diff options
| -rw-r--r-- | include/rule.h | 6 | ||||
| -rw-r--r-- | src/netlink_delinearize.c | 36 | ||||
| -rw-r--r-- | src/netlink_linearize.c | 25 |
3 files changed, 62 insertions, 5 deletions
diff --git a/include/rule.h b/include/rule.h index cfe33a73..6dbde130 100644 --- a/include/rule.h +++ b/include/rule.h @@ -418,4 +418,10 @@ extern int do_command(struct netlink_ctx *ctx, struct cmd *cmd); extern int cache_update(enum cmd_ops cmd, struct list_head *msgs); extern void cache_release(void); +enum udata_type { + UDATA_TYPE_COMMENT, + __UDATA_TYPE_MAX, +}; +#define UDATA_TYPE_MAX (__UDATA_TYPE_MAX - 1) + #endif /* NFTABLES_RULE_H */ diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c index 848acd66..ca1c6e60 100644 --- a/src/netlink_delinearize.c +++ b/src/netlink_delinearize.c @@ -25,6 +25,7 @@ #include <utils.h> #include <erec.h> #include <sys/socket.h> +#include <libnftnl/udata.h> struct netlink_parse_ctx { struct list_head *msgs; @@ -1746,6 +1747,38 @@ static void rule_parse_postprocess(struct netlink_parse_ctx *ctx, struct rule *r } } +static int parse_udata_cb(const struct nftnl_udata *attr, void *data) +{ + unsigned char *value = nftnl_udata_get(attr); + uint8_t type = nftnl_udata_type(attr); + uint8_t len = nftnl_udata_len(attr); + const struct nftnl_udata **tb = data; + + switch (type) { + case UDATA_TYPE_COMMENT: + if (value[len - 1] != '\0') + return -1; + break; + default: + return 0; + } + tb[type] = attr; + return 0; +} + +static char *udata_get_comment(const void *data, uint32_t data_len) +{ + const struct nftnl_udata *tb[UDATA_TYPE_MAX + 1] = {}; + + if (nftnl_udata_parse(data, data_len, parse_udata_cb, tb) < 0) + return NULL; + + if (!tb[UDATA_TYPE_COMMENT]) + return NULL; + + return xstrdup(nftnl_udata_get(tb[UDATA_TYPE_COMMENT])); +} + struct rule *netlink_delinearize_rule(struct netlink_ctx *ctx, const struct nftnl_rule *nlr) { @@ -1773,8 +1806,7 @@ struct rule *netlink_delinearize_rule(struct netlink_ctx *ctx, uint32_t len; data = nftnl_rule_get_data(nlr, NFTNL_RULE_USERDATA, &len); - pctx->rule->comment = xmalloc(len); - memcpy((char *)pctx->rule->comment, data, len); + pctx->rule->comment = udata_get_comment(data, len); } nftnl_expr_foreach((struct nftnl_rule *)nlr, netlink_parse_expr, pctx); diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c index bb51de73..32630436 100644 --- a/src/netlink_linearize.c +++ b/src/netlink_linearize.c @@ -21,6 +21,7 @@ #include <netinet/in.h> #include <linux/netfilter.h> +#include <libnftnl/udata.h> struct netlink_linearize_ctx { @@ -1171,9 +1172,27 @@ void netlink_linearize_rule(struct netlink_ctx *ctx, struct nftnl_rule *nlr, list_for_each_entry(stmt, &rule->stmts, list) netlink_gen_stmt(&lctx, stmt); - if (rule->comment) - nftnl_rule_set_data(nlr, NFTNL_RULE_USERDATA, - rule->comment, strlen(rule->comment) + 1); + if (rule->comment) { + struct nftnl_udata_buf *udata; + uint32_t udlen; + void *ud; + + udata = nftnl_udata_buf_alloc(NFT_USERDATA_MAXLEN); + if (!udata) + memory_allocation_error(); + + if (!nftnl_udata_put_strz(udata, UDATA_TYPE_COMMENT, + rule->comment)) + memory_allocation_error(); + + udlen = nftnl_udata_buf_len(udata); + ud = xmalloc(udlen); + memcpy(ud, nftnl_udata_buf_data(udata), udlen); + + nftnl_rule_set_data(nlr, NFTNL_RULE_USERDATA, ud, udlen); + + nftnl_udata_buf_free(udata); + } netlink_dump_rule(nlr); } |