summaryrefslogtreecommitdiffstats
path: root/src/table.c
Commit message (Collapse)AuthorAgeFilesLines
* json: fixed some leaks in the json parsing functionÁlvaro Neira Ayuso2013-08-171-6/+10
| | | | | | | | | This patch fixes some leaks in the json parsing function. After this patch, we use nft_jansson_free_root. This function uses json_decref and it decrements the reference count and it releases the node if needed. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: don't duplicate string in nft_table_xml_parsePablo Neira Ayuso2013-08-141-1/+1
| | | | | | | | | | | With this patch, nft_table_xml_parse does not duplicate the string anymore, which is what most callers seem to need. This fixes memleaks in several places in the code. Thus, this patch also adapts the code to duplicate it when needed. Based on patch from Arturo Borrero. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* jansson: Add nft_jansson_family functionÁlvaro Neira Ayuso2013-08-091-7/+2
| | | | | | | Refactor some existing code with the new function nft_jansson_family. Signed-off-by: Alvaro Neira Ayuso Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: json: delete unneeded JSON prefixesÁlvaro Neira Ayuso2013-08-091-2/+2
| | | | | | | This patch adapts JSON nodes to mimic current XML node tags. Signed-off-by: Alvaro Neira Ayuso Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: delete unneeded XML prefixesArturo Borrero Gonzalez2013-08-071-2/+2
| | | | | | | | | | | | | | | | | | | | This patch changes some XML nodes with prefixes, as the example below ilustrates. Before: <rule> <rule_flags/> <rule_family/> <rule> After: <rule> <flags> <family> </rule> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: consolidate error path in table and chain objectsPablo Neira Ayuso2013-08-061-20/+12
| | | | | | Remove a good bunch of LOC with this cleanup. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: use nodes instead of attributesArturo Borrero Gonzalez2013-08-061-15/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When working with XML, it's desirable to work with nodes better than attributes. Table/chain/rules had attributes in their XML representation, and this patch transform those to nodes, ie: Before: <table name="filter"> <family>ip</family> <table_flags>0</table_flags> </table> After: <table> <name>filter</name> <family>ip</family> <table_flags>0</table_flags> </table> While at it: * There was a lot of redundant code that is now collapsed with the new nft_mxml_family_parse() helper function. * I've added a small fix: additional validation for the name of the current XML object, and also replace raw strtol calls to nft_strtoi. * Also, all XML testfiles are updated to keep passing the parsing tests and mantain the repo in consisten state. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fully constify nft_*_get functionsPablo Neira Ayuso2013-08-061-1/+1
| | | | | | | | | We have several char * field that were not constify to avoid gcc compilation warnings when calling free. Since (99d2574 src: add xfree and use it), we can fully constify these objects fields without trouble. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add xfree and use itPablo Neira Ayuso2013-08-061-9/+9
| | | | | | | | This patch adds xfree, a replacement of free that accepts const pointers. This helps to remove ugly castings that you usually need to calm down gcc. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: table/chain delete propertiesArturo Borrero Gonzalez2013-08-051-12/+5
| | | | | | | | | | This patch deletes the <properties> node in chain and table XML objects. For this to work, the first tree search with MXML_DESCEND_FIRST flag is moved to the next node. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: remove the properties node in Json outputÁlvaro Neira Ayuso2013-07-311-10/+2
| | | | | | | | I have removed the properties node from table because it provides no relevant information. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* jansson: Add helper function for building the tree and use itÁlvaro Neira Ayuso2013-07-311-11/+3
| | | | | | | | Add a helper function that parses and returns the jansson tree, use it in the table parser. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove version from XML and JSON representationsPablo Neira Ayuso2013-07-261-30/+3
| | | | | | | | | | | | | | | | | | | | | | This patch removes the version XML node and the version JSON field in all our existing objects. The current versioning approach consists of adding a version field to every object representation in XML and JSON. While listing my entire rule-set, one can notice that this approach is too bloated. Once the library enters stable stage, if we need to obsolete a XML node and a JSON field, we can follow this procedure: 1) Remove the XML node and the JSON field from the output, so fresh outputs will not contain the old ones anymore. 2) Do not remove the parsing of the old XML node and the JSON field inmediately. We have to keep supporting the parsing for a while to avoid breaking the interpretion of old XML/JSON files. We can spot a warning to warn about it, so users generate a fresh output again. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: json: fix returned errno value while parsingPablo Neira Ayuso2013-07-251-10/+14
| | | | | | | Instead of returning ERANGE all the time, let functions set errno accordingly and set EINVAL otherwise. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: Add json parser supportÁlvaro Neira Ayuso2013-07-251-0/+69
| | | | | | | Add function for parsing tables in format JSON Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: consolidate common XML code via nft_mxml_num_parseArturo Borrero2013-07-251-11/+2
| | | | | | | | | | | This patch moves common XML parsing code to nft_mxml_num_parse(). To handle this, the nft_strtoi() helper fuction is included. I've changed some MXML_DESCEND[_FIRST] flags to avoid match a nested node under some circumstances, ie, matching two nodes with the same name that are descendant. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove default case from nft_*_attr_unsetPablo Neira Ayuso2013-07-211-7/+6
| | | | | | | | This patch removes the default case in nft_*_attr_unset, thus, the compiler will spot a warning if we add a new attribute in the future and you forget to handle it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: constify parameter of nft_*_is_setEric Leblond2013-07-191-1/+1
| | | | | | | | The functions nft_*_attr_is_set() is doing no modification so it is possible to type it to const. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: simplify getter logicPablo Neira Ayuso2013-07-181-12/+7
| | | | | | | | This patch refactors the getter code to simplify it. The default cases have been removed so gcc will spot a warning if an attribute is not handled appropriately. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_*_list_add_tailPablo Neira Ayuso2013-07-161-1/+7
| | | | | | | This redefines the meaning of nft_*_list_add to prepend, before this patch it was appending, which was semantically wrong. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_*_list_is_empty() functionsArturo Borrero2013-07-151-0/+6
| | | | | | | | | This functions check if a given nft_*_list is empty or not. I found this quite useful while working with a full ruleset. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: improve default text outputGiuseppe Longo2013-07-051-1/+1
| | | | | | | | | | | | | This patch improves default plain text output by mimicing the default output of libnl-nft. While at it, several %lu has been translated to use %"PRIu64" for correctness. [ I have added the policy to string translation --pablo ] Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support JSON format in chain, rule and expressionsÁlvaro Neira Ayuso2013-06-291-2/+2
| | | | | | | While at it, order possible switch cases of _snprintf. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: convert family values to stringArturo Borrero2013-06-271-13/+13
| | | | | | | | | | | | This patch translates family values to display a string: * ip if AF_INET * ip6 if AF_INET6 * bridge if AF_BRIDGE * arp if 0 Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: set NFT_*_ATTR_FAMILY in nft_*_parse functionPablo Neira Ayuso2013-06-171-0/+1
| | | | | | This attribute was not approapriately set in most cases. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_*_attr_is_setPablo Neira Ayuso2013-06-171-0/+6
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_*_list_foreachPablo Neira Ayuso2013-06-171-0/+16
| | | | | | This patch adds a simplied iterator interface. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix nft_*_unset function attribute that don't release dataPablo Neira Ayuso2013-06-071-0/+3
| | | | | | | | | | | In (dde2039 src: add nft_*_unset functions), I mangled Arturo's patch to add a default case, but he was intentionally not adding it to unset attributes that require no memory releases. I prefered to add the attributes explicitly in the switch rather on failing back on the default action. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_*_unset functionsArturo Borrero Gonzalez2013-06-071-1/+19
| | | | | | | | These functions unset the given attribute in each object and release the data if needed. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: add function to export tables in JSON formatAlvaro Neira Ayuso2013-06-071-0/+18
| | | | | Signed-off-by: Alvaro Neira <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: add versioningArturo Borrero Gonzalez2013-06-061-2/+16
| | | | | | | Add version to XML chunks in case of future changes. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for XML parsingArturo Borrero Gonzalez2013-05-231-0/+93
| | | | | | | | | | | | | | | | | | | This patch adds capabilities for parsing a XML table/chain/rule. Some comments: * The XML data is case sensitive (so <chain>asd</chain> != <chain>ASD</chain> != <CHAIN>asd</CHAIN>) * All exported functions receive XML and return an object (table|chain|rule). * To compile the lib with XML parsing support, run './configure --with-xml-parsing' * XML parsing is done with libmxml (http://minixml.org). XML parsing depends on this external lib, this dependency is optional at compile time. NOTE: expr/target and expr/match binary data are exported. [ Fixed to compile without --with-xml-parsing --pablo ] Signed-off-by: Arturo Borrero González <arturo.borrero.glez@gmail.com>
* table: add nft_table_attr_[set|table]_strPablo Neira Ayuso2013-05-161-0/+12
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: delete exporting internal flags in XMLArturo Borrero Gonzalez2013-05-031-2/+1
| | | | | | | | The uint32_t flags attribute is internal, so no need to export via XML. Signed-off-by: Arturo Borrero González <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove trailing \n from all nft_*_snprintf functionsPablo Neira Ayuso2013-04-191-1/+1
| | | | | | The caller should add it in case it needs it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove trailing newlines, tabs and spaces from XML formatArturo Borrero Gonzalez2013-04-191-7/+7
| | | | | | | | Delete all \n and \t from XML output, any reasonable XML viewer already does the nifty formatting for us. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: constify nft_*_attr_set and nft_*_attr_set_strPablo Neira Ayuso2013-04-141-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow to get and to set NFT_*_ATTR_FAMILYArturo Borrero Gonzalez2013-04-021-0/+8
| | | | | | | | | | This patch adds support to get and set the attribute NFT_{TABLE|CHAIN|RULE}_ATTR_FAMILY. I found this useful when parsing a XML table|chain|rule (future patch). Signed-off-by: Arturo Borrero <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: change XML output format to use element instead of attributesArturo Borrero Gonzalez2013-02-141-2/+3
| | | | | | | | | | | | | | | | | | | There are some problems in using attributes: * they cannot contain multiple values (child elements can) * they are not easily expandable (for future changes) * they cannot describe structures (child elements can) * they are more difficult to manipulate by program code * attribute values are not easy to test against a DTD Extracted from "XML Elements vs. Attributes" at: http://www.w3schools.com/dtd/dtd_el_vs_attr.asp For more information. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add XML output supportArturo Borrero Gonzalez2013-02-081-2/+27
| | | | | Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: add nft_table_attr_set_u32 and nft_table_attr_get_u32Pablo Neira Ayuso2012-11-111-0/+13
| | | | | | Useful to obtain recently added table flags. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: support NFTA_TABLE_FLAGSPablo Neira Ayuso2012-11-111-4/+30
| | | | | | | This patch adds support for the table flags, only one is possible at the moment (NFT_TABLE_F_DORMANT). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: use internal flags for attributePablo Neira Ayuso2012-11-081-6/+13
| | | | | | Fix missing use of internal flags for table objects in attributes. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* initial version of libnftablesPablo Neira Ayuso2012-10-111-0/+212
It adds support for table, chain and rule handling. This also includes expression handling for each rule. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>