *nest1, *nest2; + + nest1 = mnl_attr_nest_start(nlh, NFTA_IMMEDIATE_DATA); + nest2 = mnl_attr_nest_start(nlh, NFTA_DATA_VERDICT); + mnl_attr_put_u32(nlh, NFTA_VERDICT_CODE, htonl(imm->data.verdict)); + if (e->flags & (1 << NFT_EXPR_IMM_CHAIN)) + mnl_attr_put_strz(nlh, NFTA_VERDICT_CHAIN, imm->data.chain); + + mnl_attr_nest_end(nlh, nest1); + mnl_attr_nest_end(nlh, nest2); + } +} + +static int +nft_rule_expr_immediate_parse(struct nft_rule_expr *e, struct nlattr *attr) +{ + struct nft_expr_immediate *imm = (struct nft_expr_immediate *)e->data; + struct nlattr *tb[NFTA_IMMEDIATE_MAX+1] = {}; + int ret = 0; + + if (mnl_attr_parse_nested(attr, nft_rule_expr_immediate_cb, tb) < 0) + return -1; + + if (tb[NFTA_IMMEDIATE_DREG]) { + imm->dreg = ntohl(mnl_attr_get_u32(tb[NFTA_IMMEDIATE_DREG])); + e->flags |= (1 << NFT_EXPR_IMM_DREG); + } + if (tb[NFTA_IMMEDIATE_DATA]) { + int type; + + ret = nft_parse_data(&imm->data, tb[NFTA_IMMEDIATE_DATA], &type); + if (ret < 0) + return ret; + + switch(type) { + case DATA_VALUE: + /* real immediate data to be loaded to destination */ + e->flags |= (1 << NFT_EXPR_IMM_DATA); + break; + case DATA_VERDICT: + /* NF_ACCEPT, NF_DROP, NF_QUEUE and NFT_RETURN case */ + e->flags |= (1 << NFT_EXPR_IMM_VERDICT); + break; + case DATA_CHAIN: + /* NFT_GOTO and NFT_JUMP case */ + e->flags |= (1 << NFT_EXPR_IMM_VERDICT) | + (1 << NFT_EXPR_IMM_CHAIN); + break; + } + } + + return ret; +} + +static int +nft_rule_expr_immediate_snprintf(char *buf, size_t len, struct nft_rule_expr *e) +{ + struct nft_expr_immediate *imm = (struct nft_expr_immediate *)e->data; + + return snprintf(buf, len, "dreg=%u data=%u ", + imm->dreg, imm->data.val[0]); +} + +struct expr_ops expr_ops_immediate = { + .name = "immediate", + .alloc_len = sizeof(struct nft_expr_immediate), + .max_attr = NFTA_IMMEDIATE_MAX, + .set = nft_rule_expr_immediate_set, + .get = nft_rule_expr_immediate_get, + .parse = nft_rule_expr_immediate_parse, + .build = nft_rule_expr_immediate_build, + .snprintf = nft_rule_expr_immediate_snprintf, +}; diff --git a/src/expr/match.c b/src/expr/match.c new file mode 100644 index 0000000..a9e2dee --- /dev/null +++ b/src/expr/match.c @@ -0,0 +1,203 @@ +/* + * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This code has been sponsored by Sophos Astaro <http://www.sophos.com> + */ + +#include "internal.h" + +#include <stdio.h> +#include <stdint.h> +#include <string.h> /* for memcpy */ +#include <arpa/inet.h> + +#include <libmnl/libmnl.h> + +#include <linux/netfilter/nf_tables.h> +#include <linux/netfilter/x_tables.h> + +#include <libnftables/expr.h> + +#include "expr_ops.h" + +struct nft_expr_match { + char name[XT_EXTENSION_MAXNAMELEN]; + uint32_t rev; + uint32_t data_len; + const void *data; +}; + +static int +nft_rule_expr_match_set(struct nft_rule_expr *e, uint16_t type, + const void *data, size_t data_len) +{ + struct nft_expr_match *mt = (struct nft_expr_match *)e->data; + + switch(type) { + case NFT_EXPR_MT_NAME: + memcpy(mt->name, data, XT_EXTENSION_MAXNAMELEN); + mt->name[XT_EXTENSION_MAXNAMELEN-1] = '\0'; + break; + case NFT_EXPR_MT_REV: + mt->rev = *((uint32_t *)data); + break; + case NFT_EXPR_MT_INFO: + if (mt->data) + free((void *)mt->data); + + mt->data = data; + mt->data_len = data_len; + break; + default: + return -1; + } + return 0; +} + +static const void * +nft_rule_expr_match_get(struct nft_rule_expr *e, uint16_t type, + size_t *data_len) +{ + struct nft_expr_match *mt = (struct nft_expr_match *)e->data; + + switch(type) { + case NFT_EXPR_MT_NAME: + if (e->flags & (1 << NFT_EXPR_MT_NAME)) { + *data_len = sizeof(mt->name); + return mt->name; + } else + return NULL; + break; + case NFT_EXPR_MT_REV: + if (e->flags & (1 << NFT_EXPR_MT_REV)) { + *data_len = sizeof(mt->rev); + return &mt->rev; + } else + return NULL; + break; + case NFT_EXPR_MT_INFO: + if (e->flags & (1 << NFT_EXPR_MT_INFO)) { + *data_len = mt->data_len; + return mt->data; + } else + return NULL; + break; + default: + break; + } + return NULL; +} + +static int nft_rule_expr_match_cb(const struct nlattr *attr, void *data) +{ + const struct nlattr **tb = data; + int type = mnl_attr_get_type(attr); + + if (mnl_attr_type_valid(attr, NFTA_MATCH_MAX) < 0) + return MNL_CB_OK; + + switch(type) { + case NFTA_MATCH_NAME: + if (mnl_attr_validate(attr, MNL_TYPE_NUL_STRING) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + case NFTA_MATCH_REV: + if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + case NFTA_MATCH_INFO: + if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + } + + tb[type] = attr; + return MNL_CB_OK; +} + +static void +nft_rule_expr_match_build(struct nlmsghdr *nlh, struct nft_rule_expr *e) +{ + struct nft_expr_match *mt = (struct nft_expr_match *)e->data; + + if (e->flags & (1 << NFT_EXPR_MT_NAME)) + mnl_attr_put_strz(nlh, NFTA_MATCH_NAME, mt->name); + if (e->flags & (1 << NFT_EXPR_MT_REV)) + mnl_attr_put_u32(nlh, NFTA_MATCH_REV, htonl(mt->rev)); + if (e->flags & (1 << NFT_EXPR_MT_INFO)) + mnl_attr_put(nlh, NFTA_MATCH_INFO, XT_ALIGN(mt->data_len), mt->data); +} + +static int nft_rule_expr_match_parse(struct nft_rule_expr *e, struct nlattr *attr) +{ + struct nft_expr_match *match = (struct nft_expr_match *)e->data; + struct nlattr *tb[NFTA_MATCH_MAX+1] = {}; + + if (mnl_attr_parse_nested(attr, nft_rule_expr_match_cb, tb) < 0) + return -1; + + if (tb[NFTA_MATCH_NAME]) { + snprintf(match->name, XT_EXTENSION_MAXNAMELEN, "%s", + mnl_attr_get_str(tb[NFTA_MATCH_NAME])); + + match->name[XT_EXTENSION_MAXNAMELEN-1] = '\0'; + e->flags |= (1 << NFTA_MATCH_NAME); + } + + if (tb[NFTA_MATCH_REV]) { + match->rev = ntohl(mnl_attr_get_u32(tb[NFTA_MATCH_REV])); + e->flags |= (1 << NFTA_MATCH_REV); + } + + if (tb[NFTA_MATCH_INFO]) { + uint32_t len = mnl_attr_get_payload_len(tb[NFTA_MATCH_INFO]); + void *match_data; + + if (match->data) + free((void *) match->data); + + match_data = calloc(1, len); + if (match_data == NULL) + return -1; + + memcpy(match_data, mnl_attr_get_payload(tb[NFTA_MATCH_INFO]), len); + + match->data = match_data; + match->data_len = len; + + e->flags |= (1 << NFTA_MATCH_INFO); + } + + return 0; +} + +static int +nft_rule_expr_match_snprintf(char *buf, size_t len, struct nft_rule_expr *e) +{ + struct nft_expr_match *match = (struct nft_expr_match *)e->data; + + return snprintf(buf, len, "name=%s rev=%u ", + match->name, match->rev); +} + +struct expr_ops expr_ops_match = { + .name = "match", + .alloc_len = sizeof(struct nft_expr_match), + .max_attr = NFTA_MATCH_MAX, + .set = nft_rule_expr_match_set, + .get = nft_rule_expr_match_get, + .parse = nft_rule_expr_match_parse, + .build = nft_rule_expr_match_build, + .snprintf = nft_rule_expr_match_snprintf, +}; diff --git a/src/expr/meta.c b/src/expr/meta.c new file mode 100644 index 0000000..0251e43 --- /dev/null +++ b/src/expr/meta.c @@ -0,0 +1,144 @@ +/* + * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This code has been sponsored by Sophos Astaro <http://www.sophos.com> + */ + +#include <stdio.h> +#include <stdint.h> +#include <arpa/inet.h> + +#include <linux/netfilter/nf_tables.h> + +#include "internal.h" +#include <libmnl/libmnl.h> +#include <libnftables/expr.h> +#include "expr_ops.h" + +struct nft_expr_meta { + uint8_t key; /* enum nft_meta_keys */ + uint8_t dreg; /* enum nft_registers */ +}; + +static int +nft_rule_expr_meta_set(struct nft_rule_expr *e, uint16_t type, + const void *data, size_t data_len) +{ + struct nft_expr_meta *meta = (struct nft_expr_meta *)e->data; + + switch(type) { + case NFT_EXPR_META_KEY: + meta->key = *((uint32_t *)data); + break; + case NFT_EXPR_META_DREG: + meta->dreg = *((uint32_t *)data); + break; + default: + return -1; + } + return 0; +} + +static const void * +nft_rule_expr_meta_get(struct nft_rule_expr *e, uint16_t type, size_t *data_len) +{ + struct nft_expr_meta *meta = (struct nft_expr_meta *)e->data; + + switch(type) { + case NFT_EXPR_META_KEY: + if (e->flags & (1 << NFT_EXPR_META_KEY)) { + *data_len = sizeof(meta->key); + return &meta->key; + } else + return NULL; + break; + case NFT_EXPR_META_DREG: + if (e->flags & (1 << NFT_EXPR_META_DREG)) { + *data_len = sizeof(meta->dreg); + return &meta->dreg; + } else + return NULL; + break; + default: + break; + } + return NULL; +} + +static int nft_rule_expr_meta_cb(const struct nlattr *attr, void *data) +{ + const struct nlattr **tb = data; + int type = mnl_attr_get_type(attr); + + if (mnl_attr_type_valid(attr, NFTA_META_MAX) < 0) + return MNL_CB_OK; + + switch(type) { + case NFTA_META_KEY: + case NFTA_META_DREG: + if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + } + + tb[type] = attr; + return MNL_CB_OK; +} + +static void +nft_rule_expr_meta_build(struct nlmsghdr *nlh, struct nft_rule_expr *e) +{ + struct nft_expr_meta *meta = (struct nft_expr_meta *)e->data; + + if (e->flags & (1 << NFT_EXPR_META_KEY)) + mnl_attr_put_u32(nlh, NFTA_META_KEY, htonl(meta->key)); + if (e->flags & (1 << NFT_EXPR_META_DREG)) + mnl_attr_put_u32(nlh, NFTA_META_DREG, htonl(meta->dreg)); +} + +static int +nft_rule_expr_meta_parse(struct nft_rule_expr *e, struct nlattr *attr) +{ + struct nft_expr_meta *meta = (struct nft_expr_meta *)e->data; + struct nlattr *tb[NFTA_META_MAX+1] = {}; + + if (mnl_attr_parse_nested(attr, nft_rule_expr_meta_cb, tb) < 0) + return -1; + + if (tb[NFTA_META_KEY]) { + meta->key = ntohl(mnl_attr_get_u32(tb[NFTA_META_KEY])); + e->flags |= (1 << NFT_EXPR_META_KEY); + } + if (tb[NFTA_META_DREG]) { + meta->dreg = ntohl(mnl_attr_get_u32(tb[NFTA_META_DREG])); + e->flags |= (1 << NFT_EXPR_META_DREG); + } + + return 0; +} + +static int +nft_rule_expr_meta_snprintf(char *buf, size_t len, struct nft_rule_expr *e) +{ + struct nft_expr_meta *meta = (struct nft_expr_meta *)e->data; + + return snprintf(buf, len, "dreg=%u key=%u ", meta->dreg, meta->key); +} + +struct expr_ops expr_ops_meta = { + .name = "meta", + .alloc_len = sizeof(struct nft_expr_meta), + .max_attr = NFTA_META_MAX, + .set = nft_rule_expr_meta_set, + .get = nft_rule_expr_meta_get, + .parse = nft_rule_expr_meta_parse, + .build = nft_rule_expr_meta_build, + .snprintf = nft_rule_expr_meta_snprintf, +}; diff --git a/src/expr/payload.c b/src/expr/payload.c new file mode 100644 index 0000000..746a127 --- /dev/null +++ b/src/expr/payload.c @@ -0,0 +1,185 @@ +/* + * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This code has been sponsored by Sophos Astaro <http://www.sophos.com> + */ + +#include "internal.h" + +#include <stdio.h> +#include <stdint.h> +#include <arpa/inet.h> + +#include <libmnl/libmnl.h> + +#include <linux/netfilter/nf_tables.h> + +#include <libnftables/expr.h> + +#include "expr_ops.h" + +struct nft_expr_payload { + enum nft_registers dreg; + enum nft_payload_bases base; + unsigned int offset; + unsigned int len; +}; + +static int +nft_rule_expr_payload_set(struct nft_rule_expr *e, uint16_t type, + const void *data, size_t data_len) +{ + struct nft_expr_payload *payload = (struct nft_expr_payload *)e->data; + + switch(type) { + case NFT_EXPR_PAYLOAD_DREG: + payload->dreg = *((uint32_t *)data); + break; + case NFT_EXPR_PAYLOAD_BASE: + payload->base = *((uint32_t *)data); + break; + case NFT_EXPR_PAYLOAD_OFFSET: + payload->offset = *((unsigned int *)data); + break; + case NFT_EXPR_PAYLOAD_LEN: + payload->len = *((unsigned int *)data); + break; + default: + return -1; + } + return 0; +} + +static const void * +nft_rule_expr_payload_get(struct nft_rule_expr *e, uint16_t type, size_t *data_len) +{ + struct nft_expr_payload *payload = (struct nft_expr_payload *)e->data; + + switch(type) { + case NFT_EXPR_PAYLOAD_DREG: + if (e->flags & (1 << NFT_EXPR_PAYLOAD_DREG)) { + *data_len = sizeof(payload->dreg); + return &payload->dreg; + } else + return NULL; + break; + case NFT_EXPR_PAYLOAD_BASE: + if (e->flags & (1 << NFT_EXPR_PAYLOAD_BASE)) { + *data_len = sizeof(payload->base); + return &payload->base; + } else + return NULL; + break; + case NFT_EXPR_PAYLOAD_OFFSET: + if (e->flags & (1 << NFT_EXPR_PAYLOAD_OFFSET)) { + *data_len = sizeof(payload->offset); + return &payload->offset; + } else + return NULL; + break; + case NFT_EXPR_PAYLOAD_LEN: + if (e->flags & (1 << NFT_EXPR_PAYLOAD_LEN)) { + *data_len = sizeof(payload->len); + return &payload->len; + } else + return NULL; + break; + default: + break; + } + return NULL; +} + +static int nft_rule_expr_payload_cb(const struct nlattr *attr, void *data) +{ + const struct nlattr **tb = data; + int type = mnl_attr_get_type(attr); + + if (mnl_attr_type_valid(attr, NFTA_PAYLOAD_MAX) < 0) + return MNL_CB_OK; + + switch(type) { + case NFTA_PAYLOAD_DREG: + case NFTA_PAYLOAD_BASE: + case NFTA_PAYLOAD_OFFSET: + case NFTA_PAYLOAD_LEN: + if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + } + + tb[type] = attr; + return MNL_CB_OK; +} + +static void +nft_rule_expr_payload_build(struct nlmsghdr *nlh, struct nft_rule_expr *e) +{ + struct nft_expr_payload *payload = (struct nft_expr_payload *)e->data; + + if (e->flags & (1 << NFT_EXPR_PAYLOAD_DREG)) + mnl_attr_put_u32(nlh, NFTA_PAYLOAD_DREG, htonl(payload->dreg)); + if (e->flags & (1 << NFT_EXPR_PAYLOAD_BASE)) + mnl_attr_put_u32(nlh, NFTA_PAYLOAD_BASE, htonl(payload->base)); + if (e->flags & (1 << NFT_EXPR_PAYLOAD_OFFSET)) + mnl_attr_put_u32(nlh, NFTA_PAYLOAD_OFFSET, htonl(payload->offset)); + if (e->flags & (1 << NFT_EXPR_PAYLOAD_LEN)) + mnl_attr_put_u32(nlh, NFTA_PAYLOAD_LEN, htonl(payload->len)); +} + +static int +nft_rule_expr_payload_parse(struct nft_rule_expr *e, struct nlattr *attr) +{ + struct nft_expr_payload *payload = (struct nft_expr_payload *)e->data; + struct nlattr *tb[NFTA_PAYLOAD_MAX+1] = {}; + + if (mnl_attr_parse_nested(attr, nft_rule_expr_payload_cb, tb) < 0) + return -1; + + if (tb[NFTA_PAYLOAD_DREG]) { + payload->dreg = ntohl(mnl_attr_get_u32(tb[NFTA_PAYLOAD_DREG])); + e->flags |= (1 << NFT_EXPR_PAYLOAD_DREG); + } + if (tb[NFTA_PAYLOAD_BASE]) { + payload->base = ntohl(mnl_attr_get_u32(tb[NFTA_PAYLOAD_BASE])); + e->flags |= (1 << NFT_EXPR_PAYLOAD_BASE); + } + if (tb[NFTA_PAYLOAD_OFFSET]) { + payload->offset = ntohl(mnl_attr_get_u32(tb[NFTA_PAYLOAD_OFFSET])); + e->flags |= (1 << NFT_EXPR_PAYLOAD_OFFSET); + } + if (tb[NFTA_PAYLOAD_LEN]) { + payload->len = ntohl(mnl_attr_get_u32(tb[NFTA_PAYLOAD_LEN])); + e->flags |= (1 << NFT_EXPR_PAYLOAD_LEN); + } + + return 0; +} + +static int +nft_rule_expr_payload_snprintf(char *buf, size_t len, struct nft_rule_expr *e) +{ + struct nft_expr_payload *payload = (struct nft_expr_payload *)e->data; + + return snprintf(buf, len, "dreg=%u base=%u offset=%u len=%u ", + payload->dreg, payload->base, + payload->offset, payload->len); +} + +struct expr_ops expr_ops_payload = { + .name = "payload", + .alloc_len = sizeof(struct nft_expr_payload), + .max_attr = NFTA_PAYLOAD_MAX, + .set = nft_rule_expr_payload_set, + .get = nft_rule_expr_payload_get, + .parse = nft_rule_expr_payload_parse, + .build = nft_rule_expr_payload_build, + .snprintf = nft_rule_expr_payload_snprintf, +}; diff --git a/src/expr/target.c b/src/expr/target.c new file mode 100644 index 0000000..fccf64b --- /dev/null +++ b/src/expr/target.c @@ -0,0 +1,203 @@ +/* + * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This code has been sponsored by Sophos Astaro <http://www.sophos.com> + */ + +#include "internal.h" + +#include <stdio.h> +#include <stdint.h> +#include <string.h> /* for memcpy */ +#include <arpa/inet.h> + +#include <libmnl/libmnl.h> + +#include <linux/netfilter/nf_tables.h> +#include <linux/netfilter/x_tables.h> + +#include <libnftables/expr.h> + +#include "expr_ops.h" + +struct nft_expr_target { + char name[XT_EXTENSION_MAXNAMELEN]; + uint32_t rev; + uint32_t data_len; + const void *data; +}; + +static int +nft_rule_expr_target_set(struct nft_rule_expr *e, uint16_t type, + const void *data, size_t data_len) +{ + struct nft_expr_target *tg = (struct nft_expr_target *)e->data; + + switch(type) { + case NFT_EXPR_TG_NAME: + memcpy(tg->name, data, XT_EXTENSION_MAXNAMELEN); + tg->name[XT_EXTENSION_MAXNAMELEN-1] = '\0'; + break; + case NFT_EXPR_TG_REV: + tg->rev = *((uint32_t *)data); + break; + case NFT_EXPR_TG_INFO: + if (tg->data) + free((void *)tg->data); + + tg->data = data; + tg->data_len = data_len; + break; + default: + return -1; + } + return 0; +} + +static const void * +nft_rule_expr_target_get(struct nft_rule_expr *e, uint16_t type, + size_t *data_len) +{ + struct nft_expr_target *tg = (struct nft_expr_target *)e->data; + + switch(type) { + case NFT_EXPR_TG_NAME: + if (e->flags & (1 << NFT_EXPR_TG_NAME)) { + *data_len = sizeof(tg->name); + return tg->name; + } else + return NULL; + break; + case NFT_EXPR_TG_REV: + if (e->flags & (1 << NFT_EXPR_TG_REV)) { + *data_len = sizeof(tg->rev); + return &tg->rev; + } else + return NULL; + break; + case NFT_EXPR_TG_INFO: + if (e->flags & (1 << NFT_EXPR_TG_INFO)) { + *data_len = tg->data_len; + return tg->data; + } else + return NULL; + break; + default: + break; + } + return NULL; +} + +static int nft_rule_expr_target_cb(const struct nlattr *attr, void *data) +{ + const struct nlattr **tb = data; + int type = mnl_attr_get_type(attr); + + if (mnl_attr_type_valid(attr, NFTA_TARGET_MAX) < 0) + return MNL_CB_OK; + + switch(type) { + case NFTA_TARGET_NAME: + if (mnl_attr_validate(attr, MNL_TYPE_NUL_STRING) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + case NFTA_TARGET_REV: + if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + case NFTA_TARGET_INFO: + if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + } + + tb[type] = attr; + return MNL_CB_OK; +} + +static void +nft_rule_expr_target_build(struct nlmsghdr *nlh, struct nft_rule_expr *e) +{ + struct nft_expr_target *tg = (struct nft_expr_target *)e->data; + + if (e->flags & (1 << NFT_EXPR_TG_NAME)) + mnl_attr_put_strz(nlh, NFTA_TARGET_NAME, tg->name); + if (e->flags & (1 << NFT_EXPR_TG_REV)) + mnl_attr_put_u32(nlh, NFTA_TARGET_REV, htonl(tg->rev)); + if (e->flags & (1 << NFT_EXPR_TG_INFO)) + mnl_attr_put(nlh, NFTA_TARGET_INFO, XT_ALIGN(tg->data_len), tg->data); +} + +static int nft_rule_expr_target_parse(struct nft_rule_expr *e, struct nlattr *attr) +{ + struct nft_expr_target *target = (struct nft_expr_target *)e->data; + struct nlattr *tb[NFTA_TARGET_MAX+1] = {}; + + if (mnl_attr_parse_nested(attr, nft_rule_expr_target_cb, tb) < 0) + return -1; + + if (tb[NFTA_TARGET_NAME]) { + snprintf(target->name, XT_EXTENSION_MAXNAMELEN, "%s", + mnl_attr_get_str(tb[NFTA_TARGET_NAME])); + + target->name[XT_EXTENSION_MAXNAMELEN-1] = '\0'; + e->flags |= (1 << NFT_EXPR_TG_NAME); + } + + if (tb[NFTA_TARGET_REV]) { + target->rev = ntohl(mnl_attr_get_u32(tb[NFTA_TARGET_REV])); + e->flags |= (1 << NFT_EXPR_TG_REV); + } + + if (tb[NFTA_TARGET_INFO]) { + uint32_t len = mnl_attr_get_len(tb[NFTA_TARGET_INFO]); + void *target_data; + + if (target->data) + free((void *) target->data); + + target_data = calloc(1, len); + if (target_data == NULL) + return -1; + + memcpy(target_data, mnl_attr_get_payload(tb[NFTA_TARGET_INFO]), len); + + target->data = target_data; + target->data_len = len; + + e->flags |= (1 << NFT_EXPR_TG_INFO); + } + + return 0; +} + +static int +nft_rule_expr_target_snprintf(char *buf, size_t len, struct nft_rule_expr *e) +{ + struct nft_expr_target *target = (struct nft_expr_target *)e->data; + + return snprintf(buf, len, "name=%s rev=%u ", + target->name, target->rev); +} + +struct expr_ops expr_ops_target = { + .name = "target", + .alloc_len = sizeof(struct nft_expr_target), + .max_attr = NFTA_TARGET_MAX, + .set = nft_rule_expr_target_set, + .get = nft_rule_expr_target_get, + .parse = nft_rule_expr_target_parse, + .build = nft_rule_expr_target_build, + .snprintf = nft_rule_expr_target_snprintf, +}; diff --git a/src/expr_ops.c b/src/expr_ops.c new file mode 100644 index 0000000..2b21d96 --- /dev/null +++ b/src/expr_ops.c @@ -0,0 +1,36 @@ +#include <string.h> + +#include "expr_ops.h" + +extern struct expr_ops expr_ops_cmp; +extern struct expr_ops expr_ops_counter; +extern struct expr_ops expr_ops_immediate; +extern struct expr_ops expr_ops_match; +extern struct expr_ops expr_ops_meta; +extern struct expr_ops expr_ops_payload; +extern struct expr_ops expr_ops_target; + +struct expr_ops *expr_ops[] = { + &expr_ops_cmp, + &expr_ops_counter, + &expr_ops_immediate, + &expr_ops_match, + &expr_ops_meta, + &expr_ops_payload, + &expr_ops_target, + NULL, +}; + +struct expr_ops *nft_expr_ops_lookup(const char *name) +{ + int i = 0; + + while (expr_ops[i] != NULL) { + if (strcmp(expr_ops[i]->name, name) == 0) + return expr_ops[i]; + + i++; + } + + return NULL; +} diff --git a/src/expr_ops.h b/src/expr_ops.h new file mode 100644 index 0000000..2322958 --- /dev/null +++ b/src/expr_ops.h @@ -0,0 +1,24 @@ +#ifndef _EXPR_OPS_H_ +#define _EXPR_OPS_H_ + +#include <stdlib.h> +#include <stdint.h> + +struct nlattr; +struct nlmsghdr; +struct nft_rule_expr; + +struct expr_ops { + char *name; + size_t alloc_len; + int max_attr; + int (*set)(struct nft_rule_expr *e, uint16_t type, const void *data, size_t data_len); + const void *(*get)(struct nft_rule_expr *e, uint16_t type, size_t *data_len); + int (*parse)(struct nft_rule_expr *e, struct nlattr *attr); + void (*build)(struct nlmsghdr *nlh, struct nft_rule_expr *e); + int (*snprintf)(char *buf, size_t len, struct nft_rule_expr *e); +}; + +struct expr_ops *nft_expr_ops_lookup(const char *name); + +#endif diff --git a/src/internal.h b/src/internal.h new file mode 100644 index 0000000..5ba7c76 --- /dev/null +++ b/src/internal.h @@ -0,0 +1,32 @@ +#ifndef INTERNAL_H +#define INTERNAL_H 1 + +#include "config.h" +#ifdef HAVE_VISIBILITY_HIDDEN +# define __visible __attribute__((visibility("default"))) +# define EXPORT_SYMBOL(x) typeof(x) (x) __visible +#else +# define EXPORT_SYMBOL +#endif + +#include "linux_list.h" + +#include <stdint.h> + +struct expr_ops; + +struct nft_rule_expr { + struct list_head head; + uint32_t flags; + struct expr_ops *ops; + uint8_t data[]; +}; + +#define SNPRINTF_BUFFER_SIZE(ret, size, len, offset) \ + size += ret; \ + if (ret > len) \ + ret = len; \ + offset += ret; \ + len -= ret; + +#endif diff --git a/src/libnftables.map b/src/libnftables.map new file mode 100644 index 0000000..4024764 --- /dev/null +++ b/src/libnftables.map @@ -0,0 +1,80 @@ +LIBNFTABLES_1.0 { +global: + nft_table_alloc; + nft_table_free; + nft_table_attr_set; + nft_table_attr_get; + nft_table_snprintf; + nft_table_nlmsg_build_hdr; + nft_table_nlmsg_build_payload; + nft_table_nlmsg_parse; + nft_table_list_alloc; + nft_table_list_free; + nft_table_list_add; + nft_table_list_iter_create; + nft_table_list_iter_next; + nft_table_list_iter_destroy; + + nft_chain_alloc; + nft_chain_free; + nft_chain_attr_set; + nft_chain_attr_set_u32; + nft_chain_attr_set_s32; + nft_chain_attr_set_u64; + nft_chain_attr_get; + nft_chain_attr_get_u32; + nft_chain_attr_get_s32; + nft_chain_attr_get_u64; + nft_chain_attr_get_str; + nft_chain_snprintf; + nft_chain_nlmsg_build_hdr; + nft_chain_nlmsg_build_payload; + nft_chain_nlmsg_parse; + nft_chain_list_alloc; + nft_chain_list_free; + nft_chain_list_add; + nft_chain_list_iter_create; + nft_chain_list_iter_next; + nft_chain_list_iter_destroy; + + nft_rule_alloc; + nft_rule_free; + nft_rule_attr_set; + nft_rule_attr_set_u16; + nft_rule_attr_set_str; + nft_rule_attr_get; + nft_rule_attr_get_u16; + nft_rule_attr_get_str; + nft_rule_snprintf; + nft_rule_nlmsg_build_hdr; + nft_rule_nlmsg_build_payload; + nft_rule_nlmsg_parse; + nft_rule_add_expr; + + nft_rule_expr_iter_create; + nft_rule_expr_iter_next; + nft_rule_expr_iter_destroy; + + nft_rule_expr_alloc; + nft_rule_expr_set; + nft_rule_expr_set_u8; + nft_rule_expr_set_u32; + nft_rule_expr_set_u64; + nft_rule_expr_set_str; + nft_rule_expr_get; + nft_rule_expr_get_u8; + nft_rule_expr_get_u32; + nft_rule_expr_get_u64; + nft_rule_expr_get_str; + nft_rule_expr_free; + + nft_rule_list_alloc; + nft_rule_list_free; + nft_rule_list_add; + nft_rule_list_iter_create; + nft_rule_list_iter_cur; + nft_rule_list_iter_next; + nft_rule_list_iter_destroy; + +local: *; +}; diff --git a/src/rule.c b/src/rule.c new file mode 100644 index 0000000..b0f7bb3 --- /dev/null +++ b/src/rule.c @@ -0,0 +1,452 @@ +/* + * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This code has been sponsored by Sophos Astaro <http://www.sophos.com> + */ +#include "internal.h" + +#include <time.h> +#include <endian.h> +#include <stdint.h> +#include <stdlib.h> +#include <string.h> +#include <netinet/in.h> + +#include <libmnl/libmnl.h> +#include <linux/netfilter/nfnetlink.h> +#include <linux/netfilter/nf_tables.h> + +#include <libnftables/rule.h> +#include <libnftables/expr.h> + +#include "linux_list.h" +#include "expr_ops.h" + +struct nft_rule { + struct list_head head; + + uint32_t flags; + char *table; + char *chain; + uint8_t family; + uint16_t handle; + + struct list_head expr_list; +}; + +struct nft_rule *nft_rule_alloc(void) +{ + struct nft_rule *r; + + r = calloc(1, sizeof(struct nft_rule)); + if (r == NULL) + return NULL; + + INIT_LIST_HEAD(&r->expr_list); + + return r; +} +EXPORT_SYMBOL(nft_rule_alloc); + +void nft_rule_free(struct nft_rule *r) +{ + if (r->table != NULL) + free(r->table); + if (r->chain != NULL) + free(r->chain); + + free(r); +} +EXPORT_SYMBOL(nft_rule_free); + +void nft_rule_attr_set(struct nft_rule *r, uint16_t attr, void *data) +{ + switch(attr) { + case NFT_RULE_ATTR_TABLE: + if (r->table) + free(r->table); + + r->table = strdup(data); + break; + case NFT_RULE_ATTR_CHAIN: + if (r->chain) + free(r->chain); + + r->chain = strdup(data); + break; + case NFT_RULE_ATTR_HANDLE: + r->handle = *((uint16_t *)data); + break; + default: + return; + } + r->flags |= (1 << attr); +} +EXPORT_SYMBOL(nft_rule_attr_set); + +void nft_rule_attr_set_u16(struct nft_rule *r, uint16_t attr, uint16_t val) +{ + nft_rule_attr_set(r, attr, &val); +} +EXPORT_SYMBOL(nft_rule_attr_set_u16); + +void nft_rule_attr_set_str(struct nft_rule *r, uint16_t attr, char *str) +{ + nft_rule_attr_set(r, attr, str); +} +EXPORT_SYMBOL(nft_rule_attr_set_str); + +void *nft_rule_attr_get(struct nft_rule *r, uint16_t attr) +{ + switch(attr) { + case NFT_RULE_ATTR_TABLE: + if (r->flags & (1 << NFT_RULE_ATTR_TABLE)) + return r->table; + else + return NULL; + break; + case NFT_RULE_ATTR_CHAIN: + if (r->flags & (1 << NFT_RULE_ATTR_CHAIN)) + return r->chain; + else + return NULL; + case NFT_RULE_ATTR_HANDLE: + if (r->flags & (1 << NFT_RULE_ATTR_HANDLE)) + return &r->handle; + else + return NULL; + break; + default: + return NULL; + } +} +EXPORT_SYMBOL(nft_rule_attr_get); + +const char *nft_rule_attr_get_str(struct nft_rule *r, uint16_t attr) +{ + return nft_rule_attr_get(r, attr); +} +EXPORT_SYMBOL(nft_rule_attr_get_str); + +uint16_t nft_rule_attr_get_u16(struct nft_rule *r, uint16_t attr) +{ + uint16_t val = *((uint32_t *)nft_rule_attr_get(r, attr)); + return val; +} +EXPORT_SYMBOL(nft_rule_attr_get_u16); + +struct nlmsghdr * +nft_rule_nlmsg_build_hdr(char *buf, uint16_t cmd, uint16_t family, + uint16_t type, uint32_t seq) +{ + struct nlmsghdr *nlh; + struct nfgenmsg *nfh; + + nlh = mnl_nlmsg_put_header(buf); + nlh->nlmsg_type = (NFNL_SUBSYS_NFTABLES << 8) | cmd; + nlh->nlmsg_flags = NLM_F_REQUEST | type; + nlh->nlmsg_seq = seq; + + nfh = mnl_nlmsg_put_extra_header(nlh, sizeof(struct nfgenmsg)); + nfh->nfgen_family = family; + nfh->version = NFNETLINK_V0; + nfh->res_id = 0; + + return nlh; +} +EXPORT_SYMBOL(nft_rule_nlmsg_build_hdr); + +void nft_rule_nlmsg_build_payload(struct nlmsghdr *nlh, struct nft_rule *r) +{ + struct nft_rule_expr *expr; + struct nlattr *nest; + + if (r->flags & (1 << NFT_RULE_ATTR_TABLE)) + mnl_attr_put_strz(nlh, NFTA_RULE_TABLE, r->table); + if (r->flags & (1 << NFT_RULE_ATTR_CHAIN)) + mnl_attr_put_strz(nlh, NFTA_RULE_CHAIN, r->chain); + if (r->flags & (1 << NFT_RULE_ATTR_HANDLE)) + mnl_attr_put_u16(nlh, NFTA_RULE_HANDLE, htons(r->handle)); + + nest = mnl_attr_nest_start(nlh, NFTA_RULE_EXPRESSIONS); + list_for_each_entry(expr, &r->expr_list, head) { + nft_rule_expr_build_payload(nlh, expr); + } + mnl_attr_nest_end(nlh, nest); +} +EXPORT_SYMBOL(nft_rule_nlmsg_build_payload); + +void nft_rule_add_expr(struct nft_rule *r, struct nft_rule_expr *expr) +{ + list_add_tail(&expr->head, &r->expr_list); +} +EXPORT_SYMBOL(nft_rule_add_expr); + +static int nft_rule_parse_attr_cb(const struct nlattr *attr, void *data) +{ + const struct nlattr **tb = data; + int type = mnl_attr_get_type(attr); + + if (mnl_attr_type_valid(attr, NFTA_RULE_MAX) < 0) + return MNL_CB_OK; + + switch(type) { + case NFTA_RULE_TABLE: + case NFTA_RULE_CHAIN: + if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + case NFTA_RULE_HANDLE: + if (mnl_attr_validate(attr, MNL_TYPE_U16) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + } + + tb[type] = attr; + return MNL_CB_OK; +} + +static int nft_rule_parse_expr_cb(const struct nlattr *attr, void *data) +{ + const struct nlattr **tb = data; + int type = mnl_attr_get_type(attr); + + if (mnl_attr_type_valid(attr, NFTA_EXPR_MAX) < 0) + return MNL_CB_OK; + + switch(type) { + case NFTA_EXPR_NAME: + if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + case NFTA_EXPR_DATA: + if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + } + + tb[type] = attr; + return MNL_CB_OK; +} + +static int nft_rule_parse_expr2(struct nlattr *attr, struct nft_rule *r) +{ + struct nlattr *tb[NFTA_EXPR_MAX+1] = {}; + struct nft_rule_expr *expr; + + if (mnl_attr_parse_nested(attr, nft_rule_parse_expr_cb, tb) < 0) + return -1; + + expr = nft_rule_expr_alloc(mnl_attr_get_str(tb[NFTA_EXPR_NAME])); + if (expr == NULL) + return -1; + + if (tb[NFTA_EXPR_DATA]) { + if (expr->ops->parse(expr, tb[NFTA_EXPR_DATA]) < 0) { + free(expr); + return -1; + } + } + list_add_tail(&expr->head, &r->expr_list); + + return 0; +} + +static int nft_rule_parse_expr(struct nlattr *nest, struct nft_rule *r) +{ + struct nlattr *attr; + + mnl_attr_for_each_nested(attr, nest) { + if (mnl_attr_get_type(attr) != NFTA_LIST_ELEM) + return -1; + + nft_rule_parse_expr2(attr, r); + } + return 0; +} + +int nft_rule_nlmsg_parse(const struct nlmsghdr *nlh, struct nft_rule *r) +{ + struct nlattr *tb[NFTA_RULE_MAX+1] = {}; + struct nfgenmsg *nfg = mnl_nlmsg_get_payload(nlh); + int ret = 0; + + mnl_attr_parse(nlh, sizeof(*nfg), nft_rule_parse_attr_cb, tb); + if (tb[NFTA_RULE_TABLE]) { + r->table = strdup(mnl_attr_get_str(tb[NFTA_RULE_TABLE])); + r->flags |= (1 << NFT_RULE_ATTR_TABLE); + } + if (tb[NFTA_RULE_CHAIN]) { + r->chain = strdup(mnl_attr_get_str(tb[NFTA_RULE_CHAIN])); + r->flags |= (1 << NFT_RULE_ATTR_CHAIN); + } + if (tb[NFTA_RULE_HANDLE]) { + r->handle = ntohs(mnl_attr_get_u16(tb[NFTA_RULE_HANDLE])); + r->flags |= (1 << NFT_RULE_ATTR_HANDLE); + } + if (tb[NFTA_RULE_EXPRESSIONS]) + ret = nft_rule_parse_expr(tb[NFTA_RULE_EXPRESSIONS], r); + + r->family = nfg->nfgen_family; + + return ret; +} +EXPORT_SYMBOL(nft_rule_nlmsg_parse); + +int nft_rule_snprintf(char *buf, size_t size, struct nft_rule *r, + uint32_t type, uint32_t flags) +{ + int ret; + struct nft_rule_expr *expr; + int len = size, offset = 0; + + ret = snprintf(buf, size, "family=%u table=%s chain=%s handle=%u ", + r->family, r->table, r->chain, r->handle); + SNPRINTF_BUFFER_SIZE(ret, size, len, offset); + + list_for_each_entry(expr, &r->expr_list, head) { + ret = snprintf(buf+offset, len, "%s ", expr->ops->name); + SNPRINTF_BUFFER_SIZE(ret, size, len, offset); + + ret = expr->ops->snprintf(buf+offset, len, expr); + SNPRINTF_BUFFER_SIZE(ret, size, len, offset); + } + ret = snprintf(buf+offset-1, len, "\n"); + SNPRINTF_BUFFER_SIZE(ret, size, len, offset); + + return ret; +} +EXPORT_SYMBOL(nft_rule_snprintf); + +struct nft_rule_expr_iter { + struct nft_rule *r; + struct nft_rule_expr *cur; +}; + +struct nft_rule_expr_iter *nft_rule_expr_iter_create(struct nft_rule *r) +{ + struct nft_rule_expr_iter *iter; + + iter = calloc(1, sizeof(struct nft_rule_expr_iter)); + if (iter == NULL) + return NULL; + + iter->r = r; + iter->cur = list_entry(r->expr_list.next, struct nft_rule_expr, head); + + return iter; +} +EXPORT_SYMBOL(nft_rule_expr_iter_create); + +struct nft_rule_expr *nft_rule_expr_iter_next(struct nft_rule_expr_iter *iter) +{ + struct nft_rule_expr *expr = iter->cur; + + /* get next expression, if any */ + iter->cur = list_entry(iter->cur->head.next, struct nft_rule_expr, head); + if (&iter->cur->head == iter->r->expr_list.next) + return NULL; + + return expr; +} +EXPORT_SYMBOL(nft_rule_expr_iter_next); + +void nft_rule_expr_iter_destroy(struct nft_rule_expr_iter *iter) +{ + free(iter); +} +EXPORT_SYMBOL(nft_rule_expr_iter_destroy); + +struct nft_rule_list { + struct list_head list; +}; + +struct nft_rule_list *nft_rule_list_alloc(void) +{ + struct nft_rule_list *list; + + list = calloc(1, sizeof(struct nft_rule_list)); + if (list == NULL) + return NULL; + + INIT_LIST_HEAD(&list->list); + + return list; +} +EXPORT_SYMBOL(nft_rule_list_alloc); + +void nft_rule_list_free(struct nft_rule_list *list) +{ + struct nft_rule *r, *tmp; + + list_for_each_entry_safe(r, tmp, &list->list, head) { + list_del(&r->head); + nft_rule_free(r); + } + free(list); +} +EXPORT_SYMBOL(nft_rule_list_free); + +void nft_rule_list_add(struct nft_rule *r, struct nft_rule_list *list) +{ + list_add_tail(&r->head, &list->list); +} +EXPORT_SYMBOL(nft_rule_list_add); + +struct nft_rule_list_iter { + struct nft_rule_list *list; + struct nft_rule *cur; +}; + +struct nft_rule_list_iter *nft_rule_list_iter_create(struct nft_rule_list *l) +{ + struct nft_rule_list_iter *iter; + + iter = calloc(1, sizeof(struct nft_rule_list_iter)); + if (iter == NULL) + return NULL; + + iter->list = l; + iter->cur = list_entry(l->list.next, struct nft_rule, head); + + return iter; +} +EXPORT_SYMBOL(nft_rule_list_iter_create); + +struct nft_rule *nft_rule_list_iter_cur(struct nft_rule_list_iter *iter) +{ + return iter->cur; +} +EXPORT_SYMBOL(nft_rule_list_iter_cur); + +struct nft_rule *nft_rule_list_iter_next(struct nft_rule_list_iter *iter) +{ + struct nft_rule *r = iter->cur; + + /* get next rule, if any */ + iter->cur = list_entry(iter->cur->head.next, struct nft_rule, head); + if (&iter->cur->head == iter->list->list.next) + return NULL; + + return r; +} +EXPORT_SYMBOL(nft_rule_list_iter_next); + +void nft_rule_list_iter_destroy(struct nft_rule_list_iter *iter) +{ + free(iter); +} +EXPORT_SYMBOL(nft_rule_list_iter_destroy); diff --git a/src/table.c b/src/table.c new file mode 100644 index 0000000..040bf9a --- /dev/null +++ b/src/table.c @@ -0,0 +1,212 @@ +/* + * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This code has been sponsored by Sophos Astaro <http://www.sophos.com> + */ +#include "internal.h" + +#include <time.h> +#include <endian.h> +#include <stdint.h> +#include <stdlib.h> +#include <string.h> +#include <netinet/in.h> + +#include <libmnl/libmnl.h> +#include <linux/netfilter/nfnetlink.h> +#include <linux/netfilter/nf_tables.h> + +#include <libnftables/table.h> + +struct nft_table { + struct list_head head; + + char *name; + uint8_t family; + uint32_t flags; /* FIXME missing */ +}; + +struct nft_table *nft_table_alloc(void) +{ + return calloc(1, sizeof(struct nft_table)); +} +EXPORT_SYMBOL(nft_table_alloc); + +void nft_table_free(struct nft_table *t) +{ + if (t->name != NULL) + free(t->name); + + free(t); +} +EXPORT_SYMBOL(nft_table_free); + +void nft_table_attr_set(struct nft_table *t, uint16_t attr, void *data) +{ + switch(attr) { + case NFT_TABLE_ATTR_NAME: + if (t->name) + free(t->name); + + t->name = strdup(data); + break; + } +} +EXPORT_SYMBOL(nft_table_attr_set); + +const void *nft_table_attr_get(struct nft_table *t, uint16_t attr) +{ + switch(attr) { + case NFT_TABLE_ATTR_NAME: + return t->name; + } + return NULL; +} +EXPORT_SYMBOL(nft_table_attr_get); + +struct nlmsghdr * +nft_table_nlmsg_build_hdr(char *buf, uint16_t cmd, uint16_t family, + uint16_t type, uint32_t seq) +{ + struct nlmsghdr *nlh; + struct nfgenmsg *nfh; + + nlh = mnl_nlmsg_put_header(buf); + nlh->nlmsg_type = (NFNL_SUBSYS_NFTABLES << 8) | cmd; + nlh->nlmsg_flags = NLM_F_REQUEST | type; + nlh->nlmsg_seq = seq; + + nfh = mnl_nlmsg_put_extra_header(nlh, sizeof(struct nfgenmsg)); + nfh->nfgen_family = family; + nfh->version = NFNETLINK_V0; + nfh->res_id = 0; + + return nlh; +} +EXPORT_SYMBOL(nft_table_nlmsg_build_hdr); + +void nft_table_nlmsg_build_payload(struct nlmsghdr *nlh, const struct nft_table *t) +{ + if (t->name != NULL) + mnl_attr_put_strz(nlh, NFTA_TABLE_NAME, t->name); +} +EXPORT_SYMBOL(nft_table_nlmsg_build_payload); + +static int nft_table_parse_attr_cb(const struct nlattr *attr, void *data) +{ + const struct nlattr **tb = data; + int type = mnl_attr_get_type(attr); + + if (mnl_attr_type_valid(attr, NFTA_TABLE_MAX) < 0) + return MNL_CB_OK; + + if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + + tb[type] = attr; + return MNL_CB_OK; +} + +int nft_table_nlmsg_parse(const struct nlmsghdr *nlh, struct nft_table *t) +{ + struct nlattr *tb[NFTA_TABLE_MAX+1] = {}; + struct nfgenmsg *nfg = mnl_nlmsg_get_payload(nlh); + + mnl_attr_parse(nlh, sizeof(*nfg), nft_table_parse_attr_cb, tb); + if (tb[NFTA_TABLE_NAME]) + t->name = strdup(mnl_attr_get_str(tb[NFTA_TABLE_NAME])); + + t->family = nfg->nfgen_family; + + return 0; +} +EXPORT_SYMBOL(nft_table_nlmsg_parse); + +int nft_table_snprintf(char *buf, size_t size, struct nft_table *t, + uint32_t type, uint32_t flags) +{ + return snprintf(buf, size, "table=%s family=%u\n", t->name, t->family); +} +EXPORT_SYMBOL(nft_table_snprintf); + +struct nft_table_list { + struct list_head list; +}; + +struct nft_table_list *nft_table_list_alloc(void) +{ + struct nft_table_list *list; + + list = calloc(1, sizeof(struct nft_table_list)); + if (list == NULL) + return NULL; + + INIT_LIST_HEAD(&list->list); + + return list; +} +EXPORT_SYMBOL(nft_table_list_alloc); + +void nft_table_list_free(struct nft_table_list *list) +{ + struct nft_table *r, *tmp; + + list_for_each_entry_safe(r, tmp, &list->list, head) { + list_del(&r->head); + nft_table_free(r); + } + free(list); +} +EXPORT_SYMBOL(nft_table_list_free); + +void nft_table_list_add(struct nft_table *r, struct nft_table_list *list) +{ + list_add_tail(&r->head, &list->list); +} +EXPORT_SYMBOL(nft_table_list_add); + +struct nft_table_list_iter { + struct nft_table_list *list; + struct nft_table *cur; +}; + +struct nft_table_list_iter *nft_table_list_iter_create(struct nft_table_list *l) +{ + struct nft_table_list_iter *iter; + + iter = calloc(1, sizeof(struct nft_table_list_iter)); + if (iter == NULL) + return NULL; + + iter->list = l; + iter->cur = list_entry(l->list.next, struct nft_table, head); + + return iter; +} +EXPORT_SYMBOL(nft_table_list_iter_create); + +struct nft_table *nft_table_list_iter_next(struct nft_table_list_iter *iter) +{ + struct nft_table *r = iter->cur; + + /* get next table, if any */ + iter->cur = list_entry(iter->cur->head.next, struct nft_table, head); + if (&iter->cur->head == iter->list->list.next) + return NULL; + + return r; +} +EXPORT_SYMBOL(nft_table_list_iter_next); + +void nft_table_list_iter_destroy(struct nft_table_list_iter *iter) +{ + free(iter); +} +EXPORT_SYMBOL(nft_table_list_iter_destroy); |