src: update meta expr

This patch adds userspace support for the meta expression in the set flavour.

This expression indicates that the packet has to be set with a property,
currently one of mark, priority or nftrace.

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 92 insertions, 24 deletions

diff --git a/src/expr/meta.c b/src/expr/meta.c
index 88d2908..6899d69 100644
--- a/src/expr/meta.c
+++ b/src/expr/meta.c
@@ -28,7 +28,10 @@
 
 struct nft_expr_meta {
 	uint8_t			key;	/* enum nft_meta_keys */
-	uint8_t			dreg;	/* enum nft_registers */
+	union {
+		uint8_t		dreg;	/* enum nft_registers */
+		uint8_t		sreg;   /* enum nft_registers */
+	};
 };
 
 static int
@@ -44,6 +47,9 @@ nft_rule_expr_meta_set(struct nft_rule_expr *e, uint16_t type,
 	case NFT_EXPR_META_DREG:
 		meta->dreg = *((uint32_t *)data);
 		break;
+	case NFT_EXPR_META_SREG:
+		meta->sreg = *((uint32_t *)data);
+		break;
 	default:
 		return -1;
 	}
@@ -63,6 +69,9 @@ nft_rule_expr_meta_get(const struct nft_rule_expr *e, uint16_t type,
 	case NFT_EXPR_META_DREG:
 		*data_len = sizeof(meta->dreg);
 		return &meta->dreg;
+	case NFT_EXPR_META_SREG:
+		*data_len = sizeof(meta->sreg);
+		return &meta->sreg;
 	}
 	return NULL;
 }
@@ -78,6 +87,7 @@ static int nft_rule_expr_meta_cb(const struct nlattr *attr, void *data)
 	switch(type) {
 	case NFTA_META_KEY:
 	case NFTA_META_DREG:
+	case NFTA_META_SREG:
 		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) {
 			perror("mnl_attr_validate");
 			return MNL_CB_ERROR;
@@ -98,6 +108,8 @@ nft_rule_expr_meta_build(struct nlmsghdr *nlh, struct nft_rule_expr *e)
 		mnl_attr_put_u32(nlh, NFTA_META_KEY, htonl(meta->key));
 	if (e->flags & (1 << NFT_EXPR_META_DREG))
 		mnl_attr_put_u32(nlh, NFTA_META_DREG, htonl(meta->dreg));
+	else if (e->flags & (1 << NFT_EXPR_META_SREG))
+		mnl_attr_put_u32(nlh, NFTA_META_SREG, htonl(meta->sreg));
 }
 
 static int
@@ -116,6 +128,9 @@ nft_rule_expr_meta_parse(struct nft_rule_expr *e, struct nlattr *attr)
 	if (tb[NFTA_META_DREG]) {
 		meta->dreg = ntohl(mnl_attr_get_u32(tb[NFTA_META_DREG]));
 		e->flags |= (1 << NFT_EXPR_META_DREG);
+	} else if (tb[NFTA_META_SREG]) {
+		meta->sreg = ntohl(mnl_attr_get_u32(tb[NFTA_META_SREG]));
+		e->flags |= (1 << NFT_EXPR_META_SREG);
 	}
 
 	return 0;
@@ -164,14 +179,9 @@ static int nft_rule_expr_meta_json_parse(struct nft_rule_expr *e, json_t *root)
 {
 #ifdef JSON_PARSING
 	const char *key_str;
-	uint32_t reg;
+	uint32_t reg, sreg;
 	int key;
 
-	if (nft_jansson_parse_reg(root, "dreg", NFT_TYPE_U32, &reg) < 0)
-                return -1;
-
-	nft_rule_expr_set_u32(e, NFT_EXPR_META_DREG, reg);
-
 	key_str = nft_jansson_parse_str(root, "key");
 	if (key_str == NULL)
 		return -1;
@@ -182,6 +192,19 @@ static int nft_rule_expr_meta_json_parse(struct nft_rule_expr *e, json_t *root)
 
 	nft_rule_expr_set_u32(e, NFT_EXPR_META_KEY, key);
 
+	if (nft_jansson_node_exist(root, "dreg")) {
+		if (nft_jansson_parse_reg(root, "dreg", NFT_TYPE_U32, &reg) < 0)
+			return -1;
+
+		nft_rule_expr_set_u32(e, NFT_EXPR_META_DREG, reg);
+	} else if (nft_jansson_node_exist(root, "sreg")) {
+		if (nft_jansson_parse_reg(root, "sreg",
+					  NFT_TYPE_U32, &sreg) < 0)
+			return -1;
+
+		nft_rule_expr_set_u32(e, NFT_EXPR_META_SREG, sreg);
+	}
+
 	return 0;
 #else
 	errno = EOPNOTSUPP;
@@ -198,13 +221,6 @@ static int nft_rule_expr_meta_xml_parse(struct nft_rule_expr *e, mxml_node_t *tr
 	int32_t reg;
 	int key;
 
-	reg = nft_mxml_reg_parse(tree, "dreg", MXML_DESCEND_FIRST);
-	if (reg < 0)
-                return -1;
-
-	meta->dreg = reg;
-	e->flags |= (1 << NFT_EXPR_META_DREG);
-
 	key_str = nft_mxml_str_parse(tree, "key", MXML_DESCEND_FIRST,
 				     NFT_XML_MAND);
 	if (key_str == NULL)
@@ -217,6 +233,19 @@ static int nft_rule_expr_meta_xml_parse(struct nft_rule_expr *e, mxml_node_t *tr
 	meta->key = key;
 	e->flags |= (1 << NFT_EXPR_META_KEY);
 
+	reg = nft_mxml_reg_parse(tree, "dreg", MXML_DESCEND_FIRST);
+	if (reg >= 0) {
+		meta->dreg = reg;
+		e->flags |= (1 << NFT_EXPR_META_DREG);
+	} else {
+		reg = nft_mxml_reg_parse(tree, "sreg", MXML_DESCEND_FIRST);
+		if (reg < 0)
+			return -1;
+
+		meta->sreg = reg;
+		e->flags |= (1 << NFT_EXPR_META_SREG);
+	}
+
 	return 0;
 #else
 	errno = EOPNOTSUPP;
@@ -225,23 +254,62 @@ static int nft_rule_expr_meta_xml_parse(struct nft_rule_expr *e, mxml_node_t *tr
 }
 
 static int
-nft_rule_expr_meta_snprintf(char *buf, size_t len, uint32_t type,
-			    uint32_t flags, struct nft_rule_expr *e)
+nft_rule_expr_meta_snprintf_default(char *buf, size_t len, uint32_t flags,
+				    struct nft_rule_expr *e)
+{
+	struct nft_expr_meta *meta = nft_expr_data(e);
+
+	if (e->flags & (1 << NFT_EXPR_META_SREG))
+		return snprintf(buf, len, "set %s with reg %u ",
+				meta_key2str(meta->key), meta->sreg);
+
+	return snprintf(buf, len, "load %s => reg %u ",
+			meta_key2str(meta->key), meta->dreg);
+}
+
+static int
+nft_rule_expr_meta_snprintf_xml(char *buf, size_t len, uint32_t flags,
+				struct nft_rule_expr *e)
 {
 	struct nft_expr_meta *meta = nft_expr_data(e);
 
+	if (e->flags & (1 << NFT_EXPR_META_SREG))
+		return snprintf(buf, len, "<key>%s</key><sreg>%u</sreg>",
+				meta_key2str(meta->key), meta->sreg);
+
+	return snprintf(buf, len, "<dreg>%u</dreg><key>%s</key>",
+			meta->dreg, meta_key2str(meta->key));
+}
+
+static int
+nft_rule_expr_meta_snprintf_json(char *buf, size_t len, uint32_t flags,
+				 struct nft_rule_expr *e)
+{
+	struct nft_expr_meta *meta = nft_expr_data(e);
+
+	if (e->flags & (1 << NFT_EXPR_META_SREG))
+		return snprintf(buf, len, "\"key\":\"%s\","
+				"\"sreg\":%u",
+				meta_key2str(meta->key), meta->sreg);
+
+	return snprintf(buf, len, "\"dreg\":%u,\"key\":\"%s\"",
+			meta->dreg, meta_key2str(meta->key));
+}
+
+static int
+nft_rule_expr_meta_snprintf(char *buf, size_t len, uint32_t type,
+			    uint32_t flags, struct nft_rule_expr *e)
+{
 	switch(type) {
 	case NFT_OUTPUT_DEFAULT:
-		return snprintf(buf, len, "load %s => reg %u ",
-				meta_key2str(meta->key), meta->dreg);
+		return nft_rule_expr_meta_snprintf_default(buf, len,
+							   flags, e);
 	case NFT_OUTPUT_XML:
-		return snprintf(buf, len, "<dreg>%u</dreg>"
-					  "<key>%s</key>",
-				meta->dreg, meta_key2str(meta->key));
+		return nft_rule_expr_meta_snprintf_xml(buf, len,
+						       flags, e);
 	case NFT_OUTPUT_JSON:
-		return snprintf(buf, len, "\"dreg\":%u,"
-					  "\"key\":\"%s\"",
-				meta->dreg, meta_key2str(meta->key));
+		return nft_rule_expr_meta_snprintf_json(buf, len,
+							flags, e);
 	default:
 		break;
 	}