summaryrefslogtreecommitdiffstats
path: root/src/set_elem.c
Commit message (Collapse)AuthorAgeFilesLines
* set_elem: add NFTNL_SET_ELEM_OBJREF attributePablo Neira Ayuso2016-12-091-0/+27
| | | | | | | This new attribute allows us to attach stateful objects to elements for map lookups. This new attribute identifies the object through its name. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: nftnl_set_elems_nlmsg_build_payload_iter()Pablo Neira Ayuso2016-12-051-0/+4
| | | | | | | Similar to a24e4b21ee33 ("set_elem: don't add NFTA_SET_ELEM_LIST_ELEMENTS attribute if set is empty"). This is required by the set flush support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: don't add NFTA_SET_ELEM_LIST_ELEMENTS attribute if set is emptyPablo Neira Ayuso2016-10-171-0/+3
| | | | | | | If the set is empty, don't send an empty NFTA_SET_ELEM_LIST_ELEMENTS netlink attributes with no elements. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove libmxml supportArturo Borrero2016-09-231-114/+4
| | | | | | | | | | | | | | | | | | | This patch removes the libmxml integration in libnftnl, since we have JSON in place and there is no need to support two at the same time. The JSON support is much better, for example libjansson has a better parsing error reporting. Moreover, libmxml 2.10 breaks the integration with libnftnl somehow, as reported in Debian bug #83870 [0]. Also, the XML support inside libnftnl has never been in good shape, with several tiny inconsitencies. [0] https://bugs.debian.org/838370 Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Constify iteratorsCarlos Falgueras García2016-08-101-5/+7
| | | | | | | | Iterators do not modify objects which they iterate, so input pointer must be const. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: don't set data_len to zero when returning pointersPablo Neira Ayuso2016-08-011-1/+0
| | | | | | | | nft already assumes that passing NULL as data_len is valid, otherwise it crashes. Fix this by leave data_len unset in this specific case. Fixes: bda7102 ("src: Fix nftnl_*_get_data() to return the real attribute length") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Fix nftnl_*_get_data() to return the real attribute lengthCarlos Falgueras García2016-07-111-0/+6
| | | | | | | | | | | All getters must set the memory size of the attributes, ie. this includes the nul-termination in strings. For references to opaque objects hidden behind the curtain, report a zero size. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Fix missing nul-termination in nftnl_*_set_str()Carlos Falgueras García2016-07-061-1/+1
| | | | | | | | The string length must be one character longer to include the nul-termination. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: fix return in several error paths of nftnl_set_elems_parse2()Pablo Neira Ayuso2016-06-221-2/+6
| | | | | | | | They don't set ret to anything, and ret is not initialized, so we return garbage. Fixes: 59cb13b ("src: fix missing error checking in parser functions") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix missing error checking in parser functionsCarlos Falgueras García2016-06-221-17/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bail out on errors in several nftnl_*_nlmsg_parse() functions. We can overwrite the previous error value, and may execute code which should not. Bad way: int f() { int ret; ret = g(); ret = h(); return ret; } Good way: int f() { int ret; ret = g(); if (ret < 0) return ret; ret = h(); if (ret < 0) return ret; return 0; } Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: check for flags before releasing attributesPablo Neira Ayuso2016-06-151-11/+9
| | | | | | | Now that unsetters don't set pointers to NULL, check if the attribute is set before trying to release it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: simplify unsettersPablo Neira Ayuso2016-06-151-10/+5
| | | | | | | If the attribute is set as we already check at the beginning of this function, then we can release the object. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: check for strdup() errors from setters and parsersPablo Neira Ayuso2016-06-151-1/+13
| | | | | | And pass up an error to the caller. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: return value on setters that internally allocate memoryPablo Neira Ayuso2016-06-151-7/+6
| | | | | | | | So the client can bail out of memory allocation errors. Or in case of daemon, make sure things are left in consistent state before bailing out. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Fix leak in nftnl_*_unset()Carlos Falgueras García2016-06-141-0/+2
| | | | | | | Fix leak of NFTNL_*_USERDATA from unset() functions. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: Copy user data memoryCarlos Falgueras García2016-05-301-2/+8
| | | | | | | All attributes are passed by copy, so user data should be copied too. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: Fix memory leakCarlos Falgueras García2016-05-251-0/+3
| | | | | | | | | | | | User data must be freed. How to reproduce: > nft add table t > nft add set t s {type ipv4_addr\;} > valgrind nft add element t s {1.1.1.1} Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove unnecessary inline in _snprintf functionsPablo Neira Ayuso2016-05-091-3/+3
| | | | | | | These functions are passed as parameter, so we basically get nothing with this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftnl: constify object arguments to various functionsPatrick McHardy2016-05-091-10/+14
| | | | | | | | | flow table support needs constant object arguments to printing functions to avoid ugly casts. While at it, also constify object arguments to message construction, destructor and a few helper functions. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rename EXPORT_SYMBOL to EXPORT_SYMBOL_ALIASFlorian Westphal2015-11-241-24/+24
| | | | | | | Future symbols don't need backwards-compat aliases. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: get rid of _attr_ infix in new nftnl_ definitionsPablo Neira Ayuso2015-09-071-30/+30
| | | | | | | The function names are already large, trim off the _ATTR_ infix in the attribute definitions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: get rid of _ATTR_ infix in new nfntl_ definitionsPablo Neira Ayuso2015-09-071-68/+68
| | | | | | | The constant names are already large, trim off the _ATTR_ infix in the attribute definitions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rename nftnl_rule_expr to nftnl_exprPablo Neira Ayuso2015-09-071-3/+3
| | | | | | | Use a shorter name for this, morever this can be used from sets so the _rule_ is misleading. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rename existing functions to use the nftnl_ prefixPablo Neira Ayuso2015-09-071-207/+207
| | | | | | | | | So we can use the nft_* prefix anytime soon for our upcoming higher level library. After this patch, the nft_* symbols become an alias of the nftnl_* symbols. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce nftnl_* aliases for all existing functionsPablo Neira Ayuso2015-09-021-24/+24
| | | | | | | | | | | This patch introduces the nftnl_ symbols as aliases for the existing nft_ symbols through the EXPORT_SYMBOL(...) macro. We would like to use the nft_* prefix from our upcoming higher level library, meanwhile with this move we avoid that old binaries break because of missing symbol dependencies. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix memory leaks at nft_[object]_nlmsg_parseCarlos Falgueras García2015-08-181-0/+2
| | | | | | | | Free object attributes before overwrite it. Fix 'nlmsg_parse' methods of following objects: 'table', 'chain', 'rule', 'set' and 'set_element'. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: support expressions attached to set elementsPatrick McHardy2015-04-141-0/+20
| | | | | | | This patch supports attaching a struct nft_rule_expr to a set element and adds netlink attribute encoding and decoding. Signed-off-by: Patrick McHardy <kaber@trash.net>
* set_elem: add support for userdataPatrick McHardy2015-04-121-0/+47
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* set_elem: add timeout supportPatrick McHardy2015-04-091-0/+38
| | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ruleset: fix crash if we free sets included in the set_listAlvaro Neira2015-02-241-0/+16
| | | | | | | | | | | | | | | | | When we parse a ruleset which has a rule using a set. First step is to parse the set, set up an ID and add it to a set list. Later, we use this set list to find the set associated to the rule and we set up the set ID to the expression (lookup expression) of the rule. The problem is that if we return this set to the callback function nft_ruleset_parse_file_cb() and we free this set, we have a crash when we try to iterate in the set list. This patch solves it, cloning the set and adding the new set to the set list. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: split internal.h is smaller filesPablo Neira Ayuso2015-02-171-3/+0
| | | | | | | | | The internal.h file started being a small file with private definitions. Its size has been increasing over time more and more, so let's split this in small header files that map to the corresponding class where the functions belong to. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add command tag in JSON/XML export supportAlvaro Neira Ayuso2015-02-101-6/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, we can't do incremental updates via JSON/XML. This patch enriches the existing output to indicate the kind of update that you want to perform. So, if we have a ruleset like: table ip filter { chain input { type filter hook input priority 0; } } The new output looks like: {"nftables":[{"add":[{"table":{"name":"filter",...}}]}]} ^^^^^ Where we explicitly indicate that we want to add a table. We support all the actions that we can do with nft, they are: - Add, delete and flush tables and chains. - Add, delete, replace and insert rules. - Add and delete sets. - Add and delete set elements. - Flush ruleset. You only need to add the command tag: {"nftables":[{"delete":[{...}, {...},...}]}]} ^^^^^^^^ The possible command tags that you can use are "add", "delete", "insert", "replace" and "flush". - Flush table or chain, eg.: {"nftables":[{"flush":[{"table":{"name":...}}]}]} - Delete table, chain, set or rule: {"nftables":[{"delete":[{"chain":{"name":...}]}]} - Replace a rule (you have to specify the handle): {"nftables":[{"replace":[{"rule":{...}}]}]} - Insert a rule: {"nftables":[{"insert":[{"rule":{...}}]}]} Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: don't create iterator with empty listAlvaro Neira2015-01-151-1/+8
| | | | | | | | | | Currently, we create iterator without test if the list is empty. If the list is empty, we have a crash when we set up the current element. With this patch, we test if the list is empty before to create the iterator. If the list is empty the iterator return NULL. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: use proper free functionArturo Borrero2014-08-181-1/+1
| | | | | | | | Let's use the proper free function to liberate the set_elem, so we avoid potential memory leaks. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: add nft_set_elems_nlmsg_build_payload_iter()Pablo Neira Ayuso2014-07-251-11/+72
| | | | | | | | | This new interface allows you to put as many set elements as possible into a netlink message. The iterator stores the last element that has fit into a netlink message, so you can continue adding more set elements across several netlink messages. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: stricter netlink attribute length validationPablo Neira Ayuso2014-07-201-16/+8
| | | | | | | | | | | | If the kernel sends us different data length for a given attribute, stop further processing and indicate that an ABI breakage has ocurred. This is an example of the (hypothetical) message that is shown in that case: nf_tables kernel ABI is broken, contact your vendor. table.c:214 reason: Numerical result out of range Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: set: Do not print unset values in jsonAna Rey2014-06-111-9/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It changes the parse and the snprint functions to omit unset values. This json file is gotten for a set: { "set": { "name": "mi6set3", "table": "test6", "flags": "0", "family": "unknown", "key_type": "0", "key_len": "0", "set_elem": [ { "flags": "0", "key": { "data_reg": { "type": "value", "len": "16", "data0": "0x000080fe", "data1": "0x00000000", "data2": "0xffb30202", "data3": "0x89001efe" Now, This json file is gotten for a set without unset elements. { "set": { "name": "mi6set3", "table": "test6", "family": "unknown", "set_elem": [ { "key": { "data_reg": { "type": "value", "len": "16", "data0": "0x000080fe", "data1": "0x00000000", "data2": "0xffb30202", "data3": "0x89001efe" [ Note: These fields are unset when they are obtained from the set element information --pablo. ] Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: set: Do not print unset values in xmlAna Rey2014-06-111-19/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It changes the parse and the snprint functions to omit unset values. This xml file is gotten for a set: <set> <family>unknown</family> <table>test</table> <name>miset</name> <flags>0</flags> <key_type>0</key_type> <key_len>0</key_len> <set_elem> <flags>0</flags> <key> <data_reg type="value"> <len>4</len> <data0>0x0401a8c0</data0> </data_reg> </key> </set_elem> <set_elem> <flags>0</flags> <key> <data_reg type="value"> <len>4</len> <data0>0x0501a8c0</data0> </data_reg> </key> </set_elem> </set> Now, this xml file is gotten without unset values: <set> <family>unknown</family> <table>test</table> <name>miset</name> <set_elem> <key> <data_reg type="value"> <len>4</len> <data0>0x00000002</data0> </data_reg> </key> </set_elem> <set_elem> <key> <data_reg type="value"> <len>4</len> <data0>0x0401a8c0</data0> </data_reg> </key> </set_elem> </set> Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: set: Use nft_rule_expr_set_* in the xml parsing codeAna Rey2014-06-111-5/+5
| | | | | | | Code refactoring to use nft_rule_expr_set_* in parse functions. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: add set ID supportPablo Neira Ayuso2014-05-191-0/+6
| | | | | | | Add the set ID (u32) which allows us to uniquely identify the set in the batch that is sent to kernel-space. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add flag to add event wrapping in output functionsArturo Borrero2014-04-261-5/+19
| | | | | | | | | | | | | | This patch uses the flag option of each output function to print an event wrapper string in each object. In order to use this functionality, the caller must pass the corresponding flags: NFT_OF_EVENT_NEW / NFT_OF_EVENT_DEL. (I have slightly refactorized the original code to add the xml/json header and footer --pablo). Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set-elem: fix a memory leakAna Rey2014-04-161-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | Valgrind reports the following memory leak: valgrind --leak-check=full ./nft-parsing-test -f jsonfiles/63-set.json ==7131== HEAP SUMMARY: ==7131== in use at exit: 2 bytes in 1 blocks ==7131== total heap usage: 155 allocs, 154 frees, 6,497 bytes allocated ==7131== ==7131== 2 bytes in 1 blocks are definitely lost in loss record 1 of 1 ==7131== at 0x4C274A0: malloc (vg_replace_malloc.c:291) ==7131== by 0x590B829: strdup (strdup.c:42) ==7131== by 0x4E4341A: nft_data_reg_json_parse (data_reg.c:55) ==7131== by 0x4E4093A: nft_jansson_data_reg_parse (jansson.c:231) ==7131== by 0x4E40A1B: nft_jansson_et_elem_parse (jansson.c:257) ==7131== by 0x4E3CECA: nft_jansson_parse_set (set.c:398) ==7131== by 0x4E3EC65: nft_ruleset_do_parse (ruleset.c:263) ==7131== by 0x401479: test_json (nft-parsing-test.c:129) ==7131== by 0x4017C2: execute_test_file (nft-parsing-test.c:270) ==7131== by 0x400EBB: main (nft-parsing-test.c:332) Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: parse family from Netlink messageArturo Borrero2014-04-071-0/+3
| | | | | | | Lets obtain the family from the Netlink message. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elems: delete unexisting exported symbolArturo Borrero2014-03-261-1/+0
| | | | | | | There is no function called 'nft_set_elem_nlmsg_parse()' Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: check if netlink parsing failsArturo Borrero2014-02-271-2/+9
| | | | | | | | We have to check if mnl_attr_parse() returns an error, which means that it failed to validate and retrieve the attributes. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rename library to libnftnllibnftnl-1.0.0Pablo Neira Ayuso2014-01-201-2/+2
| | | | | | We plan to use this library name for the higher layer library. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* data_reg: fix verdict format approachArturo Borrero2014-01-181-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Patrick reports that the XML/JSON formats of the data_reg object are not accuarate. This patch updates these formats, so they are now as follow: * <data_reg type=value> with raw data (this doesn't change). * <data_reg type=verdict> with a concrete verdict (eg drop accept) and an optional <chain>, with destination. In XML: <data_reg type="verdict"> <verdict>goto</verdict> <chain>output</chain> </data_reg> In JSON: "data_reg" : { "type" : "verdict", "verdict" : "goto" "chain" : "output", } The default output format is updated to reflect these changes (minor collateral thing). When parsing set_elems, to know if we need to add the NFT_SET_ELEM_ATTR_CHAIN flag, a basic check for the chain not being NULL is done, instead of evaluating if the result of the parsing was DATA_CHAIN. The DATA_CHAIN symbol is no longer used in the data_reg XML/JSON parsing zone. While at it, I updated the error reporting stuff regarding data_reg/verdict, in order to leave a consistent state in the library. A JSON testfile is updated as well. Reported-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add interface to parse from fileArturo Borrero2014-01-091-0/+7
| | | | | | | | This patch adds a new API to parse rule-set expressed in XML/JSON from a file. A new enum nft_parse_input type is added for this purpose. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rework and generalize the build/parse systemArturo Borrero2014-01-091-10/+19
| | | | | | | | | | | The intention behind this patch is to prepare the introduction of the new API that will allow us to parse files that contain the rule-sets expressed in XML/JSON format. This adds the NFT_PARSE_BUFFER that indicates that the input is provided in a buffer, which is what we currently support. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: add json parsing to APIArturo Borrero2014-01-081-0/+21
| | | | | | | | | Add missing support in the API function to parse a JSON set_elem. I've renamed the main JSON parsing function to prevent clashing. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>