summaryrefslogtreecommitdiffstats
path: root/src/table.c
Commit message (Collapse)AuthorAgeFilesLines
* utils: Introduce and use nftnl_set_str_attr()Phil Sutter2024-04-111-7/+2
| | | | | | | | | | | | | | | The function consolidates the necessary code when assigning to string pointer attributes, namely: * Conditional free of the previous value * Allocation of new value * Checking for memory allocation errors * Setting respective flag bit A new feature previously missing in all call sites is respecting data_len in case the buffer up to that point did not contain a NUL-char. Signed-off-by: Phil Sutter <phil@nwl.cc>
* table: Validate NFTNL_TABLE_OWNER, tooPhil Sutter2024-04-111-0/+1
| | | | | Fixes: 985955fe41f53 ("table: add table owner support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* table: Validate NFTNL_TABLE_USE, tooPhil Sutter2024-04-111-0/+1
| | | | | Fixes: 53c0ff324598c ("src: add nft_*_attr_{set|get}_data interface") Signed-off-by: Phil Sutter <phil@nwl.cc>
* Get rid of single option switch statementsPhil Sutter2021-03-151-9/+3
| | | | | | | | | | | | Replace each by a conditional testing the only valid case. There is one odd example, namely src/set.c: When printing a set with type NFTNL_OUTPUT_XML, the relevant function would return 0 instead of -1 like all others. Just drop it assuming nothing depends on that (faulty) behaviour. Cc: Arturo Borrero <arturo.borrero.glez@gmail.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* Drop pointless local variable in snprintf callbacksPhil Sutter2021-03-151-2/+2
| | | | | | | | | | A common idiom among snprintf callbacks was to copy the unsigned parameter 'size' (or 'len') into a signed variable for further use. Though since snprintf() itself casts it to unsigned and SNPRINTF_BUFFER_SIZE() does not allow it to become negative, this is not needed. Drop the local variable and rename the parameter accordingly. Signed-off-by: Phil Sutter <phil@nwl.cc>
* table: add table owner supportPablo Neira Ayuso2021-03-011-1/+13
| | | | | | Add support for NFTA_TABLE_OWNER. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: add userdata supportJose M. Guisado Gomez2020-08-281-0/+33
| | | | | | | | This patch adds NFT_TABLE_USERDATA and NFTNL_UDATA_TABLE_COMMENT to support for table comments. Signed-off-by: Jose M. Guisado Gomez <guigom@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: Remove buffer.hBrett Mastbergen2020-01-051-1/+0
| | | | | | | | | Almost everything in this header is unused. The command defines used in utils.c don't seem to be justified and have just been replaced by their strings Signed-off-by: Brett Mastbergen <bmastbergen@untangle.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Deprecate untyped data settersPhil Sutter2019-10-311-1/+1
| | | | | | | | | These functions make assumptions on size of passed data pointer and therefore tend to hide programming mistakes. Instead either one of the type-specific setters or the generic *_set_data() setter should be used. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Use memcpy() to handle potentially unaligned dataMatt Turner2018-10-191-4/+4
| | | | | | | | | | | | Rolf Eike Beer <eike@sf-mail.de> reported that nft-expr_quota-test fails with a SIGBUS on SPARC due to unaligned accesses. This patch resolves that and fixes additional sources of unaligned accesses matching the same pattern. Both nft-expr_quota-test and nft-expr_objref-test generated unaligned accesses on DEC Alpha. Bug: https://bugs.gentoo.org/666448 Signed-off-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove json supportPablo Neira Ayuso2018-10-151-92/+1
| | | | | | We have better json support in libnftables these days. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: parse new handle attribute for tablesHarsha Sharma2018-03-051-2/+36
| | | | | | | This patch adds code to parse new handle attribute for tables. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Fix exporting symbols with clangArmin K2017-12-301-30/+30
| | | | | | | | | | | | | When EXPORT_SYMBOL is located after function definition, clang won't properly export the function, resulting in a library with no symbols when built with clang. Based on libmnl commit dcdb47373a37 ("Move declaration of visibility attributes before definition.") Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1205 Signed-off-by: Armin K <krejzi@email.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: do not nul-terminate internal helper functionsPablo Neira Ayuso2017-10-041-3/+0
| | | | | | | Public API already does this for us, no need to do this again from internal helper functions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: no need to nul-terminate buffer for nftnl_fprintf() callsPablo Neira Ayuso2017-10-041-3/+0
| | | | | | | This function bails out with -1 if we cannot print, and this buffer is internally allocated. No need for this overly deffensive initialization. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Buffer is null terminated.Varsha Rao2017-09-271-0/+9
| | | | | | | In _snprintf() functions definition the buffer is null terminated. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Change parameters of SNPRINTF_BUFFER_SIZE macro.Varsha Rao2017-09-271-8/+8
| | | | | | | | | SNPRINTF_BUFFER_SIZE() macro declaration and definition is changed so that it accepts three arguments ret, remain and offset. Parameters size and len are not required instead parameter remain keeps track of available space in the buffer. Signed-off-by: Varsha Rao <rvarsha016@gmail.com>
* src: get rid of aliases and compatPablo Neira Ayuso2016-12-201-30/+30
| | | | | | | | | | | This machinery was introduced to avoid sudden compilation breakage of old nftables releases. With the upcoming release of 0.7 (and 0.6 which is now 6 months old) this is not required anymore. Moreover, users gain nothing from older releases since they are half-boiled and buggy. So let's get rid of aliases now. Bump LIBVERSION and update map file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove libmxml supportArturo Borrero2016-09-231-52/+1
| | | | | | | | | | | | | | | | | | | This patch removes the libmxml integration in libnftnl, since we have JSON in place and there is no need to support two at the same time. The JSON support is much better, for example libjansson has a better parsing error reporting. Moreover, libmxml 2.10 breaks the integration with libnftnl somehow, as reported in Debian bug #83870 [0]. Also, the XML support inside libnftnl has never been in good shape, with several tiny inconsitencies. [0] https://bugs.debian.org/838370 Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Avoid returning uninitialized dataPhil Sutter2016-08-121-1/+1
| | | | | | | | | Although the 'err' pointer should be interesting for users only if the parser returned non-zero, having it point to uninitialized data is generally a bad thing. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Constify iteratorsCarlos Falgueras García2016-08-101-3/+4
| | | | | | | | Iterators do not modify objects which they iterate, so input pointer must be const. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Fix nftnl_*_get_data() to return the real attribute lengthCarlos Falgueras García2016-07-111-0/+1
| | | | | | | | | | | All getters must set the memory size of the attributes, ie. this includes the nul-termination in strings. For references to opaque objects hidden behind the curtain, report a zero size. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Fix missing nul-termination in nftnl_*_set_str()Carlos Falgueras García2016-07-061-1/+1
| | | | | | | | The string length must be one character longer to include the nul-termination. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: check for flags before releasing attributesPablo Neira Ayuso2016-06-151-2/+3
| | | | | | | Now that unsetters don't set pointers to NULL, check if the attribute is set before trying to release it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: simplify unsettersPablo Neira Ayuso2016-06-151-4/+1
| | | | | | | If the attribute is set as we already check at the beginning of this function, then we can release the object. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: check for strdup() errors from setters and parsersPablo Neira Ayuso2016-06-151-0/+2
| | | | | | And pass up an error to the caller. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: return value on setters that internally allocate memoryPablo Neira Ayuso2016-06-151-4/+7
| | | | | | | | So the client can bail out of memory allocation errors. Or in case of daemon, make sure things are left in consistent state before bailing out. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: assert when setting unknown attributesPablo Neira Ayuso2016-06-151-3/+1
| | | | | | | | | | | | If this attribute is not supported by the library, we should rise an assertion so the client knows something is wrong, instead of silently going through. The only case I can think may hit this problem is version mismatch between library and tools. This should not ever really happen, so better bail out from the library itself in this case. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove unnecessary inline in _snprintf functionsPablo Neira Ayuso2016-05-091-3/+2
| | | | | | | These functions are passed as parameter, so we basically get nothing with this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftnl: constify object arguments to various functionsPatrick McHardy2016-05-091-21/+23
| | | | | | | | | flow table support needs constant object arguments to printing functions to avoid ugly casts. While at it, also constify object arguments to message construction, destructor and a few helper functions. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rename EXPORT_SYMBOL to EXPORT_SYMBOL_ALIASFlorian Westphal2015-11-241-30/+30
| | | | | | | Future symbols don't need backwards-compat aliases. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: get rid of _attr_ infix in new nftnl_ definitionsPablo Neira Ayuso2015-09-071-42/+42
| | | | | | | The function names are already large, trim off the _ATTR_ infix in the attribute definitions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: get rid of _ATTR_ infix in new nfntl_ definitionsPablo Neira Ayuso2015-09-071-35/+35
| | | | | | | The constant names are already large, trim off the _ATTR_ infix in the attribute definitions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rename existing functions to use the nftnl_ prefixPablo Neira Ayuso2015-09-071-158/+158
| | | | | | | | | So we can use the nft_* prefix anytime soon for our upcoming higher level library. After this patch, the nft_* symbols become an alias of the nftnl_* symbols. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce nftnl_* aliases for all existing functionsPablo Neira Ayuso2015-09-021-30/+30
| | | | | | | | | | | This patch introduces the nftnl_ symbols as aliases for the existing nft_ symbols through the EXPORT_SYMBOL(...) macro. We would like to use the nft_* prefix from our upcoming higher level library, meanwhile with this move we avoid that old binaries break because of missing symbol dependencies. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix memory leaks at nft_[object]_nlmsg_parseCarlos Falgueras García2015-08-181-0/+1
| | | | | | | | Free object attributes before overwrite it. Fix 'nlmsg_parse' methods of following objects: 'table', 'chain', 'rule', 'set' and 'set_element'. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* chain: add netdev family supportPablo Neira Ayuso2015-06-161-35/+2
| | | | | | | | | Add support for the new NFT_CHAIN_ATTR_DEV attribute that indicates that the basechain is attached to a net_device. This partially reworks 1dd9ba1ea23c ("table: add netdev family support"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: add netdev family supportPablo Neira Ayuso2015-05-291-2/+35
| | | | | | This adds support for the new 'netdev' family tables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add command tag in JSON/XML export supportAlvaro Neira Ayuso2015-02-101-6/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, we can't do incremental updates via JSON/XML. This patch enriches the existing output to indicate the kind of update that you want to perform. So, if we have a ruleset like: table ip filter { chain input { type filter hook input priority 0; } } The new output looks like: {"nftables":[{"add":[{"table":{"name":"filter",...}}]}]} ^^^^^ Where we explicitly indicate that we want to add a table. We support all the actions that we can do with nft, they are: - Add, delete and flush tables and chains. - Add, delete, replace and insert rules. - Add and delete sets. - Add and delete set elements. - Flush ruleset. You only need to add the command tag: {"nftables":[{"delete":[{...}, {...},...}]}]} ^^^^^^^^ The possible command tags that you can use are "add", "delete", "insert", "replace" and "flush". - Flush table or chain, eg.: {"nftables":[{"flush":[{"table":{"name":...}}]}]} - Delete table, chain, set or rule: {"nftables":[{"delete":[{"chain":{"name":...}]}]} - Replace a rule (you have to specify the handle): {"nftables":[{"replace":[{"rule":{...}}]}]} - Insert a rule: {"nftables":[{"insert":[{"rule":{...}}]}]} Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: don't create iterator with empty listAlvaro Neira2015-01-151-1/+7
| | | | | | | | | | Currently, we create iterator without test if the list is empty. If the list is empty, we have a crash when we set up the current element. With this patch, we test if the list is empty before to create the iterator. If the list is empty the iterator return NULL. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: consolidate XML/JSON exportationPablo Neira Ayuso2014-11-101-69/+17
| | | | | | | | | | | | | | Add new buffer class to consolidate the existing code to export objects in XML/JSON and use it. We save ~700 LOC with this change. The rule and set objects are not yet consolidated. It seems this would require some specific glue code per representation type since lists are arranged differently. This also consolidates the tag names, so we make sure the same are used from XML and JSON by placing them in include/buffer.h. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: stricter netlink attribute length validationPablo Neira Ayuso2014-07-201-13/+4
| | | | | | | | | | | | If the kernel sends us different data length for a given attribute, stop further processing and indicate that an ABI breakage has ocurred. This is an example of the (hypothetical) message that is shown in that case: nf_tables kernel ABI is broken, contact your vendor. table.c:214 reason: Numerical result out of range Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: Do not print unset values in json fileAna Rey2014-06-301-22/+42
| | | | | | | It changes the parse and snprintf functions to omit unset values. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: Do not print unset values in xml fileAna Rey2014-06-301-13/+34
| | | | | | | It changes the parse and snprintf functions to omit unset values. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: Add set, unset and parse implementation for the use attributeAna Rey2014-06-301-6/+12
| | | | | | | | | Add some parts of the implemention of 'use' vualue in table that miss it. These changes are neeeded for a correct import/export of xml/json file Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: Use nft_table_attr_set_* in the xml functionsAna Rey2014-06-301-13/+5
| | | | | | | Code refactoring to use nft_table_attr_set_* in parse xml functions. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: Free memory in the same function that is reservedAna Rey2014-06-301-8/+9
| | | | | | | Free memory in the same function that is reserved. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add flag to add event wrapping in output functionsArturo Borrero2014-04-261-5/+18
| | | | | | | | | | | | | | This patch uses the flag option of each output function to print an event wrapper string in each object. In order to use this functionality, the caller must pass the corresponding flags: NFT_OF_EVENT_NEW / NFT_OF_EVENT_DEL. (I have slightly refactorized the original code to add the xml/json header and footer --pablo). Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix bogus assertion for unset attributesPablo Neira Ayuso2014-04-071-1/+1
| | | | | | | | | | | | If you try to obtain an unset attribute, you hit an assertion error that should not happen. Fix this by checking if the attribute is unset, otherwise skip the assertion checking. Now that we have that nft_assert takes the data parameter, we can also validate if someone is using the setter passing NULL, which is illegal. So let's add an assertion for that as well. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: check if netlink parsing failsArturo Borrero2014-02-271-1/+3
| | | | | | | | We have to check if mnl_attr_parse() returns an error, which means that it failed to validate and retrieve the attributes. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>