From 656141197153f22d8b4fd0920abbe8f455ca558f Mon Sep 17 00:00:00 2001 From: Arturo Borrero Date: Tue, 1 Oct 2013 00:33:18 +0200 Subject: src: add low-level ruleset API This patch adds a low level ruleset API for libnftables. Signed-off-by: Arturo Borrero Gonzalez Signed-off-by: Alvaro Neira Ayuso Signed-off-by: Pablo Neira Ayuso --- tests/jsonfiles/64-ruleset.json | 2 ++ tests/nft-parsing-test.c | 40 ++++++++++++++++++++++++++++++++++++++++ tests/xmlfiles/75-ruleset.xml | 1 + 3 files changed, 43 insertions(+) create mode 100644 tests/jsonfiles/64-ruleset.json create mode 100644 tests/xmlfiles/75-ruleset.xml (limited to 'tests') diff --git a/tests/jsonfiles/64-ruleset.json b/tests/jsonfiles/64-ruleset.json new file mode 100644 index 0000000..c4fffa1 --- /dev/null +++ b/tests/jsonfiles/64-ruleset.json @@ -0,0 +1,2 @@ +{ "nftables": [{"table" : {"name" : "filter","family" : "ip","flags" : 0}},{"table" : {"name" : "filter2","family" : "ip6","flags" : 0}},{ "chain": {"name": "input","handle": 1,"bytes": 10681449,"packets": 16216,"family": "ip","table": "filter","use": 0,"type": "filter","hooknum": "input","prio": 0,"policy": "accept"}},{ "chain": {"name": "forward","handle": 2,"bytes": 0,"packets": 0,"family": "ip","table": "filter","use": 0,"type": "filter","hooknum": "forward","prio": 0,"policy": "accept"}},{ "chain": {"name": "output","handle": 3,"bytes": 2375830,"packets": 15184,"family": "ip","table": "filter","use": 0,"type": "filter","hooknum": "output","prio": 0,"policy": "accept"}},{ "chain": {"name": "chain1","handle": 4,"bytes": 0,"packets": 0,"family": "ip","table": "filter","use": 0}},{ "set": { "name": "set0","table": "filter","flags": 3,"family": "ip","key_type": 12,"key_len": 2}},{ "rule": { "family" : "ip", "table" : "filter", "chain" : "output", "handle" : 6,"flags" : 0, " expr" : [ { "type" : "payload", "dreg" : 1, "offset" : 16, "len" : 4, "base" : "link"}, { "type" : "cmp", "sreg" : 1, "op" : "eq", "cmpdata" : {"data_reg": { "type" : "value", "len" : 4, "data0" : "0x0100a8c0"}}}, { "type" : "counter", "pkts" : 0, "bytes" : 0}, { "type" : "immediate", "dreg" : 0, "immediatedata" : {"data_reg": {"type" : "verdict", "verdict" : "drop"}}}]}},{ "rule": { "family" : "ip", "table" : "filter", "chain" : "output", "handle" : 9,"flags" : 0, "expr" : [ { "type" : "payload", "dreg" : 1, "offset" : 9, "len" : 1, "base" : "link"}, { "type" : "cmp", "sreg" : 1, "op" : "eq", "cmpdata" : {"data_reg": { "type" : "value", "len" : 1, "data0" : "0x00000006"}}}, { "type" : "payload", "dreg" : 1, "offset" : 2, "len" : 2, "base" : "link"}, { "type" : "cmp", "sreg" : 1, "op" : "eq", "cmpdata" : {"data_reg": { "type" : "value", "len" : 2, "data0" : "0x00001600"}}}, { "type" : "counter", "pkts" : 0, "bytes" : 0}]}},{ "rule": { "family" : "ip", "table" : "filter", "chain" : "output", "handle" : 10,"flags" : 0, "expr" : [ { "type" : "payload", "dreg" : 1, "offset" : 16, "len" : 4, "base" : "link"}, { "type" : "cmp", "sreg" : 1, "op" : "eq", "cmpdata" : {"data_reg": { "type" : "value", "len" : 4, "data0" : "0x0100a8c0"}}}, { "type" : "counter", "pkts" : 0, "bytes" : 0}]}},{ "rule": { "family" : "ip", "table" : "filter", "chain" : "output", "handle" : 11,"flags" : 0, "expr" : [ { "type" : "payload", "dreg" : 1, "offset" : 16, "len" : 4, "base" : "link"}, { "type" : "cmp", "sreg" : 1, "op" : "eq", "cmpdata" : {"data_reg": { "type" : "value", "len" : 4, "data0" : "0x0100a8c0"}}}, { "type" : "counter", "pkts" : 0, "bytes" : 0}, { "type" : "immediate", "dreg" : 0, "immediatedata" : {"data_reg": {"type" : "verdict", "verdict" : "drop"}}}]}}]} + diff --git a/tests/nft-parsing-test.c b/tests/nft-parsing-test.c index ecde0e2..866c985 100644 --- a/tests/nft-parsing-test.c +++ b/tests/nft-parsing-test.c @@ -6,6 +6,7 @@ #include #include /*nlmsghdr*/ +#include #include #include #include @@ -24,10 +25,12 @@ enum { TEST_XML_CHAIN, TEST_XML_RULE, TEST_XML_SET, + TEST_XML_RULESET, TEST_JSON_TABLE, TEST_JSON_CHAIN, TEST_JSON_RULE, TEST_JSON_SET, + TEST_JSON_RULESET, }; #if defined(XML_PARSING) || defined(JSON_PARSING) @@ -76,6 +79,7 @@ static int compare_test(uint32_t type, void *input, const char *filename) struct nft_chain *c = NULL; struct nft_rule *r = NULL; struct nft_set *s = NULL; + struct nft_ruleset *rs = NULL; char orig[4096]; char out[4096]; FILE *fp; @@ -97,6 +101,10 @@ static int compare_test(uint32_t type, void *input, const char *filename) case TEST_JSON_SET: s = (struct nft_set *)input; break; + case TEST_XML_RULESET: + case TEST_JSON_RULESET: + rs = (struct nft_ruleset *)input; + break; default: errno = EINVAL; return -1; @@ -127,6 +135,14 @@ static int compare_test(uint32_t type, void *input, const char *filename) case TEST_JSON_SET: nft_set_snprintf(out, sizeof(out), s, NFT_SET_O_JSON, 0); break; + case TEST_XML_RULESET: + nft_ruleset_snprintf(out, sizeof(out), rs, + NFT_RULESET_O_XML, 0); + break; + case TEST_JSON_RULESET: + nft_ruleset_snprintf(out, sizeof(out), rs, + NFT_RULESET_O_JSON, 0); + break; default: errno = EINVAL; return -1; @@ -159,6 +175,7 @@ static int test_json(const char *filename) struct nft_chain *c; struct nft_rule *r; struct nft_set *s; + struct nft_ruleset *rs; json_t *root; json_error_t error; char *json; @@ -211,6 +228,16 @@ static int test_json(const char *filename) nft_set_free(s); } + } else if (json_object_get(root, "nftables") != NULL) { + rs = nft_ruleset_alloc(); + if (rs != NULL) { + if (nft_ruleset_parse(rs, NFT_RULESET_PARSE_JSON, json) == 0) + ret = compare_test(TEST_JSON_RULESET, rs, filename); + else + ret = -1; + + nft_ruleset_free(rs); + } } free(json); @@ -237,6 +264,7 @@ static int test_xml(const char *filename) struct nft_chain *c; struct nft_rule *r; struct nft_set *s; + struct nft_ruleset *rs; FILE *fp; mxml_node_t *tree; char *xml; @@ -293,6 +321,18 @@ static int test_xml(const char *filename) nft_set_free(s); } + } else if (strcmp(tree->value.opaque, "nftables") == 0) { + rs = nft_ruleset_alloc(); + if (rs != NULL) { + if (nft_ruleset_parse(rs, NFT_RULESET_PARSE_XML, + xml) == 0) + ret = compare_test(TEST_XML_RULESET, rs, + filename); + else + ret = -1; + + nft_ruleset_free(rs); + } } return ret; diff --git a/tests/xmlfiles/75-ruleset.xml b/tests/xmlfiles/75-ruleset.xml new file mode 100644 index 0000000..926c2be --- /dev/null +++ b/tests/xmlfiles/75-ruleset.xml @@ -0,0 +1 @@ +filterip0
filter2ip0
input100filter
ipoutput300filter
ipipfilter
set0312200020x00001900020x00001600ipfilter
set1312200