From 00c179b4c9f9f9394cc6f79e5f2a68410631fd72 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Fri, 3 Aug 2012 17:31:48 +0200 Subject: initial version of libnftables It adds support for table, chain and rule handling. This also includes expression handling for each rule. Signed-off-by: Pablo Neira Ayuso --- src/chain.c | 484 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 484 insertions(+) create mode 100644 src/chain.c (limited to 'src/chain.c') diff --git a/src/chain.c b/src/chain.c new file mode 100644 index 0000000..fd95a64 --- /dev/null +++ b/src/chain.c @@ -0,0 +1,484 @@ +/* + * (C) 2012 by Pablo Neira Ayuso + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This code has been sponsored by Sophos Astaro + */ +#include "internal.h" + +#include +#include +#include +#include +#include +#include + +#include +#include +#include + +#include + +struct nft_chain { + struct list_head head; + + char *name; + char *table; + uint8_t family; + uint32_t policy; + uint32_t hooknum; + int32_t prio; + uint32_t use; + uint64_t packets; + uint64_t bytes; + uint32_t flags; +}; + +struct nft_chain *nft_chain_alloc(void) +{ + return calloc(1, sizeof(struct nft_chain)); +} +EXPORT_SYMBOL(nft_chain_alloc); + +void nft_chain_free(struct nft_chain *c) +{ + if (c->name != NULL) + free(c->name); + if (c->table != NULL) + free(c->table); + + free(c); +} +EXPORT_SYMBOL(nft_chain_free); + +void nft_chain_attr_set(struct nft_chain *c, uint16_t attr, void *data) +{ + switch(attr) { + case NFT_CHAIN_ATTR_NAME: + if (c->name) + free(c->name); + + c->name = strdup(data); + break; + case NFT_CHAIN_ATTR_TABLE: + if (c->table) + free(c->table); + + c->table = strdup(data); + break; + case NFT_CHAIN_ATTR_HOOKNUM: + memcpy(&c->hooknum, data, sizeof(c->hooknum)); + break; + case NFT_CHAIN_ATTR_PRIO: + memcpy(&c->prio, data, sizeof(c->prio)); + break; + case NFT_CHAIN_ATTR_POLICY: + c->policy = *((uint32_t *)data); + break; + case NFT_CHAIN_ATTR_USE: + /* cannot be set, ignore it */ + return; + case NFT_CHAIN_ATTR_BYTES: + c->bytes = *((uint64_t *)data); + break; + case NFT_CHAIN_ATTR_PACKETS: + c->bytes = *((uint64_t *)data); + break; + default: + return; + } + c->flags |= (1 << attr); +} +EXPORT_SYMBOL(nft_chain_attr_set); + +void nft_chain_attr_set_u32(struct nft_chain *c, uint16_t attr, uint32_t data) +{ + nft_chain_attr_set(c, attr, &data); +} +EXPORT_SYMBOL(nft_chain_attr_set_u32); + +void nft_chain_attr_set_s32(struct nft_chain *c, uint16_t attr, int32_t data) +{ + nft_chain_attr_set(c, attr, &data); +} +EXPORT_SYMBOL(nft_chain_attr_set_s32); + +void nft_chain_attr_set_u64(struct nft_chain *c, uint16_t attr, uint64_t data) +{ + nft_chain_attr_set(c, attr, &data); +} +EXPORT_SYMBOL(nft_chain_attr_set_u64); + +void *nft_chain_attr_get(struct nft_chain *c, uint16_t attr) +{ + switch(attr) { + case NFT_CHAIN_ATTR_NAME: + if (c->flags & (1 << NFT_CHAIN_ATTR_NAME)) + return c->name; + else + return NULL; + break; + case NFT_CHAIN_ATTR_TABLE: + if (c->flags & (1 << NFT_CHAIN_ATTR_TABLE)) + return c->table; + else + return NULL; + case NFT_CHAIN_ATTR_HOOKNUM: + if (c->flags & (1 << NFT_CHAIN_ATTR_HOOKNUM)) + return &c->hooknum; + else + return NULL; + break; + case NFT_CHAIN_ATTR_PRIO: + if (c->flags & (1 << NFT_CHAIN_ATTR_PRIO)) + return &c->prio; + else + return NULL; + break; + case NFT_CHAIN_ATTR_POLICY: + if (c->flags & (1 << NFT_CHAIN_ATTR_POLICY)) + return &c->policy; + else + return NULL; + break; + case NFT_CHAIN_ATTR_USE: + if (c->flags & (1 << NFT_CHAIN_ATTR_USE)) + return &c->use; + else + return NULL; + break; + case NFT_CHAIN_ATTR_BYTES: + if (c->flags & (1 << NFT_CHAIN_ATTR_BYTES)) + return &c->bytes; + else + return NULL; + break; + case NFT_CHAIN_ATTR_PACKETS: + if (c->flags & (1 << NFT_CHAIN_ATTR_PACKETS)) + return &c->packets; + else + return NULL; + break; + default: + return NULL; + } +} +EXPORT_SYMBOL(nft_chain_attr_get); + +const char *nft_chain_attr_get_str(struct nft_chain *c, uint16_t attr) +{ + return nft_chain_attr_get(c, attr); +} +EXPORT_SYMBOL(nft_chain_attr_get_str); + +uint32_t nft_chain_attr_get_u32(struct nft_chain *c, uint16_t attr) +{ + uint32_t *val = nft_chain_attr_get(c, attr); + return val ? *val : 0; +} +EXPORT_SYMBOL(nft_chain_attr_get_u32); + +int32_t nft_chain_attr_get_s32(struct nft_chain *c, uint16_t attr) +{ + int32_t *val = nft_chain_attr_get(c, attr); + return val ? *val : 0; +} +EXPORT_SYMBOL(nft_chain_attr_get_s32); + +uint64_t nft_chain_attr_get_u64(struct nft_chain *c, uint16_t attr) +{ + uint64_t *val = nft_chain_attr_get(c, attr); + return val ? *val : 0; +} +EXPORT_SYMBOL(nft_chain_attr_get_u64); + +struct nlmsghdr * +nft_chain_nlmsg_build_hdr(char *buf, uint16_t cmd, uint16_t family, + uint16_t type, uint32_t seq) +{ + struct nlmsghdr *nlh; + struct nfgenmsg *nfh; + + nlh = mnl_nlmsg_put_header(buf); + nlh->nlmsg_type = (NFNL_SUBSYS_NFTABLES << 8) | cmd; + nlh->nlmsg_flags = NLM_F_REQUEST | type; + nlh->nlmsg_seq = seq; + + nfh = mnl_nlmsg_put_extra_header(nlh, sizeof(struct nfgenmsg)); + nfh->nfgen_family = family; + nfh->version = NFNETLINK_V0; + nfh->res_id = 0; + + return nlh; +} +EXPORT_SYMBOL(nft_chain_nlmsg_build_hdr); + +void nft_chain_nlmsg_build_payload(struct nlmsghdr *nlh, const struct nft_chain *c) +{ + if (c->flags & (1 << NFT_CHAIN_ATTR_TABLE)) + mnl_attr_put_strz(nlh, NFTA_CHAIN_TABLE, c->table); + if (c->flags & (1 << NFT_CHAIN_ATTR_NAME)) + mnl_attr_put_strz(nlh, NFTA_CHAIN_NAME, c->name); + if ((c->flags & (1 << NFT_CHAIN_ATTR_HOOKNUM)) && + (c->flags & (1 << NFT_CHAIN_ATTR_PRIO))) { + struct nlattr *nest; + + nest = mnl_attr_nest_start(nlh, NFTA_CHAIN_HOOK); + mnl_attr_put_u32(nlh, NFTA_HOOK_HOOKNUM, htonl(c->hooknum)); + mnl_attr_put_u32(nlh, NFTA_HOOK_PRIORITY, htonl(c->prio)); + mnl_attr_nest_end(nlh, nest); + } + if (c->flags & (1 << NFT_CHAIN_ATTR_POLICY)) + mnl_attr_put_u32(nlh, NFTA_CHAIN_POLICY, htonl(c->policy)); + if ((c->flags & (1 << NFT_CHAIN_ATTR_PACKETS)) && + (c->flags & (1 << NFT_CHAIN_ATTR_BYTES))) { + struct nlattr *nest; + + nest = mnl_attr_nest_start(nlh, NFTA_CHAIN_COUNTERS); + mnl_attr_put_u64(nlh, NFTA_COUNTER_PACKETS, be64toh(c->packets)); + mnl_attr_put_u64(nlh, NFTA_COUNTER_BYTES, be64toh(c->bytes)); + mnl_attr_nest_end(nlh, nest); + } +} +EXPORT_SYMBOL(nft_chain_nlmsg_build_payload); + +static int nft_chain_parse_attr_cb(const struct nlattr *attr, void *data) +{ + const struct nlattr **tb = data; + int type = mnl_attr_get_type(attr); + + if (mnl_attr_type_valid(attr, NFTA_CHAIN_MAX) < 0) + return MNL_CB_OK; + + switch(type) { + case NFTA_CHAIN_NAME: + case NFTA_CHAIN_TABLE: + if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + case NFTA_CHAIN_HOOK: + case NFTA_CHAIN_COUNTERS: + if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + case NFTA_CHAIN_POLICY: + case NFTA_CHAIN_USE: + if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + } + + tb[type] = attr; + return MNL_CB_OK; +} + +static int nft_chain_parse_counters_cb(const struct nlattr *attr, void *data) +{ + const struct nlattr **tb = data; + int type = mnl_attr_get_type(attr); + + if (mnl_attr_type_valid(attr, NFTA_COUNTER_MAX) < 0) + return MNL_CB_OK; + + switch(type) { + case NFTA_COUNTER_BYTES: + case NFTA_COUNTER_PACKETS: + if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + } + + tb[type] = attr; + return MNL_CB_OK; +} + +static int nft_chain_parse_counters(struct nlattr *attr, struct nft_chain *c) +{ + struct nlattr *tb[NFTA_COUNTER_MAX+1] = {}; + + if (mnl_attr_parse_nested(attr, nft_chain_parse_counters_cb, tb) < 0) + return -1; + + if (tb[NFTA_COUNTER_PACKETS]) { + c->packets = be64toh(mnl_attr_get_u64(tb[NFTA_COUNTER_PACKETS])); + c->flags |= (1 << NFT_CHAIN_ATTR_PACKETS); + } + if (tb[NFTA_COUNTER_BYTES]) { + c->bytes = be64toh(mnl_attr_get_u64(tb[NFTA_COUNTER_BYTES])); + c->flags |= (1 << NFT_CHAIN_ATTR_BYTES); + } + + return 0; +} +static int nft_chain_parse_hook_cb(const struct nlattr *attr, void *data) +{ + const struct nlattr **tb = data; + int type = mnl_attr_get_type(attr); + + if (mnl_attr_type_valid(attr, NFTA_HOOK_MAX) < 0) + return MNL_CB_OK; + + switch(type) { + case NFTA_HOOK_HOOKNUM: + case NFTA_HOOK_PRIORITY: + if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) { + perror("mnl_attr_validate"); + return MNL_CB_ERROR; + } + break; + } + + tb[type] = attr; + return MNL_CB_OK; +} + +static int nft_chain_parse_hook(struct nlattr *attr, struct nft_chain *c) +{ + struct nlattr *tb[NFTA_HOOK_MAX+1] = {}; + + if (mnl_attr_parse_nested(attr, nft_chain_parse_hook_cb, tb) < 0) + return -1; + + if (tb[NFTA_HOOK_HOOKNUM]) { + c->hooknum = ntohl(mnl_attr_get_u32(tb[NFTA_HOOK_HOOKNUM])); + c->flags |= (1 << NFT_CHAIN_ATTR_HOOKNUM); + } + if (tb[NFTA_HOOK_PRIORITY]) { + c->prio = ntohl(mnl_attr_get_u32(tb[NFTA_HOOK_PRIORITY])); + c->flags |= (1 << NFT_CHAIN_ATTR_PRIO); + } + + return 0; +} + +int nft_chain_nlmsg_parse(const struct nlmsghdr *nlh, struct nft_chain *c) +{ + struct nlattr *tb[NFTA_CHAIN_MAX+1] = {}; + struct nfgenmsg *nfg = mnl_nlmsg_get_payload(nlh); + int ret = 0; + + mnl_attr_parse(nlh, sizeof(*nfg), nft_chain_parse_attr_cb, tb); + if (tb[NFTA_CHAIN_NAME]) { + c->name = strdup(mnl_attr_get_str(tb[NFTA_CHAIN_NAME])); + c->flags |= (1 << NFT_CHAIN_ATTR_NAME); + } + if (tb[NFTA_CHAIN_TABLE]) { + c->table = strdup(mnl_attr_get_str(tb[NFTA_CHAIN_TABLE])); + c->flags |= (1 << NFT_CHAIN_ATTR_TABLE); + } + if (tb[NFTA_CHAIN_HOOK]) + ret = nft_chain_parse_hook(tb[NFTA_CHAIN_HOOK], c); + if (tb[NFTA_CHAIN_POLICY]) { + c->policy = ntohl(mnl_attr_get_u32(tb[NFTA_CHAIN_POLICY])); + c->flags |= (1 << NFT_CHAIN_ATTR_POLICY); + } + if (tb[NFTA_CHAIN_USE]) { + c->use = ntohl(mnl_attr_get_u32(tb[NFTA_CHAIN_USE])); + c->flags |= (1 << NFT_CHAIN_ATTR_USE); + } + if (tb[NFTA_CHAIN_COUNTERS]) + ret = nft_chain_parse_counters(tb[NFTA_CHAIN_COUNTERS], c); + + c->family = nfg->nfgen_family; + + return ret; +} +EXPORT_SYMBOL(nft_chain_nlmsg_parse); + +int nft_chain_snprintf(char *buf, size_t size, struct nft_chain *c, + uint32_t type, uint32_t flags) +{ + return snprintf(buf, size, "family=%u table=%s chain=%s " + "hook=%u prio=%d policy=%d use=%d " + "packets=%lu bytes=%lu\n", + c->family, c->table, c->name, c->hooknum, + c->prio, c->policy, c->use, c->packets, c->bytes); +} +EXPORT_SYMBOL(nft_chain_snprintf); + +struct nft_chain_list { + struct list_head list; +}; + +struct nft_chain_list *nft_chain_list_alloc(void) +{ + struct nft_chain_list *list; + + list = calloc(1, sizeof(struct nft_chain_list)); + if (list == NULL) + return NULL; + + INIT_LIST_HEAD(&list->list); + + return list; +} +EXPORT_SYMBOL(nft_chain_list_alloc); + +void nft_chain_list_free(struct nft_chain_list *list) +{ + struct nft_chain *r, *tmp; + + list_for_each_entry_safe(r, tmp, &list->list, head) { + list_del(&r->head); + nft_chain_free(r); + } + free(list); +} +EXPORT_SYMBOL(nft_chain_list_free); + +void nft_chain_list_add(struct nft_chain *r, struct nft_chain_list *list) +{ + list_add_tail(&r->head, &list->list); +} +EXPORT_SYMBOL(nft_chain_list_add); + +struct nft_chain_list_iter { + struct nft_chain_list *list; + struct nft_chain *cur; +}; + +struct nft_chain_list_iter *nft_chain_list_iter_create(struct nft_chain_list *l) +{ + struct nft_chain_list_iter *iter; + + iter = calloc(1, sizeof(struct nft_chain_list_iter)); + if (iter == NULL) + return NULL; + + iter->list = l; + iter->cur = list_entry(l->list.next, struct nft_chain, head); + + return iter; +} +EXPORT_SYMBOL(nft_chain_list_iter_create); + +struct nft_chain *nft_chain_list_iter_next(struct nft_chain_list_iter *iter) +{ + struct nft_chain *r = iter->cur; + + /* get next chain, if any */ + iter->cur = list_entry(iter->cur->head.next, struct nft_chain, head); + if (&iter->cur->head == iter->list->list.next) + return NULL; + + return r; +} +EXPORT_SYMBOL(nft_chain_list_iter_next); + +void nft_chain_list_iter_destroy(struct nft_chain_list_iter *iter) +{ + free(iter); +} +EXPORT_SYMBOL(nft_chain_list_iter_destroy); -- cgit v1.2.3