From 00c179b4c9f9f9394cc6f79e5f2a68410631fd72 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Fri, 3 Aug 2012 17:31:48 +0200 Subject: initial version of libnftables It adds support for table, chain and rule handling. This also includes expression handling for each rule. Signed-off-by: Pablo Neira Ayuso --- examples/Makefile.am | 38 +++++++++ examples/nft-chain-add.c | 111 ++++++++++++++++++++++++++ examples/nft-chain-del.c | 93 ++++++++++++++++++++++ examples/nft-chain-get.c | 123 +++++++++++++++++++++++++++++ examples/nft-rule-add.c | 199 +++++++++++++++++++++++++++++++++++++++++++++++ examples/nft-rule-del.c | 103 ++++++++++++++++++++++++ examples/nft-rule-get.c | 99 +++++++++++++++++++++++ examples/nft-table-add.c | 92 ++++++++++++++++++++++ examples/nft-table-del.c | 92 ++++++++++++++++++++++ examples/nft-table-get.c | 107 +++++++++++++++++++++++++ 10 files changed, 1057 insertions(+) create mode 100644 examples/Makefile.am create mode 100644 examples/nft-chain-add.c create mode 100644 examples/nft-chain-del.c create mode 100644 examples/nft-chain-get.c create mode 100644 examples/nft-rule-add.c create mode 100644 examples/nft-rule-del.c create mode 100644 examples/nft-rule-get.c create mode 100644 examples/nft-table-add.c create mode 100644 examples/nft-table-del.c create mode 100644 examples/nft-table-get.c (limited to 'examples') diff --git a/examples/Makefile.am b/examples/Makefile.am new file mode 100644 index 0000000..1c72ab4 --- /dev/null +++ b/examples/Makefile.am @@ -0,0 +1,38 @@ +include $(top_srcdir)/Make_global.am + +check_PROGRAMS = nft-table-add \ + nft-table-del \ + nft-table-get \ + nft-chain-add \ + nft-chain-del \ + nft-chain-get \ + nft-rule-add \ + nft-rule-del \ + nft-rule-get + +nft_table_add_SOURCES = nft-table-add.c +nft_table_add_LDADD = ../src/libnftables.la ${LIBMNL_LIBS} + +nft_table_del_SOURCES = nft-table-del.c +nft_table_del_LDADD = ../src/libnftables.la ${LIBMNL_LIBS} + +nft_table_get_SOURCES = nft-table-get.c +nft_table_get_LDADD = ../src/libnftables.la ${LIBMNL_LIBS} + +nft_chain_add_SOURCES = nft-chain-add.c +nft_chain_add_LDADD = ../src/libnftables.la ${LIBMNL_LIBS} + +nft_chain_del_SOURCES = nft-chain-del.c +nft_chain_del_LDADD = ../src/libnftables.la ${LIBMNL_LIBS} + +nft_chain_get_SOURCES = nft-chain-get.c +nft_chain_get_LDADD = ../src/libnftables.la ${LIBMNL_LIBS} + +nft_rule_add_SOURCES = nft-rule-add.c +nft_rule_add_LDADD = ../src/libnftables.la ${LIBMNL_LIBS} + +nft_rule_del_SOURCES = nft-rule-del.c +nft_rule_del_LDADD = ../src/libnftables.la ${LIBMNL_LIBS} + +nft_rule_get_SOURCES = nft-rule-get.c +nft_rule_get_LDADD = ../src/libnftables.la ${LIBMNL_LIBS} diff --git a/examples/nft-chain-add.c b/examples/nft-chain-add.c new file mode 100644 index 0000000..4897fc5 --- /dev/null +++ b/examples/nft-chain-add.c @@ -0,0 +1,111 @@ +/* + * (C) 2012 by Pablo Neira Ayuso + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This software has been sponsored by Sophos Astaro + */ + +#include +#include +#include +#include + +#include +#include + +#include +#include + +int main(int argc, char *argv[]) +{ + struct mnl_socket *nl; + char buf[MNL_SOCKET_BUFFER_SIZE]; + struct nlmsghdr *nlh; + uint32_t portid, seq; + struct nft_chain *t = NULL; + int ret, family, hooknum; + + if (argc != 6) { + fprintf(stderr, "Usage: %s " + " \n", + argv[0]); + exit(EXIT_FAILURE); + } + + if (strcmp(argv[1], "ip") == 0) + family = AF_INET; + else if (strcmp(argv[1], "ip6") == 0) + family = AF_INET6; + else if (strcmp(argv[1], "bridge") == 0) + family = AF_BRIDGE; + else { + fprintf(stderr, "Unknown family: ip, ip6, bridge\n"); + exit(EXIT_FAILURE); + } + + if (strcmp(argv[4], "NF_INET_LOCAL_IN") == 0) + hooknum = NF_INET_LOCAL_IN; + else if (strcmp(argv[4], "NF_INET_LOCAL_OUT") == 0) + hooknum = NF_INET_LOCAL_OUT; + else if (strcmp(argv[4], "NF_INET_PRE_ROUTING") == 0) + hooknum = NF_INET_PRE_ROUTING; + else if (strcmp(argv[4], "NF_INET_POST_ROUTING") == 0) + hooknum = NF_INET_POST_ROUTING; + else if (strcmp(argv[4], "NF_INET_FORWARD") == 0) + hooknum = NF_INET_FORWARD; + else { + fprintf(stderr, "Unknown hook: %s\n", argv[4]); + exit(EXIT_FAILURE); + } + + t = nft_chain_alloc(); + if (t == NULL) { + perror("OOM"); + exit(EXIT_FAILURE); + } + seq = time(NULL); + nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_NEWCHAIN, family, + NLM_F_EXCL|NLM_F_ACK, seq); + nft_chain_attr_set(t, NFT_CHAIN_ATTR_TABLE, argv[2]); + nft_chain_attr_set(t, NFT_CHAIN_ATTR_NAME, argv[3]); + nft_chain_attr_set_u32(t, NFT_CHAIN_ATTR_HOOKNUM, hooknum); + nft_chain_attr_set_u32(t, NFT_CHAIN_ATTR_PRIO, atoi(argv[5])); + nft_chain_nlmsg_build_payload(nlh, t); + nft_chain_free(t); + + nl = mnl_socket_open(NETLINK_NETFILTER); + if (nl == NULL) { + perror("mnl_socket_open"); + exit(EXIT_FAILURE); + } + + if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) { + perror("mnl_socket_bind"); + exit(EXIT_FAILURE); + } + portid = mnl_socket_get_portid(nl); + + if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { + perror("mnl_socket_send"); + exit(EXIT_FAILURE); + } + + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + while (ret > 0) { + ret = mnl_cb_run(buf, ret, seq, portid, NULL, NULL); + if (ret <= 0) + break; + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + } + if (ret == -1) { + perror("error"); + exit(EXIT_FAILURE); + } + mnl_socket_close(nl); + + return EXIT_SUCCESS; +} diff --git a/examples/nft-chain-del.c b/examples/nft-chain-del.c new file mode 100644 index 0000000..ddbab3f --- /dev/null +++ b/examples/nft-chain-del.c @@ -0,0 +1,93 @@ +/* + * (C) 2012 by Pablo Neira Ayuso + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This software has been sponsored by Sophos Astaro + */ + +#include +#include +#include +#include + +#include +#include + +#include +#include + +int main(int argc, char *argv[]) +{ + struct mnl_socket *nl; + char buf[MNL_SOCKET_BUFFER_SIZE]; + struct nlmsghdr *nlh; + uint32_t portid, seq; + struct nft_chain *t = NULL; + int ret, family; + + if (argc != 4) { + fprintf(stderr, "Usage: %s
\n", + argv[0]); + exit(EXIT_FAILURE); + } + + if (strcmp(argv[1], "ip") == 0) + family = AF_INET; + else if (strcmp(argv[1], "ip6") == 0) + family = AF_INET6; + else if (strcmp(argv[1], "bridge") == 0) + family = AF_BRIDGE; + else { + fprintf(stderr, "Unknown family: ip, ip6, bridge\n"); + exit(EXIT_FAILURE); + } + + t = nft_chain_alloc(); + if (t == NULL) { + perror("OOM"); + exit(EXIT_FAILURE); + } + seq = time(NULL); + nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_DELCHAIN, family, + NLM_F_ACK, seq); + nft_chain_attr_set(t, NFT_CHAIN_ATTR_TABLE, argv[2]); + nft_chain_attr_set(t, NFT_CHAIN_ATTR_NAME, argv[3]); + nft_chain_nlmsg_build_payload(nlh, t); + nft_chain_free(t); + + nl = mnl_socket_open(NETLINK_NETFILTER); + if (nl == NULL) { + perror("mnl_socket_open"); + exit(EXIT_FAILURE); + } + + if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) { + perror("mnl_socket_bind"); + exit(EXIT_FAILURE); + } + portid = mnl_socket_get_portid(nl); + + if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { + perror("mnl_socket_send"); + exit(EXIT_FAILURE); + } + + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + while (ret > 0) { + ret = mnl_cb_run(buf, ret, seq, portid, NULL, NULL); + if (ret <= 0) + break; + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + } + if (ret == -1) { + perror("error"); + exit(EXIT_FAILURE); + } + mnl_socket_close(nl); + + return EXIT_SUCCESS; +} diff --git a/examples/nft-chain-get.c b/examples/nft-chain-get.c new file mode 100644 index 0000000..2756c90 --- /dev/null +++ b/examples/nft-chain-get.c @@ -0,0 +1,123 @@ +/* + * (C) 2012 by Pablo Neira Ayuso + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This software has been sponsored by Sophos Astaro + */ + +#include +#include +#include +#include + +#include + +#include +#include + +static int table_cb(const struct nlmsghdr *nlh, void *data) +{ + struct nft_chain *t; + char buf[4096]; + + t = nft_chain_alloc(); + if (t == NULL) { + perror("OOM"); + goto err; + } + + if (nft_chain_nlmsg_parse(nlh, t) < 0) { + perror("nft_chain_nlmsg_parse"); + goto err_free; + } + + nft_chain_snprintf(buf, sizeof(buf), t, NFT_CHAIN_O_DEFAULT, 0); + printf("%s", buf); + +err_free: + nft_chain_free(t); +err: + return MNL_CB_OK; +} + +int main(int argc, char *argv[]) +{ + struct mnl_socket *nl; + char buf[MNL_SOCKET_BUFFER_SIZE]; + struct nlmsghdr *nlh; + uint32_t portid, seq; + struct nft_chain *t = NULL; + int ret; + + seq = time(NULL); + + if (argc == 1) { + nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_GETCHAIN, AF_INET, + NLM_F_DUMP, seq); + } else if (argc == 4) { + int family; + + if (strcmp(argv[1], "ip") == 0) + family = AF_INET; + else if (strcmp(argv[1], "ip6") == 0) + family = AF_INET6; + else if (strcmp(argv[1], "bridge") == 0) + family = AF_BRIDGE; + else { + fprintf(stderr, "Unknown family: ip, ip6, bridge\n"); + exit(EXIT_FAILURE); + } + + t = nft_chain_alloc(); + if (t == NULL) { + perror("OOM"); + exit(EXIT_FAILURE); + } + nlh = nft_chain_nlmsg_build_hdr(buf, NFT_MSG_GETCHAIN, family, + NLM_F_ACK, seq); + nft_chain_attr_set(t, NFT_CHAIN_ATTR_TABLE, argv[2]); + nft_chain_attr_set(t, NFT_CHAIN_ATTR_NAME, argv[3]); + nft_chain_nlmsg_build_payload(nlh, t); + nft_chain_free(t); + } else { + fprintf(stderr, "Usage: %s [
]\n", + argv[0]); + exit(EXIT_FAILURE); + } + + nl = mnl_socket_open(NETLINK_NETFILTER); + if (nl == NULL) { + perror("mnl_socket_open"); + exit(EXIT_FAILURE); + } + + if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) { + perror("mnl_socket_bind"); + exit(EXIT_FAILURE); + } + portid = mnl_socket_get_portid(nl); + + if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { + perror("mnl_socket_send"); + exit(EXIT_FAILURE); + } + + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + while (ret > 0) { + ret = mnl_cb_run(buf, ret, seq, portid, table_cb, NULL); + if (ret <= 0) + break; + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + } + if (ret == -1) { + perror("error"); + exit(EXIT_FAILURE); + } + mnl_socket_close(nl); + + return EXIT_SUCCESS; +} diff --git a/examples/nft-rule-add.c b/examples/nft-rule-add.c new file mode 100644 index 0000000..5fbc796 --- /dev/null +++ b/examples/nft-rule-add.c @@ -0,0 +1,199 @@ +/* + * (C) 2012 by Pablo Neira Ayuso + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This software has been sponsored by Sophos Astaro + */ + +#include +#include +#include +#include /* for offsetof */ +#include +#include + +#include + +#include +#include +#include +#include + +#include +#include + +#include + +static void add_target_log(struct nft_rule_expr *e) +{ + struct ipt_log_info *info; + + nft_rule_expr_set(e, NFT_EXPR_TG_NAME, "LOG", strlen("LOG")); + nft_rule_expr_set_u32(e, NFT_EXPR_TG_REV, 0); + + info = calloc(1, sizeof(struct ipt_log_info)); + if (info == NULL) + return; + + sprintf(info->prefix, "test: "); + info->prefix[sizeof(info->prefix)-1] = '\0'; + info->logflags = 0x0f; + info->level = 5; + + nft_rule_expr_set(e, NFT_EXPR_TG_INFO, info, sizeof(*info)); +} + +static void add_expr_target(struct nft_rule *r) +{ + struct nft_rule_expr *expr; + + expr = nft_rule_expr_alloc("target"); + if (expr == NULL) + return; + + add_target_log(expr); + + nft_rule_add_expr(r, expr); +} + +static void add_match_iprange(struct nft_rule_expr *e) +{ + struct xt_iprange_mtinfo *info; + + nft_rule_expr_set(e, NFT_EXPR_MT_NAME, "iprange", strlen("iprange")); + nft_rule_expr_set_u32(e, NFT_EXPR_MT_REV, 1); + + info = calloc(1, sizeof(struct xt_iprange_mtinfo)); + if (info == NULL) + return; + + info->src_min.ip = info->dst_min.ip = inet_addr("127.0.0.1"); + info->src_max.ip = info->dst_max.ip = inet_addr("127.0.0.1"); + info->flags = IPRANGE_SRC; + + nft_rule_expr_set(e, NFT_EXPR_MT_INFO, info, sizeof(*info)); +} + +static void add_expr_match(struct nft_rule *r) +{ + struct nft_rule_expr *expr; + + expr = nft_rule_expr_alloc("match"); + if (expr == NULL) + return; + + add_match_iprange(expr); + + nft_rule_add_expr(r, expr); +} + +#define field_sizeof(t, f) (sizeof(((t *)NULL)->f)) + +static void add_payload2(struct nft_rule_expr *e) +{ + nft_rule_expr_set_u32(e, NFT_EXPR_PAYLOAD_BASE, + NFT_PAYLOAD_NETWORK_HEADER); + nft_rule_expr_set_u32(e, NFT_EXPR_PAYLOAD_DREG, NFT_REG_1); + nft_rule_expr_set_u32(e, NFT_EXPR_PAYLOAD_OFFSET, + offsetof(struct iphdr, protocol)); + nft_rule_expr_set_u32(e, NFT_EXPR_PAYLOAD_LEN, 1); +} + +static void add_payload(struct nft_rule *r) +{ + struct nft_rule_expr *expr; + + expr = nft_rule_expr_alloc("payload"); + if (expr == NULL) + return; + + add_payload2(expr); + + nft_rule_add_expr(r, expr); +} + +int main(int argc, char *argv[]) +{ + struct mnl_socket *nl; + char buf[MNL_SOCKET_BUFFER_SIZE]; + struct nlmsghdr *nlh; + uint32_t portid, seq; + struct nft_rule *r = NULL; + int ret, family; + + if (argc != 4) { + fprintf(stderr, "Usage: %s
\n", + argv[0]); + exit(EXIT_FAILURE); + } + + r = nft_rule_alloc(); + if (r == NULL) { + perror("OOM"); + exit(EXIT_FAILURE); + } + + if (strcmp(argv[1], "ip") == 0) + family = AF_INET; + else if (strcmp(argv[1], "ip6") == 0) + family = AF_INET6; + else if (strcmp(argv[1], "bridge") == 0) + family = AF_BRIDGE; + else { + fprintf(stderr, "Unknown family: ip, ip6, bridge\n"); + exit(EXIT_FAILURE); + } + + nft_rule_attr_set(r, NFT_RULE_ATTR_TABLE, argv[2]); + nft_rule_attr_set(r, NFT_RULE_ATTR_CHAIN, argv[3]); + + add_expr_match(r); + add_expr_target(r); +// add_payload(r); + + char tmp[1024]; + nft_rule_snprintf(tmp, sizeof(tmp), r, 0, 0); + printf("%s\n", tmp); + + seq = time(NULL); + nlh = nft_rule_nlmsg_build_hdr(buf, NFT_MSG_NEWRULE, family, + NLM_F_APPEND|NLM_F_ACK, seq); + nft_rule_nlmsg_build_payload(nlh, r); + nft_rule_free(r); + + nl = mnl_socket_open(NETLINK_NETFILTER); + if (nl == NULL) { + perror("mnl_socket_open"); + exit(EXIT_FAILURE); + } + + if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) { + perror("mnl_socket_bind"); + exit(EXIT_FAILURE); + } + portid = mnl_socket_get_portid(nl); + + if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { + perror("mnl_socket_send"); + exit(EXIT_FAILURE); + } + + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + while (ret > 0) { + ret = mnl_cb_run(buf, ret, seq, portid, NULL, NULL); + if (ret <= 0) + break; + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + } + if (ret == -1) { + perror("error"); + exit(EXIT_FAILURE); + } + mnl_socket_close(nl); + + return EXIT_SUCCESS; +} diff --git a/examples/nft-rule-del.c b/examples/nft-rule-del.c new file mode 100644 index 0000000..4678b4e --- /dev/null +++ b/examples/nft-rule-del.c @@ -0,0 +1,103 @@ +/* + * (C) 2012 by Pablo Neira Ayuso + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This software has been sponsored by Sophos Astaro + */ + +#include +#include +#include +#include /* for offsetof */ +#include + +#include + +#include +#include + +int main(int argc, char *argv[]) +{ + struct mnl_socket *nl; + char buf[MNL_SOCKET_BUFFER_SIZE]; + struct nlmsghdr *nlh; + uint32_t portid, seq; + struct nft_rule *r = NULL; + int ret, family; + + if (argc < 4 || argc > 5) { + fprintf(stderr, "Usage: %s
[]\n", + argv[0]); + exit(EXIT_FAILURE); + } + + r = nft_rule_alloc(); + if (r == NULL) { + perror("OOM"); + exit(EXIT_FAILURE); + } + + if (strcmp(argv[1], "ip") == 0) + family = AF_INET; + else if (strcmp(argv[1], "ip6") == 0) + family = AF_INET6; + else if (strcmp(argv[1], "bridge") == 0) + family = AF_BRIDGE; + else { + fprintf(stderr, "Unknown family: ip, ip6, bridge\n"); + exit(EXIT_FAILURE); + } + + seq = time(NULL); + nlh = nft_rule_nlmsg_build_hdr(buf, NFT_MSG_DELRULE, family, + NLM_F_ACK, seq); + nft_rule_attr_set(r, NFT_RULE_ATTR_TABLE, argv[2]); + nft_rule_attr_set(r, NFT_RULE_ATTR_CHAIN, argv[3]); + + /* If no handle is specified, delete all rules in the chain */ + if (argc == 5) + nft_rule_attr_set_u16(r, NFT_RULE_ATTR_HANDLE, atoi(argv[4])); + + char tmp[1024]; + nft_rule_snprintf(tmp, sizeof(tmp), r, 0, 0); + printf("%s\n", tmp); + + nft_rule_nlmsg_build_payload(nlh, r); + nft_rule_free(r); + + nl = mnl_socket_open(NETLINK_NETFILTER); + if (nl == NULL) { + perror("mnl_socket_open"); + exit(EXIT_FAILURE); + } + + if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) { + perror("mnl_socket_bind"); + exit(EXIT_FAILURE); + } + portid = mnl_socket_get_portid(nl); + + if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { + perror("mnl_socket_send"); + exit(EXIT_FAILURE); + } + + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + while (ret > 0) { + ret = mnl_cb_run(buf, ret, seq, portid, NULL, NULL); + if (ret <= 0) + break; + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + } + if (ret == -1) { + perror("error"); + exit(EXIT_FAILURE); + } + mnl_socket_close(nl); + + return EXIT_SUCCESS; +} diff --git a/examples/nft-rule-get.c b/examples/nft-rule-get.c new file mode 100644 index 0000000..75043d7 --- /dev/null +++ b/examples/nft-rule-get.c @@ -0,0 +1,99 @@ +/* + * (C) 2012 by Pablo Neira Ayuso + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This software has been sponsored by Sophos Astaro + */ + +#include +#include +#include +#include + +#include + +#include +#include + +static int table_cb(const struct nlmsghdr *nlh, void *data) +{ + struct nft_rule *t; + char buf[4096]; + + t = nft_rule_alloc(); + if (t == NULL) { + perror("OOM"); + goto err; + } + + if (nft_rule_nlmsg_parse(nlh, t) < 0) { + perror("nft_rule_nlmsg_parse"); + goto err_free; + } + + nft_rule_snprintf(buf, sizeof(buf), t, NFT_RULE_O_DEFAULT, 0); + printf("%s", buf); + +err_free: + nft_rule_free(t); +err: + return MNL_CB_OK; +} + +int main(int argc, char *argv[]) +{ + struct mnl_socket *nl; + char buf[MNL_SOCKET_BUFFER_SIZE]; + struct nlmsghdr *nlh; + uint32_t portid, seq; + struct nft_rule *t = NULL; + int ret; + + /* XXX requires table, chain and handle attributes for selective get */ + + t = nft_rule_alloc(); + if (t == NULL) { + perror("OOM"); + exit(EXIT_FAILURE); + } + + seq = time(NULL); + nlh = nft_rule_nlmsg_build_hdr(buf, NFT_MSG_GETRULE, AF_INET, + NLM_F_DUMP, seq); + + nl = mnl_socket_open(NETLINK_NETFILTER); + if (nl == NULL) { + perror("mnl_socket_open"); + exit(EXIT_FAILURE); + } + + if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) { + perror("mnl_socket_bind"); + exit(EXIT_FAILURE); + } + portid = mnl_socket_get_portid(nl); + + if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { + perror("mnl_socket_send"); + exit(EXIT_FAILURE); + } + + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + while (ret > 0) { + ret = mnl_cb_run(buf, ret, seq, portid, table_cb, NULL); + if (ret <= 0) + break; + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + } + if (ret == -1) { + perror("error"); + exit(EXIT_FAILURE); + } + mnl_socket_close(nl); + + return EXIT_SUCCESS; +} diff --git a/examples/nft-table-add.c b/examples/nft-table-add.c new file mode 100644 index 0000000..f59049c --- /dev/null +++ b/examples/nft-table-add.c @@ -0,0 +1,92 @@ +/* + * (C) 2012 by Pablo Neira Ayuso + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This software has been sponsored by Sophos Astaro + */ + +#include +#include +#include +#include + +#include + +#include +#include + +int main(int argc, char *argv[]) +{ + struct mnl_socket *nl; + char buf[MNL_SOCKET_BUFFER_SIZE]; + struct nlmsghdr *nlh; + uint32_t portid, seq, family; + struct nft_table *t = NULL; + int ret; + + if (argc != 3) { + fprintf(stderr, "%s \n", argv[0]); + exit(EXIT_FAILURE); + } + + t = nft_table_alloc(); + if (t == NULL) { + perror("OOM"); + exit(EXIT_FAILURE); + } + + seq = time(NULL); + if (strcmp(argv[1], "ip") == 0) + family = AF_INET; + else if (strcmp(argv[1], "ip6") == 0) + family = AF_INET6; + else if (strcmp(argv[1], "bridge") == 0) + family = AF_BRIDGE; + else { + fprintf(stderr, "Unknown family: ip, ip6, bridge\n"); + exit(EXIT_FAILURE); + } + + nft_table_attr_set(t, NFT_TABLE_ATTR_NAME, argv[2]); + + nlh = nft_table_nlmsg_build_hdr(buf, NFT_MSG_NEWTABLE, family, + NLM_F_ACK, seq); + nft_table_nlmsg_build_payload(nlh, t); + nft_table_free(t); + + nl = mnl_socket_open(NETLINK_NETFILTER); + if (nl == NULL) { + perror("mnl_socket_open"); + exit(EXIT_FAILURE); + } + + if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) { + perror("mnl_socket_bind"); + exit(EXIT_FAILURE); + } + portid = mnl_socket_get_portid(nl); + + if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { + perror("mnl_socket_send"); + exit(EXIT_FAILURE); + } + + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + while (ret > 0) { + ret = mnl_cb_run(buf, ret, seq, portid, NULL, NULL); + if (ret <= 0) + break; + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + } + if (ret == -1) { + perror("error"); + exit(EXIT_FAILURE); + } + mnl_socket_close(nl); + + return EXIT_SUCCESS; +} diff --git a/examples/nft-table-del.c b/examples/nft-table-del.c new file mode 100644 index 0000000..2a73a27 --- /dev/null +++ b/examples/nft-table-del.c @@ -0,0 +1,92 @@ +/* + * (C) 2012 by Pablo Neira Ayuso + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This software has been sponsored by Sophos Astaro + */ + +#include +#include +#include +#include + +#include + +#include +#include + +int main(int argc, char *argv[]) +{ + struct mnl_socket *nl; + char buf[MNL_SOCKET_BUFFER_SIZE]; + struct nlmsghdr *nlh; + uint32_t portid, seq, family; + struct nft_table *t = NULL; + int ret; + + if (argc != 3) { + fprintf(stderr, "%s \n", argv[0]); + exit(EXIT_FAILURE); + } + + t = nft_table_alloc(); + if (t == NULL) { + perror("OOM"); + exit(EXIT_FAILURE); + } + + seq = time(NULL); + if (strcmp(argv[1], "ip") == 0) + family = AF_INET; + else if (strcmp(argv[1], "ip6") == 0) + family = AF_INET6; + else if (strcmp(argv[1], "bridge") == 0) + family = AF_BRIDGE; + else { + fprintf(stderr, "Unknown family: ip, ip6, bridge\n"); + exit(EXIT_FAILURE); + } + + nlh = nft_table_nlmsg_build_hdr(buf, NFT_MSG_DELTABLE, family, + NLM_F_ACK, seq); + nft_table_attr_set(t, NFT_TABLE_ATTR_NAME, argv[2]); + + nft_table_nlmsg_build_payload(nlh, t); + nft_table_free(t); + + nl = mnl_socket_open(NETLINK_NETFILTER); + if (nl == NULL) { + perror("mnl_socket_open"); + exit(EXIT_FAILURE); + } + + if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) { + perror("mnl_socket_bind"); + exit(EXIT_FAILURE); + } + portid = mnl_socket_get_portid(nl); + + if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { + perror("mnl_socket_send"); + exit(EXIT_FAILURE); + } + + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + while (ret > 0) { + ret = mnl_cb_run(buf, ret, seq, portid, NULL, NULL); + if (ret <= 0) + break; + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + } + if (ret == -1) { + perror("error"); + exit(EXIT_FAILURE); + } + mnl_socket_close(nl); + + return EXIT_SUCCESS; +} diff --git a/examples/nft-table-get.c b/examples/nft-table-get.c new file mode 100644 index 0000000..219c188 --- /dev/null +++ b/examples/nft-table-get.c @@ -0,0 +1,107 @@ +/* + * (C) 2012 by Pablo Neira Ayuso + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This software has been sponsored by Sophos Astaro + */ + +#include +#include +#include +#include + +#include + +#include +#include + +static int table_cb(const struct nlmsghdr *nlh, void *data) +{ + struct nft_table *t; + char buf[4096]; + + t = nft_table_alloc(); + if (t == NULL) { + perror("OOM"); + goto err; + } + + if (nft_table_nlmsg_parse(nlh, t) < 0) { + perror("nft_table_nlmsg_parse"); + goto err_free; + } + + nft_table_snprintf(buf, sizeof(buf), t, NFT_TABLE_O_DEFAULT, 0); + printf("%s", buf); + +err_free: + nft_table_free(t); +err: + return MNL_CB_OK; +} + +int main(int argc, char *argv[]) +{ + struct mnl_socket *nl; + char buf[MNL_SOCKET_BUFFER_SIZE]; + struct nlmsghdr *nlh; + uint32_t portid, seq; + struct nft_table *t = NULL; + int ret; + + if (argc == 2) { + t = nft_table_alloc(); + if (t == NULL) { + perror("OOM"); + exit(EXIT_FAILURE); + } + } + + seq = time(NULL); + if (t == NULL) { + nlh = nft_table_nlmsg_build_hdr(buf, NFT_MSG_GETTABLE, AF_INET, + NLM_F_DUMP, seq); + } else { + nlh = nft_table_nlmsg_build_hdr(buf, NFT_MSG_GETTABLE, AF_INET, + NLM_F_ACK, seq); + nft_table_attr_set(t, NFT_TABLE_ATTR_NAME, argv[1]); + nft_table_nlmsg_build_payload(nlh, t); + nft_table_free(t); + } + + nl = mnl_socket_open(NETLINK_NETFILTER); + if (nl == NULL) { + perror("mnl_socket_open"); + exit(EXIT_FAILURE); + } + + if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) { + perror("mnl_socket_bind"); + exit(EXIT_FAILURE); + } + portid = mnl_socket_get_portid(nl); + + if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { + perror("mnl_socket_send"); + exit(EXIT_FAILURE); + } + + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + while (ret > 0) { + ret = mnl_cb_run(buf, ret, seq, portid, table_cb, NULL); + if (ret <= 0) + break; + ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); + } + if (ret == -1) { + perror("error"); + exit(EXIT_FAILURE); + } + mnl_socket_close(nl); + + return EXIT_SUCCESS; +} -- cgit v1.2.3