From 9cdef799414451258a62d088ba7cda6ff6035a88 Mon Sep 17 00:00:00 2001 From: Arturo Borrero Date: Thu, 26 Dec 2013 16:50:00 +0100 Subject: src: update meta expr This patch adds userspace support for the meta expression in the set flavour. This expression indicates that the packet has to be set with a property, currently one of mark, priority or nftrace. Signed-off-by: Arturo Borrero Gonzalez Signed-off-by: Pablo Neira Ayuso --- src/expr/meta.c | 116 ++++++++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 92 insertions(+), 24 deletions(-) (limited to 'src') diff --git a/src/expr/meta.c b/src/expr/meta.c index 88d2908..6899d69 100644 --- a/src/expr/meta.c +++ b/src/expr/meta.c @@ -28,7 +28,10 @@ struct nft_expr_meta { uint8_t key; /* enum nft_meta_keys */ - uint8_t dreg; /* enum nft_registers */ + union { + uint8_t dreg; /* enum nft_registers */ + uint8_t sreg; /* enum nft_registers */ + }; }; static int @@ -44,6 +47,9 @@ nft_rule_expr_meta_set(struct nft_rule_expr *e, uint16_t type, case NFT_EXPR_META_DREG: meta->dreg = *((uint32_t *)data); break; + case NFT_EXPR_META_SREG: + meta->sreg = *((uint32_t *)data); + break; default: return -1; } @@ -63,6 +69,9 @@ nft_rule_expr_meta_get(const struct nft_rule_expr *e, uint16_t type, case NFT_EXPR_META_DREG: *data_len = sizeof(meta->dreg); return &meta->dreg; + case NFT_EXPR_META_SREG: + *data_len = sizeof(meta->sreg); + return &meta->sreg; } return NULL; } @@ -78,6 +87,7 @@ static int nft_rule_expr_meta_cb(const struct nlattr *attr, void *data) switch(type) { case NFTA_META_KEY: case NFTA_META_DREG: + case NFTA_META_SREG: if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) { perror("mnl_attr_validate"); return MNL_CB_ERROR; @@ -98,6 +108,8 @@ nft_rule_expr_meta_build(struct nlmsghdr *nlh, struct nft_rule_expr *e) mnl_attr_put_u32(nlh, NFTA_META_KEY, htonl(meta->key)); if (e->flags & (1 << NFT_EXPR_META_DREG)) mnl_attr_put_u32(nlh, NFTA_META_DREG, htonl(meta->dreg)); + else if (e->flags & (1 << NFT_EXPR_META_SREG)) + mnl_attr_put_u32(nlh, NFTA_META_SREG, htonl(meta->sreg)); } static int @@ -116,6 +128,9 @@ nft_rule_expr_meta_parse(struct nft_rule_expr *e, struct nlattr *attr) if (tb[NFTA_META_DREG]) { meta->dreg = ntohl(mnl_attr_get_u32(tb[NFTA_META_DREG])); e->flags |= (1 << NFT_EXPR_META_DREG); + } else if (tb[NFTA_META_SREG]) { + meta->sreg = ntohl(mnl_attr_get_u32(tb[NFTA_META_SREG])); + e->flags |= (1 << NFT_EXPR_META_SREG); } return 0; @@ -164,14 +179,9 @@ static int nft_rule_expr_meta_json_parse(struct nft_rule_expr *e, json_t *root) { #ifdef JSON_PARSING const char *key_str; - uint32_t reg; + uint32_t reg, sreg; int key; - if (nft_jansson_parse_reg(root, "dreg", NFT_TYPE_U32, ®) < 0) - return -1; - - nft_rule_expr_set_u32(e, NFT_EXPR_META_DREG, reg); - key_str = nft_jansson_parse_str(root, "key"); if (key_str == NULL) return -1; @@ -182,6 +192,19 @@ static int nft_rule_expr_meta_json_parse(struct nft_rule_expr *e, json_t *root) nft_rule_expr_set_u32(e, NFT_EXPR_META_KEY, key); + if (nft_jansson_node_exist(root, "dreg")) { + if (nft_jansson_parse_reg(root, "dreg", NFT_TYPE_U32, ®) < 0) + return -1; + + nft_rule_expr_set_u32(e, NFT_EXPR_META_DREG, reg); + } else if (nft_jansson_node_exist(root, "sreg")) { + if (nft_jansson_parse_reg(root, "sreg", + NFT_TYPE_U32, &sreg) < 0) + return -1; + + nft_rule_expr_set_u32(e, NFT_EXPR_META_SREG, sreg); + } + return 0; #else errno = EOPNOTSUPP; @@ -198,13 +221,6 @@ static int nft_rule_expr_meta_xml_parse(struct nft_rule_expr *e, mxml_node_t *tr int32_t reg; int key; - reg = nft_mxml_reg_parse(tree, "dreg", MXML_DESCEND_FIRST); - if (reg < 0) - return -1; - - meta->dreg = reg; - e->flags |= (1 << NFT_EXPR_META_DREG); - key_str = nft_mxml_str_parse(tree, "key", MXML_DESCEND_FIRST, NFT_XML_MAND); if (key_str == NULL) @@ -217,6 +233,19 @@ static int nft_rule_expr_meta_xml_parse(struct nft_rule_expr *e, mxml_node_t *tr meta->key = key; e->flags |= (1 << NFT_EXPR_META_KEY); + reg = nft_mxml_reg_parse(tree, "dreg", MXML_DESCEND_FIRST); + if (reg >= 0) { + meta->dreg = reg; + e->flags |= (1 << NFT_EXPR_META_DREG); + } else { + reg = nft_mxml_reg_parse(tree, "sreg", MXML_DESCEND_FIRST); + if (reg < 0) + return -1; + + meta->sreg = reg; + e->flags |= (1 << NFT_EXPR_META_SREG); + } + return 0; #else errno = EOPNOTSUPP; @@ -225,23 +254,62 @@ static int nft_rule_expr_meta_xml_parse(struct nft_rule_expr *e, mxml_node_t *tr } static int -nft_rule_expr_meta_snprintf(char *buf, size_t len, uint32_t type, - uint32_t flags, struct nft_rule_expr *e) +nft_rule_expr_meta_snprintf_default(char *buf, size_t len, uint32_t flags, + struct nft_rule_expr *e) +{ + struct nft_expr_meta *meta = nft_expr_data(e); + + if (e->flags & (1 << NFT_EXPR_META_SREG)) + return snprintf(buf, len, "set %s with reg %u ", + meta_key2str(meta->key), meta->sreg); + + return snprintf(buf, len, "load %s => reg %u ", + meta_key2str(meta->key), meta->dreg); +} + +static int +nft_rule_expr_meta_snprintf_xml(char *buf, size_t len, uint32_t flags, + struct nft_rule_expr *e) { struct nft_expr_meta *meta = nft_expr_data(e); + if (e->flags & (1 << NFT_EXPR_META_SREG)) + return snprintf(buf, len, "%s%u", + meta_key2str(meta->key), meta->sreg); + + return snprintf(buf, len, "%u%s", + meta->dreg, meta_key2str(meta->key)); +} + +static int +nft_rule_expr_meta_snprintf_json(char *buf, size_t len, uint32_t flags, + struct nft_rule_expr *e) +{ + struct nft_expr_meta *meta = nft_expr_data(e); + + if (e->flags & (1 << NFT_EXPR_META_SREG)) + return snprintf(buf, len, "\"key\":\"%s\"," + "\"sreg\":%u", + meta_key2str(meta->key), meta->sreg); + + return snprintf(buf, len, "\"dreg\":%u,\"key\":\"%s\"", + meta->dreg, meta_key2str(meta->key)); +} + +static int +nft_rule_expr_meta_snprintf(char *buf, size_t len, uint32_t type, + uint32_t flags, struct nft_rule_expr *e) +{ switch(type) { case NFT_OUTPUT_DEFAULT: - return snprintf(buf, len, "load %s => reg %u ", - meta_key2str(meta->key), meta->dreg); + return nft_rule_expr_meta_snprintf_default(buf, len, + flags, e); case NFT_OUTPUT_XML: - return snprintf(buf, len, "%u" - "%s", - meta->dreg, meta_key2str(meta->key)); + return nft_rule_expr_meta_snprintf_xml(buf, len, + flags, e); case NFT_OUTPUT_JSON: - return snprintf(buf, len, "\"dreg\":%u," - "\"key\":\"%s\"", - meta->dreg, meta_key2str(meta->key)); + return nft_rule_expr_meta_snprintf_json(buf, len, + flags, e); default: break; } -- cgit v1.2.3