summaryrefslogtreecommitdiffstats
path: root/src/set.c
Commit message (Collapse)AuthorAgeFilesLines
* set: fix set nlmsg desc parsingArturo Borrero2014-09-181-20/+2
| | | | | | | | In commit ff62959("set: add support for set mechanism selection") the support for parsing the nested attribute (NFTA_SET_DESC) was incorrect. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: add support for set mechanism selectionArturo Borrero2014-07-241-3/+160
| | | | | | | | | | This patch adds support to select the set mechanism. The kernel support was added in commit: c50b960 netfilter: nf_tables: implement proper set selection Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: stricter netlink attribute length validationPablo Neira Ayuso2014-07-201-8/+4
| | | | | | | | | | | | If the kernel sends us different data length for a given attribute, stop further processing and indicate that an ABI breakage has ocurred. This is an example of the (hypothetical) message that is shown in that case: nf_tables kernel ABI is broken, contact your vendor. table.c:214 reason: Numerical result out of range Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: Free memory in the same function that is reservedAna Rey2014-06-111-11/+10
| | | | | | | Free memory in the same function that is reserved. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: set: Do not print unset values in jsonAna Rey2014-06-111-48/+67
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It changes the parse and the snprint functions to omit unset values. This json file is gotten for a set: { "set": { "name": "mi6set3", "table": "test6", "flags": "0", "family": "unknown", "key_type": "0", "key_len": "0", "set_elem": [ { "flags": "0", "key": { "data_reg": { "type": "value", "len": "16", "data0": "0x000080fe", "data1": "0x00000000", "data2": "0xffb30202", "data3": "0x89001efe" Now, This json file is gotten for a set without unset elements. { "set": { "name": "mi6set3", "table": "test6", "family": "unknown", "set_elem": [ { "key": { "data_reg": { "type": "value", "len": "16", "data0": "0x000080fe", "data1": "0x00000000", "data2": "0xffb30202", "data3": "0x89001efe" [ Note: These fields are unset when they are obtained from the set element information --pablo. ] Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: set: Do not print unset values in xmlAna Rey2014-06-111-27/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It changes the parse and the snprint functions to omit unset values. This xml file is gotten for a set: <set> <family>unknown</family> <table>test</table> <name>miset</name> <flags>0</flags> <key_type>0</key_type> <key_len>0</key_len> <set_elem> <flags>0</flags> <key> <data_reg type="value"> <len>4</len> <data0>0x0401a8c0</data0> </data_reg> </key> </set_elem> <set_elem> <flags>0</flags> <key> <data_reg type="value"> <len>4</len> <data0>0x0501a8c0</data0> </data_reg> </key> </set_elem> </set> Now, this xml file is gotten without unset values: <set> <family>unknown</family> <table>test</table> <name>miset</name> <set_elem> <key> <data_reg type="value"> <len>4</len> <data0>0x00000002</data0> </data_reg> </key> </set_elem> <set_elem> <key> <data_reg type="value"> <len>4</len> <data0>0x0401a8c0</data0> </data_reg> </key> </set_elem> </set> Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: set: Use nft_rule_expr_set_* in the xml parsing codeAna Rey2014-06-111-30/+16
| | | | | | | Code refactoring to use nft_rule_expr_set_* in parse functions. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: add set ID supportPablo Neira Ayuso2014-05-191-0/+14
| | | | | | | Add the set ID (u32) which allows us to uniquely identify the set in the batch that is sent to kernel-space. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add flag to add event wrapping in output functionsArturo Borrero2014-04-261-5/+25
| | | | | | | | | | | | | | This patch uses the flag option of each output function to print an event wrapper string in each object. In order to use this functionality, the caller must pass the corresponding flags: NFT_OF_EVENT_NEW / NFT_OF_EVENT_DEL. (I have slightly refactorized the original code to add the xml/json header and footer --pablo). Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix bogus assertion for unset attributesPablo Neira Ayuso2014-04-071-2/+2
| | | | | | | | | | | | If you try to obtain an unset attribute, you hit an assertion error that should not happen. Fix this by checking if the attribute is unset, otherwise skip the assertion checking. Now that we have that nft_assert takes the data parameter, we can also validate if someone is using the setter passing NULL, which is illegal. So let's add an assertion for that as well. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: check if netlink parsing failsArturo Borrero2014-02-271-3/+4
| | | | | | | | We have to check if mnl_attr_parse() returns an error, which means that it failed to validate and retrieve the attributes. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_*_attr_{set|get}_data interfacePablo Neira Ayuso2014-02-271-3/+39
| | | | | | | | | | | | This patch adds two functions that allows you to validate the size of the attribute. This new functions provide a replacement for nft_rule_attr_set and nft_rule_attr_get. The data_len parameter was already passed to the {_set|_get} funcion in expressions. For consistency, add nft_rule_expr_{set|get}_data alias. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: early attribute type validation in nft_*_attr_setPablo Neira Ayuso2014-02-271-2/+3
| | | | | | | | This allows us to remove the default case in the switch, which show help to spot missing attribute support since gcc will spot a compilation warning. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rename library to libnftnllibnftnl-1.0.0Pablo Neira Ayuso2014-01-201-1/+1
| | | | | | We plan to use this library name for the higher layer library. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: xml: data_type/data_len are optionalArturo Borrero2014-01-151-13/+20
| | | | | | | | | | Don't print data_type and data_len if they aren't set. Also, they are optional when parsing. Printing and parsing unconditionally leads to false values and other errors. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add interface to parse from fileArturo Borrero2014-01-091-2/+11
| | | | | | | | This patch adds a new API to parse rule-set expressed in XML/JSON from a file. A new enum nft_parse_input type is added for this purpose. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rework and generalize the build/parse systemArturo Borrero2014-01-091-10/+16
| | | | | | | | | | | The intention behind this patch is to prepare the introduction of the new API that will allow us to parse files that contain the rule-sets expressed in XML/JSON format. This adds the NFT_PARSE_BUFFER that indicates that the input is provided in a buffer, which is what we currently support. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: add json parsing to APIArturo Borrero2014-01-081-1/+2
| | | | | | | | | Add missing support in the API function to parse a JSON set_elem. I've renamed the main JSON parsing function to prevent clashing. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: new error reporting approach for XML/JSON parsersÁlvaro Neira Ayuso2014-01-061-30/+40
| | | | | | | | | | | | | | I have added a new structure for reporting some errors in parser that we can't cover with errno. In this patch, we have three errors that we can't cover with errno: NFT_PARSE_EBADINPUT : Bad XML/JSON format in the input NFT_PARSE_EMISSINGNODE : Missing node in our input NFT_PARSE_EBADTYPE : Wrong type value in a node Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: consolidate netlink build header functionPablo Neira Ayuso2013-11-241-21/+0
| | | | | | | | | Add new function nft_nlmsg_build_hdr which consolidates all existing functions to build headers per object. They basically look the same. This patch still provides aliases for consistency in the naming approach. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: unify parse and output typesÁlvaro Neira Ayuso2013-11-141-7/+7
| | | | | | | | | Unify parse and output types that are redundant to all existing nftables objects. Thus, all NFT_*_O_[XML|JSON|DEFAULT] are merged into NFT_OUTPUT_[JSON|XML] and NFT_PARSE_[JSON|XML]. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add fprintf API functionsArturo Borrero2013-11-031-0/+13
| | | | | | | | | | | | | | Now it's possible to print directly from libnftables to a file or other stream. The caller must explicitly print the trailing '\n' in this call. The error reporting of fprintf (< 0) is respected. However, we have already print some information in case that the default (plain text) output is used, that output is mostly intended for debugging so it should not be a problem. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix possible null pointer dereference in nft_*_attr_get_*Phil Oester2013-10-271-2/+2
| | | | | | | | | | | | | | As reported by John Sager, nft_set_attr_get_u32 can cause a segfault because nft_set_attr_get can return NULL. Check for a non-NULL pointer before dereferencing. This closes netfilter bugzilla #868. [ I have mangled this patch to solve possible null pointer dereference with get operations with rule objects --pablo ] Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: json: remove spacesÁlvaro Neira Ayuso2013-10-171-8/+8
| | | | | | | | | | | | Remove all the spaces from the JSON output to reduce the size of the output string, this also provides a consistent output in table, chain, rule and set. As Stephen Hemminger suggested, better to squash the output to consume as less bytes as possible. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add low-level ruleset APIArturo Borrero2013-10-011-1/+1
| | | | | | | | This patch adds a low level ruleset API for libnftables. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: json: fix returned string lengthPablo Neira Ayuso2013-09-271-0/+2
| | | | | | | | Similar to (e7c068d rule: json: fix returned string length). Based on patch from Arturo. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: snprintf: fix buffer lengthsArturo Borrero2013-09-271-15/+15
| | | | | | | | Use 'len' instead of 'size' since we need the remaining unused bytes in the buffer, not its total size. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_*_list_delPablo Neira Ayuso2013-09-171-0/+6
| | | | | | | This allows us to delete object from the list, note that nft_chain_list_del already existed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: refactor XML parsing codeArturo Borrero Gonzalez2013-09-161-25/+25
| | | | | | | | | | | This patch refactors nft_*_xml_parse to provide a new intermediate function nft_mxml_parse_* which will allow us to navigate an entire XML tree containing a ruleset without xml2text2xml conversions. While at it, I added a helper to build the XML tree and validate the top node name. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* src: xml: add parsing optional/mandatory flagArturo Borrero Gonzalez2013-09-161-13/+16
| | | | | | | | | | | Add an optional/mandatory flag to XML parsing. In some elements (ie regs), no flag is used because is always mandatory. DATA_NONE is created to indicate a non-parsed data_reg. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: json: refactor json parsing to allow tree based navigationÁlvaro Neira Ayuso2013-09-131-11/+21
| | | | | | | | | | This patch refactors nft_*_json_parse to provide a new intermediate function nft_jansson_parse_chain which will allows us to navigate the entire json tree containing the ruleset. Signed-off-by: Álvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: xml: fix key_type parsingArturo Borrero2013-09-051-1/+1
| | | | | | | Bug introduced by myself at 44928cd5 [set: add XML parsing] Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: Add json parser supportÁlvaro Neira Ayuso2013-08-281-0/+99
| | | | | | | Add function for parsing set in format JSON. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: constify nft_*_parse input dataArturo Borrero Gonzalez2013-08-221-2/+3
| | | | | | | Since the input string is not changing, let's make it constant. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: don't duplicate string in nft_table_xml_parsePablo Neira Ayuso2013-08-141-2/+2
| | | | | | | | | | | With this patch, nft_table_xml_parse does not duplicate the string anymore, which is what most callers seem to need. This fixes memleaks in several places in the code. Thus, this patch also adapts the code to duplicate it when needed. Based on patch from Arturo Borrero. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: cleanup set element parsingPablo Neira Ayuso2013-08-071-3/+4
| | | | | | | | | | | | Move nft_mxml_set_elem_parse to set_elem.c to improve readability, thus, we don't need to jump from set_elem.c to mxml.c to see how the parsing is done. I have also refactored some common parsing code in the new helper function nft_mxml_set_elem_parse, that avoids conversions from XML tree to text and then again back to tree. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: delete unneeded XML prefixesArturo Borrero Gonzalez2013-08-071-7/+7
| | | | | | | | | | | | | | | | | | | | This patch changes some XML nodes with prefixes, as the example below ilustrates. Before: <rule> <rule_flags/> <rule_family/> <rule> After: <rule> <flags> <family> </rule> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: xml: use nft_mxml_family_parseArturo Borrero Gonzalez2013-08-061-7/+2
| | | | | | | Use nft_mxml_family_parse() to parse the family. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove useless castingPablo Neira Ayuso2013-08-061-9/+4
| | | | | | | | Not needed anymore after constification. Based on patch from Arturo Borrero. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fully constify nft_*_get functionsPablo Neira Ayuso2013-08-061-1/+1
| | | | | | | | | We have several char * field that were not constify to avoid gcc compilation warnings when calling free. Since (99d2574 src: add xfree and use it), we can fully constify these objects fields without trouble. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add xfree and use itPablo Neira Ayuso2013-08-061-11/+11
| | | | | | | | This patch adds xfree, a replacement of free that accepts const pointers. This helps to remove ugly castings that you usually need to calm down gcc. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove version from XML and JSON representationsPablo Neira Ayuso2013-07-261-12/+3
| | | | | | | | | | | | | | | | | | | | | | This patch removes the version XML node and the version JSON field in all our existing objects. The current versioning approach consists of adding a version field to every object representation in XML and JSON. While listing my entire rule-set, one can notice that this approach is too bloated. Once the library enters stable stage, if we need to obsolete a XML node and a JSON field, we can follow this procedure: 1) Remove the XML node and the JSON field from the output, so fresh outputs will not contain the old ones anymore. 2) Do not remove the parsing of the old XML node and the JSON field inmediately. We have to keep supporting the parsing for a while to avoid breaking the interpretion of old XML/JSON files. We can spot a warning to warn about it, so users generate a fresh output again. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: add XML parsingArturo Borrero2013-07-261-0/+140
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Sets are now parsed, following this previous snprintf pattern: <set> <set_name>string</set_name> <set_table>table</set_table> <set_xml_version>int</set_xml_version> <set_flags>uint32_t</set_flags> <key_type>uint32_t</key_type> <key_len>size_t</key_len> <data_type>uint32_t</data_type> <data_len>size_t</data_len> <set_elem> <set_elem_flags>uint32_t</set_elem_flags> <set_elem_key> <data_reg type="value"> <len></len> <dataN></dataN> </data_reg> </set_elem_key> <set_elem_data> <data_reg type="xx"> [...] </data_reg> </set_elem_data> </set_elem> </set> Signed-off-by: Arturo Borrero González <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: xml: change XML attributes to nodes.Arturo Borrero2013-07-261-14/+12
| | | | | | | | | | | | | | | | This patch changes all XML attributes to XML nodes in nft_set. In order to avoid issues regarding XML nodes with the same name but different meanings, I've followed this pattern for the new elements: <set> <set_table>string</set_table> <set_name>string</set_name> [...] </set> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: constify parameter of nft_*_is_setEric Leblond2013-07-191-1/+1
| | | | | | | | The functions nft_*_attr_is_set() is doing no modification so it is possible to type it to const. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: simplify getter logicPablo Neira Ayuso2013-07-181-26/+11
| | | | | | | | This patch refactors the getter code to simplify it. The default cases have been removed so gcc will spot a warning if an attribute is not handled appropriately. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_*_list_add_tailPablo Neira Ayuso2013-07-161-1/+7
| | | | | | | This redefines the meaning of nft_*_list_add to prepend, before this patch it was appending, which was semantically wrong. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: json: fix incomplete outputÁlvaro Neira Ayuso2013-07-161-6/+17
| | | | | | | | | | | In (bf39c53 set: add json output), the json support for sets was incomplete: * version, family, key_type, key_len, data_type, data_len were not included. * Now I use nft_data_reg_snprintf for printing the key and data Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_*_list_is_empty() functionsArturo Borrero2013-07-151-0/+6
| | | | | | | | | This functions check if a given nft_*_list is empty or not. I found this quite useful while working with a full ruleset. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: add xml outputArturo Borrero2013-07-061-2/+41
| | | | | | | This patch adds XML output for sets. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>