From cb86c1691c6900881b43229c07779412ffc48154 Mon Sep 17 00:00:00 2001 From: Arturo Borrero Gonzalez Date: Thu, 23 Jan 2014 17:42:34 +0000 Subject: ruleset: add XML/JSON export This patch adds the following operation: :~# nft export The XML/JSON output is provided raw by libnftnl, thus without format. In case of XML, you can give format with the `xmllint' tool from libxml2-tools: :~# nft list ruleset xml | xmllint --format - In case of JSON, you can use `json_pp' from perl standar package: :~# nft list ruleset json | json_pp A format field is added in struct cmd, and it will be reused in the import operation. Signed-off-by: Arturo Borrero Gonzalez Signed-off-by: Patrick McHardy --- src/evaluate.c | 1 + src/mnl.c | 64 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++- src/netlink.c | 17 ++++++++++++++++ src/parser.y | 23 +++++++++++++++++++-- src/rule.c | 20 ++++++++++++++++++ src/scanner.l | 4 ++++ 6 files changed, 126 insertions(+), 3 deletions(-) (limited to 'src') diff --git a/src/evaluate.c b/src/evaluate.c index cf30ed92..215a004a 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1405,6 +1405,7 @@ static int cmd_evaluate(struct eval_ctx *ctx, struct cmd *cmd) case CMD_LIST: case CMD_FLUSH: case CMD_RENAME: + case CMD_EXPORT: return 0; default: BUG("invalid command operation %u\n", cmd->op); diff --git a/src/mnl.c b/src/mnl.c index 7ac1fc57..3f092ed9 100644 --- a/src/mnl.c +++ b/src/mnl.c @@ -9,6 +9,8 @@ */ #include +#include +#include #include #include #include @@ -645,7 +647,8 @@ mnl_nft_set_dump(struct mnl_socket *nf_sock, int family, const char *table) nlh = nft_set_nlmsg_build_hdr(buf, NFT_MSG_GETSET, family, NLM_F_DUMP|NLM_F_ACK, seq); - nft_set_attr_set(s, NFT_SET_ATTR_TABLE, table); + if (table != NULL) + nft_set_attr_set(s, NFT_SET_ATTR_TABLE, table); nft_set_nlmsg_build_payload(nlh, s); nft_set_free(s); @@ -733,3 +736,62 @@ int mnl_nft_setelem_get(struct mnl_socket *nf_sock, struct nft_set *nls) return mnl_talk(nf_sock, nlh, nlh->nlmsg_len, set_elem_cb, nls); } + +/* + * ruleset + */ +struct nft_ruleset *mnl_nft_ruleset_dump(struct mnl_socket *nf_sock, + uint32_t family) +{ + struct nft_ruleset *rs; + struct nft_table_list *t; + struct nft_chain_list *c; + struct nft_set_list *sl; + struct nft_set_list_iter *i; + struct nft_set *s; + struct nft_rule_list *r; + int ret = 0; + + rs = nft_ruleset_alloc(); + if (rs == NULL) + memory_allocation_error(); + + t = mnl_nft_table_dump(nf_sock, family); + if (t != NULL) + nft_ruleset_attr_set(rs, NFT_RULESET_ATTR_TABLELIST, t); + + c = mnl_nft_chain_dump(nf_sock, family); + if (c != NULL) + nft_ruleset_attr_set(rs, NFT_RULESET_ATTR_CHAINLIST, c); + + sl = mnl_nft_set_dump(nf_sock, family, NULL); + if (sl != NULL) { + i = nft_set_list_iter_create(sl); + s = nft_set_list_iter_next(i); + while (s != NULL) { + ret = mnl_nft_setelem_get(nf_sock, s); + if (ret != 0) + goto out; + + s = nft_set_list_iter_next(i); + } + nft_set_list_iter_destroy(i); + + nft_ruleset_attr_set(rs, NFT_RULESET_ATTR_SETLIST, sl); + } + + r = mnl_nft_rule_dump(nf_sock, family); + if (r != NULL) + nft_ruleset_attr_set(rs, NFT_RULESET_ATTR_RULELIST, r); + + if (!(nft_ruleset_attr_is_set(rs, NFT_RULESET_ATTR_TABLELIST)) && + !(nft_ruleset_attr_is_set(rs, NFT_RULESET_ATTR_CHAINLIST)) && + !(nft_ruleset_attr_is_set(rs, NFT_RULESET_ATTR_SETLIST)) && + !(nft_ruleset_attr_is_set(rs, NFT_RULESET_ATTR_RULELIST))) + goto out; + + return rs; +out: + nft_ruleset_free(rs); + return NULL; +} diff --git a/src/netlink.c b/src/netlink.c index 84be505d..98e7fc6c 100644 --- a/src/netlink.c +++ b/src/netlink.c @@ -13,12 +13,15 @@ #include #include #include +#include +#include #include #include #include #include #include +#include #include #include @@ -1050,3 +1053,17 @@ int netlink_batch_send(struct list_head *err_list) { return mnl_batch_talk(nf_sock, err_list); } + +struct nft_ruleset *netlink_dump_ruleset(struct netlink_ctx *ctx, + const struct handle *h, + const struct location *loc) +{ + struct nft_ruleset *rs; + + rs = mnl_nft_ruleset_dump(nf_sock, h->family); + if (rs == NULL) + netlink_io_error(ctx, loc, "Could not receive ruleset: %s", + strerror(errno)); + + return rs; +} diff --git a/src/parser.y b/src/parser.y index cd9ade14..24f022a5 100644 --- a/src/parser.y +++ b/src/parser.y @@ -18,6 +18,7 @@ #include #include #include +#include #include #include @@ -176,6 +177,7 @@ static void location_update(struct location *loc, struct location *rhs, int n) %token FLUSH "flush" %token RENAME "rename" %token DESCRIBE "describe" +%token EXPORT "export" %token ACCEPT "accept" %token DROP "drop" @@ -346,14 +348,17 @@ static void location_update(struct location *loc, struct location *rhs, int n) %token POSITION "position" +%token XML "xml" +%token JSON "json" + %type identifier string %destructor { xfree($$); } identifier string %type line %destructor { cmd_free($$); } line -%type base_cmd add_cmd create_cmd insert_cmd delete_cmd list_cmd flush_cmd rename_cmd -%destructor { cmd_free($$); } base_cmd add_cmd create_cmd insert_cmd delete_cmd list_cmd flush_cmd rename_cmd +%type base_cmd add_cmd create_cmd insert_cmd delete_cmd list_cmd flush_cmd rename_cmd export_cmd +%destructor { cmd_free($$); } base_cmd add_cmd create_cmd insert_cmd delete_cmd list_cmd flush_cmd rename_cmd export_cmd %type table_spec tables_spec chain_spec chain_identifier ruleid_spec %destructor { handle_free(&$$); } table_spec tables_spec chain_spec chain_identifier ruleid_spec @@ -476,6 +481,8 @@ static void location_update(struct location *loc, struct location *rhs, int n) %destructor { expr_free($$); } ct_expr %type ct_key +%type export_format + %% input : /* empty */ @@ -544,6 +551,7 @@ base_cmd : /* empty */ add_cmd { $$ = $1; } | LIST list_cmd { $$ = $2; } | FLUSH flush_cmd { $$ = $2; } | RENAME rename_cmd { $$ = $2; } + | EXPORT export_cmd { $$ = $2; } | DESCRIBE primary_expr { expr_describe($2); @@ -703,6 +711,14 @@ rename_cmd : CHAIN chain_spec identifier } ; +export_cmd : export_format + { + struct handle h = { .family = NFPROTO_UNSPEC }; + $$ = cmd_alloc(CMD_EXPORT, CMD_OBJ_RULESET, &h, &@$, NULL); + $$->format = $1; + } + ; + table_block_alloc : /* empty */ { $$ = table_alloc(); @@ -1914,4 +1930,7 @@ mh_hdr_field : NEXTHDR { $$ = MHHDR_NEXTHDR; } | CHECKSUM { $$ = MHHDR_CHECKSUM; } ; +export_format : XML { $$ = NFT_OUTPUT_XML; } + | JSON { $$ = NFT_OUTPUT_JSON; } + ; %% diff --git a/src/rule.c b/src/rule.c index b43ce107..38cd63cf 100644 --- a/src/rule.c +++ b/src/rule.c @@ -18,7 +18,10 @@ #include #include #include +#include +#include +#include #include #include #include @@ -592,6 +595,21 @@ static int do_list_sets(struct netlink_ctx *ctx, const struct location *loc, return 0; } +static int do_command_export(struct netlink_ctx *ctx, struct cmd *cmd) +{ + struct nft_ruleset *rs = netlink_dump_ruleset(ctx, &cmd->handle, + &cmd->location); + + if (rs == NULL) + return -1; + + nft_ruleset_fprintf(stdout, rs, cmd->format, 0); + fprintf(stdout, "\n"); + + nft_ruleset_free(rs); + return 0; +} + static int do_command_list(struct netlink_ctx *ctx, struct cmd *cmd) { struct table *table = NULL; @@ -744,6 +762,8 @@ int do_command(struct netlink_ctx *ctx, struct cmd *cmd) return do_command_flush(ctx, cmd); case CMD_RENAME: return do_command_rename(ctx, cmd); + case CMD_EXPORT: + return do_command_export(ctx, cmd); default: BUG("invalid command object type %u\n", cmd->obj); } diff --git a/src/scanner.l b/src/scanner.l index f133f237..47ab1e23 100644 --- a/src/scanner.l +++ b/src/scanner.l @@ -255,6 +255,7 @@ addrstring ({macaddr}|{ip4addr}|{ip6addr}) "list" { return LIST; } "flush" { return FLUSH; } "rename" { return RENAME; } +"export" { return EXPORT; } "position" { return POSITION; } @@ -411,6 +412,9 @@ addrstring ({macaddr}|{ip4addr}|{ip6addr}) "proto-src" { return PROTO_SRC; } "proto-dst" { return PROTO_DST; } +"xml" { return XML; } +"json" { return JSON; } + {addrstring} { yylval->string = xstrdup(yytext); return STRING; -- cgit v1.2.3