summaryrefslogtreecommitdiffstats
path: root/src/set_elem.c
Commit message (Collapse)AuthorAgeFilesLines
* src: split internal.h is smaller filesPablo Neira Ayuso2015-02-171-3/+0
| | | | | | | | | The internal.h file started being a small file with private definitions. Its size has been increasing over time more and more, so let's split this in small header files that map to the corresponding class where the functions belong to. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add command tag in JSON/XML export supportAlvaro Neira Ayuso2015-02-101-6/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, we can't do incremental updates via JSON/XML. This patch enriches the existing output to indicate the kind of update that you want to perform. So, if we have a ruleset like: table ip filter { chain input { type filter hook input priority 0; } } The new output looks like: {"nftables":[{"add":[{"table":{"name":"filter",...}}]}]} ^^^^^ Where we explicitly indicate that we want to add a table. We support all the actions that we can do with nft, they are: - Add, delete and flush tables and chains. - Add, delete, replace and insert rules. - Add and delete sets. - Add and delete set elements. - Flush ruleset. You only need to add the command tag: {"nftables":[{"delete":[{...}, {...},...}]}]} ^^^^^^^^ The possible command tags that you can use are "add", "delete", "insert", "replace" and "flush". - Flush table or chain, eg.: {"nftables":[{"flush":[{"table":{"name":...}}]}]} - Delete table, chain, set or rule: {"nftables":[{"delete":[{"chain":{"name":...}]}]} - Replace a rule (you have to specify the handle): {"nftables":[{"replace":[{"rule":{...}}]}]} - Insert a rule: {"nftables":[{"insert":[{"rule":{...}}]}]} Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: don't create iterator with empty listAlvaro Neira2015-01-151-1/+8
| | | | | | | | | | Currently, we create iterator without test if the list is empty. If the list is empty, we have a crash when we set up the current element. With this patch, we test if the list is empty before to create the iterator. If the list is empty the iterator return NULL. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: use proper free functionArturo Borrero2014-08-181-1/+1
| | | | | | | | Let's use the proper free function to liberate the set_elem, so we avoid potential memory leaks. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: add nft_set_elems_nlmsg_build_payload_iter()Pablo Neira Ayuso2014-07-251-11/+72
| | | | | | | | | This new interface allows you to put as many set elements as possible into a netlink message. The iterator stores the last element that has fit into a netlink message, so you can continue adding more set elements across several netlink messages. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: stricter netlink attribute length validationPablo Neira Ayuso2014-07-201-16/+8
| | | | | | | | | | | | If the kernel sends us different data length for a given attribute, stop further processing and indicate that an ABI breakage has ocurred. This is an example of the (hypothetical) message that is shown in that case: nf_tables kernel ABI is broken, contact your vendor. table.c:214 reason: Numerical result out of range Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: set: Do not print unset values in jsonAna Rey2014-06-111-9/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It changes the parse and the snprint functions to omit unset values. This json file is gotten for a set: { "set": { "name": "mi6set3", "table": "test6", "flags": "0", "family": "unknown", "key_type": "0", "key_len": "0", "set_elem": [ { "flags": "0", "key": { "data_reg": { "type": "value", "len": "16", "data0": "0x000080fe", "data1": "0x00000000", "data2": "0xffb30202", "data3": "0x89001efe" Now, This json file is gotten for a set without unset elements. { "set": { "name": "mi6set3", "table": "test6", "family": "unknown", "set_elem": [ { "key": { "data_reg": { "type": "value", "len": "16", "data0": "0x000080fe", "data1": "0x00000000", "data2": "0xffb30202", "data3": "0x89001efe" [ Note: These fields are unset when they are obtained from the set element information --pablo. ] Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: set: Do not print unset values in xmlAna Rey2014-06-111-19/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It changes the parse and the snprint functions to omit unset values. This xml file is gotten for a set: <set> <family>unknown</family> <table>test</table> <name>miset</name> <flags>0</flags> <key_type>0</key_type> <key_len>0</key_len> <set_elem> <flags>0</flags> <key> <data_reg type="value"> <len>4</len> <data0>0x0401a8c0</data0> </data_reg> </key> </set_elem> <set_elem> <flags>0</flags> <key> <data_reg type="value"> <len>4</len> <data0>0x0501a8c0</data0> </data_reg> </key> </set_elem> </set> Now, this xml file is gotten without unset values: <set> <family>unknown</family> <table>test</table> <name>miset</name> <set_elem> <key> <data_reg type="value"> <len>4</len> <data0>0x00000002</data0> </data_reg> </key> </set_elem> <set_elem> <key> <data_reg type="value"> <len>4</len> <data0>0x0401a8c0</data0> </data_reg> </key> </set_elem> </set> Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: set: Use nft_rule_expr_set_* in the xml parsing codeAna Rey2014-06-111-5/+5
| | | | | | | Code refactoring to use nft_rule_expr_set_* in parse functions. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: add set ID supportPablo Neira Ayuso2014-05-191-0/+6
| | | | | | | Add the set ID (u32) which allows us to uniquely identify the set in the batch that is sent to kernel-space. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add flag to add event wrapping in output functionsArturo Borrero2014-04-261-5/+19
| | | | | | | | | | | | | | This patch uses the flag option of each output function to print an event wrapper string in each object. In order to use this functionality, the caller must pass the corresponding flags: NFT_OF_EVENT_NEW / NFT_OF_EVENT_DEL. (I have slightly refactorized the original code to add the xml/json header and footer --pablo). Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set-elem: fix a memory leakAna Rey2014-04-161-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | Valgrind reports the following memory leak: valgrind --leak-check=full ./nft-parsing-test -f jsonfiles/63-set.json ==7131== HEAP SUMMARY: ==7131== in use at exit: 2 bytes in 1 blocks ==7131== total heap usage: 155 allocs, 154 frees, 6,497 bytes allocated ==7131== ==7131== 2 bytes in 1 blocks are definitely lost in loss record 1 of 1 ==7131== at 0x4C274A0: malloc (vg_replace_malloc.c:291) ==7131== by 0x590B829: strdup (strdup.c:42) ==7131== by 0x4E4341A: nft_data_reg_json_parse (data_reg.c:55) ==7131== by 0x4E4093A: nft_jansson_data_reg_parse (jansson.c:231) ==7131== by 0x4E40A1B: nft_jansson_et_elem_parse (jansson.c:257) ==7131== by 0x4E3CECA: nft_jansson_parse_set (set.c:398) ==7131== by 0x4E3EC65: nft_ruleset_do_parse (ruleset.c:263) ==7131== by 0x401479: test_json (nft-parsing-test.c:129) ==7131== by 0x4017C2: execute_test_file (nft-parsing-test.c:270) ==7131== by 0x400EBB: main (nft-parsing-test.c:332) Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: parse family from Netlink messageArturo Borrero2014-04-071-0/+3
| | | | | | | Lets obtain the family from the Netlink message. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elems: delete unexisting exported symbolArturo Borrero2014-03-261-1/+0
| | | | | | | There is no function called 'nft_set_elem_nlmsg_parse()' Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: check if netlink parsing failsArturo Borrero2014-02-271-2/+9
| | | | | | | | We have to check if mnl_attr_parse() returns an error, which means that it failed to validate and retrieve the attributes. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rename library to libnftnllibnftnl-1.0.0Pablo Neira Ayuso2014-01-201-2/+2
| | | | | | We plan to use this library name for the higher layer library. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* data_reg: fix verdict format approachArturo Borrero2014-01-181-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Patrick reports that the XML/JSON formats of the data_reg object are not accuarate. This patch updates these formats, so they are now as follow: * <data_reg type=value> with raw data (this doesn't change). * <data_reg type=verdict> with a concrete verdict (eg drop accept) and an optional <chain>, with destination. In XML: <data_reg type="verdict"> <verdict>goto</verdict> <chain>output</chain> </data_reg> In JSON: "data_reg" : { "type" : "verdict", "verdict" : "goto" "chain" : "output", } The default output format is updated to reflect these changes (minor collateral thing). When parsing set_elems, to know if we need to add the NFT_SET_ELEM_ATTR_CHAIN flag, a basic check for the chain not being NULL is done, instead of evaluating if the result of the parsing was DATA_CHAIN. The DATA_CHAIN symbol is no longer used in the data_reg XML/JSON parsing zone. While at it, I updated the error reporting stuff regarding data_reg/verdict, in order to leave a consistent state in the library. A JSON testfile is updated as well. Reported-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add interface to parse from fileArturo Borrero2014-01-091-0/+7
| | | | | | | | This patch adds a new API to parse rule-set expressed in XML/JSON from a file. A new enum nft_parse_input type is added for this purpose. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rework and generalize the build/parse systemArturo Borrero2014-01-091-10/+19
| | | | | | | | | | | The intention behind this patch is to prepare the introduction of the new API that will allow us to parse files that contain the rule-sets expressed in XML/JSON format. This adds the NFT_PARSE_BUFFER that indicates that the input is provided in a buffer, which is what we currently support. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: add json parsing to APIArturo Borrero2014-01-081-0/+21
| | | | | | | | | Add missing support in the API function to parse a JSON set_elem. I've renamed the main JSON parsing function to prevent clashing. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: new error reporting approach for XML/JSON parsersÁlvaro Neira Ayuso2014-01-061-9/+12
| | | | | | | | | | | | | | I have added a new structure for reporting some errors in parser that we can't cover with errno. In this patch, we have three errors that we can't cover with errno: NFT_PARSE_EBADINPUT : Bad XML/JSON format in the input NFT_PARSE_EMISSINGNODE : Missing node in our input NFT_PARSE_EBADTYPE : Wrong type value in a node Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: consolidate netlink build header functionPablo Neira Ayuso2013-11-241-21/+0
| | | | | | | | | Add new function nft_nlmsg_build_hdr which consolidates all existing functions to build headers per object. They basically look the same. This patch still provides aliases for consistency in the naming approach. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: unify parse and output typesÁlvaro Neira Ayuso2013-11-141-9/+9
| | | | | | | | | Unify parse and output types that are redundant to all existing nftables objects. Thus, all NFT_*_O_[XML|JSON|DEFAULT] are merged into NFT_OUTPUT_[JSON|XML] and NFT_PARSE_[JSON|XML]. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add fprintf API functionsArturo Borrero2013-11-031-0/+13
| | | | | | | | | | | | | | Now it's possible to print directly from libnftables to a file or other stream. The caller must explicitly print the trailing '\n' in this call. The error reporting of fprintf (< 0) is respected. However, we have already print some information in case that the default (plain text) output is used, that output is mostly intended for debugging so it should not be a problem. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: fix access after free in case of parsing errorsPablo Neira Ayuso2013-10-211-1/+3
| | | | | | If this fails to parse a set element, stop the processing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: json: remove spacesÁlvaro Neira Ayuso2013-10-171-3/+3
| | | | | | | | | | | | Remove all the spaces from the JSON output to reduce the size of the output string, this also provides a consistent output in table, chain, rule and set. As Stephen Hemminger suggested, better to squash the output to consume as less bytes as possible. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: snprintf: fix buffer lengthsArturo Borrero2013-09-271-11/+11
| | | | | | | | Use 'len' instead of 'size' since we need the remaining unused bytes in the buffer, not its total size. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: xml: avoid code duplicationArturo Borrero2013-09-271-23/+9
| | | | | | | This patch removes 3x code duplication in the XML snprintf function. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: replace size_t by uint32_t in set/get interfacesPablo Neira Ayuso2013-09-191-4/+4
| | | | | | | | | | | | This patch breaks the ABI to shrink the size parameter from 8 to 4 bytes in x86_64. The maximum length of netlink attributes is 2 bytes, so 4 bytes as attribute payload length should be enough. After this patch, size_t is only used in the nft_*_snprintf interfaces. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: refactor XML parsing codeArturo Borrero Gonzalez2013-09-161-12/+2
| | | | | | | | | | | This patch refactors nft_*_xml_parse to provide a new intermediate function nft_mxml_parse_* which will allow us to navigate an entire XML tree containing a ruleset without xml2text2xml conversions. While at it, I added a helper to build the XML tree and validate the top node name. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* src: xml: add parsing optional/mandatory flagArturo Borrero Gonzalez2013-09-161-21/+16
| | | | | | | | | | | Add an optional/mandatory flag to XML parsing. In some elements (ie regs), no flag is used because is always mandatory. DATA_NONE is created to indicate a non-parsed data_reg. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: constify nft_*_parse input dataArturo Borrero Gonzalez2013-08-221-2/+2
| | | | | | | Since the input string is not changing, let's make it constant. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: json: delete unneeded JSON prefixesÁlvaro Neira Ayuso2013-08-091-3/+3
| | | | | | | This patch adapts JSON nodes to mimic current XML node tags. Signed-off-by: Alvaro Neira Ayuso Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: cleanup set element parsingPablo Neira Ayuso2013-08-071-21/+28
| | | | | | | | | | | | Move nft_mxml_set_elem_parse to set_elem.c to improve readability, thus, we don't need to jump from set_elem.c to mxml.c to see how the parsing is done. I have also refactored some common parsing code in the new helper function nft_mxml_set_elem_parse, that avoids conversions from XML tree to text and then again back to tree. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: delete unneeded XML prefixesArturo Borrero Gonzalez2013-08-071-15/+12
| | | | | | | | | | | | | | | | | | | | This patch changes some XML nodes with prefixes, as the example below ilustrates. Before: <rule> <rule_flags/> <rule_family/> <rule> After: <rule> <flags> <family> </rule> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: constify nft_set_elem_attr_get_strPablo Neira Ayuso2013-08-061-1/+1
| | | | | | | Should have been done in (ec75831 src: fully constify nft_*_get functions) Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add xfree and use itPablo Neira Ayuso2013-08-061-5/+5
| | | | | | | | This patch adds xfree, a replacement of free that accepts const pointers. This helps to remove ugly castings that you usually need to calm down gcc. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: add XML parsingArturo Borrero2013-07-261-1/+84
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Sets are now parsed, following this previous snprintf pattern: <set> <set_name>string</set_name> <set_table>table</set_table> <set_xml_version>int</set_xml_version> <set_flags>uint32_t</set_flags> <key_type>uint32_t</key_type> <key_len>size_t</key_len> <data_type>uint32_t</data_type> <data_len>size_t</data_len> <set_elem> <set_elem_flags>uint32_t</set_elem_flags> <set_elem_key> <data_reg type="value"> <len></len> <dataN></dataN> </data_reg> </set_elem_key> <set_elem_data> <data_reg type="xx"> [...] </data_reg> </set_elem_data> </set_elem> </set> Signed-off-by: Arturo Borrero González <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: constify parameter of nft_*_is_setEric Leblond2013-07-191-1/+1
| | | | | | | | The functions nft_*_attr_is_set() is doing no modification so it is possible to type it to const. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: simplify getter logicPablo Neira Ayuso2013-07-181-21/+10
| | | | | | | | This patch refactors the getter code to simplify it. The default cases have been removed so gcc will spot a warning if an attribute is not handled appropriately. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: json: fix incomplete outputÁlvaro Neira Ayuso2013-07-161-22/+28
| | | | | | | | | | | In (bf39c53 set: add json output), the json support for sets was incomplete: * version, family, key_type, key_len, data_type, data_len were not included. * Now I use nft_data_reg_snprintf for printing the key and data Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: add xml outputArturo Borrero2013-07-061-1/+64
| | | | | | | This patch adds XML output for sets. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: add json outputÁlvaro Neira Ayuso2013-07-061-2/+49
| | | | | | | This patch allows you to dump set and their content in json format. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: fix printing of key and data registersPablo Neira Ayuso2013-07-061-2/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: improve default text outputGiuseppe Longo2013-07-051-2/+5
| | | | | | | | | | | | | This patch improves default plain text output by mimicing the default output of libnl-nft. While at it, several %lu has been translated to use %"PRIu64" for correctness. [ I have added the policy to string translation --pablo ] Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: add nft_set_elem_attr_set_strPablo Neira Ayuso2013-06-211-0/+6
| | | | | | | It was not implemented, it was defined in the header anf map files though. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: fix nft_set_elem_attr_get with NFT_SET_ELEM_ATTR_CHAINPablo Neira Ayuso2013-06-191-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: fix wrong flags setting in nft_set_elems_parse2Pablo Neira Ayuso2013-06-191-3/+4
| | | | | | Set element object flags instead of set flags. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: fix wrong flags set for NFT_SET_ELEM_ATTR_FLAGSPablo Neira Ayuso2013-06-171-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_*_attr_is_setPablo Neira Ayuso2013-06-171-0/+6
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>