16 #include <arpa/inet.h>
17 #include <libmnl/libmnl.h>
18 #include <linux/netfilter/nf_tables.h>
19 #include <libnftnl/rule.h>
20 #include <libnftnl/expr.h>
26 enum nft_registers sreg_key;
27 enum nft_registers sreg_data;
28 enum nft_dynset_ops op;
30 struct nftnl_expr *expr;
36 nftnl_expr_dynset_set(
struct nftnl_expr *e, uint16_t type,
37 const void *data, uint32_t data_len)
42 case NFTNL_EXPR_DYNSET_SREG_KEY:
43 dynset->sreg_key = *((uint32_t *)data);
45 case NFTNL_EXPR_DYNSET_SREG_DATA:
46 dynset->sreg_data = *((uint32_t *)data);
48 case NFTNL_EXPR_DYNSET_OP:
49 dynset->op = *((uint32_t *)data);
51 case NFTNL_EXPR_DYNSET_TIMEOUT:
52 dynset->timeout = *((uint64_t *)data);
54 case NFTNL_EXPR_DYNSET_SET_NAME:
55 dynset->set_name = strdup((
const char *)data);
56 if (!dynset->set_name)
59 case NFTNL_EXPR_DYNSET_SET_ID:
60 dynset->set_id = *((uint32_t *)data);
62 case NFTNL_EXPR_DYNSET_EXPR:
63 dynset->expr = (
void *)data;
72 nftnl_expr_dynset_get(
const struct nftnl_expr *e, uint16_t type,
78 case NFTNL_EXPR_DYNSET_SREG_KEY:
79 *data_len =
sizeof(dynset->sreg_key);
80 return &dynset->sreg_key;
81 case NFTNL_EXPR_DYNSET_SREG_DATA:
82 *data_len =
sizeof(dynset->sreg_data);
83 return &dynset->sreg_data;
84 case NFTNL_EXPR_DYNSET_OP:
85 *data_len =
sizeof(dynset->op);
87 case NFTNL_EXPR_DYNSET_TIMEOUT:
88 *data_len =
sizeof(dynset->timeout);
89 return &dynset->timeout;
90 case NFTNL_EXPR_DYNSET_SET_NAME:
91 *data_len = strlen(dynset->set_name) + 1;
92 return dynset->set_name;
93 case NFTNL_EXPR_DYNSET_SET_ID:
94 *data_len =
sizeof(dynset->set_id);
95 return &dynset->set_id;
96 case NFTNL_EXPR_DYNSET_EXPR:
102 static int nftnl_expr_dynset_cb(
const struct nlattr *attr,
void *data)
104 const struct nlattr **tb = data;
105 int type = mnl_attr_get_type(attr);
107 if (mnl_attr_type_valid(attr, NFTA_SET_MAX) < 0)
111 case NFTA_DYNSET_SREG_KEY:
112 case NFTA_DYNSET_SREG_DATA:
113 case NFTA_DYNSET_SET_ID:
115 if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
118 case NFTA_DYNSET_TIMEOUT:
119 if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
122 case NFTA_DYNSET_SET_NAME:
123 if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
126 case NFTA_DYNSET_EXPR:
127 if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
137 nftnl_expr_dynset_build(
struct nlmsghdr *nlh,
const struct nftnl_expr *e)
142 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_KEY))
143 mnl_attr_put_u32(nlh, NFTA_DYNSET_SREG_KEY, htonl(dynset->sreg_key));
144 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_DATA))
145 mnl_attr_put_u32(nlh, NFTA_DYNSET_SREG_DATA, htonl(dynset->sreg_data));
146 if (e->flags & (1 << NFTNL_EXPR_DYNSET_OP))
147 mnl_attr_put_u32(nlh, NFTA_DYNSET_OP, htonl(dynset->op));
148 if (e->flags & (1 << NFTNL_EXPR_DYNSET_TIMEOUT))
149 mnl_attr_put_u64(nlh, NFTA_DYNSET_TIMEOUT, htobe64(dynset->timeout));
150 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SET_NAME))
151 mnl_attr_put_strz(nlh, NFTA_DYNSET_SET_NAME, dynset->set_name);
152 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SET_ID))
153 mnl_attr_put_u32(nlh, NFTA_DYNSET_SET_ID, htonl(dynset->set_id));
154 if (e->flags & (1 << NFTNL_EXPR_DYNSET_EXPR)) {
155 nest = mnl_attr_nest_start(nlh, NFTA_DYNSET_EXPR);
156 nftnl_expr_build_payload(nlh, dynset->expr);
157 mnl_attr_nest_end(nlh, nest);
162 nftnl_expr_dynset_parse(
struct nftnl_expr *e,
struct nlattr *attr)
165 struct nlattr *tb[NFTA_SET_MAX+1] = {};
168 if (mnl_attr_parse_nested(attr, nftnl_expr_dynset_cb, tb) < 0)
171 if (tb[NFTA_DYNSET_SREG_KEY]) {
172 dynset->sreg_key = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SREG_KEY]));
173 e->flags |= (1 << NFTNL_EXPR_DYNSET_SREG_KEY);
175 if (tb[NFTA_DYNSET_SREG_DATA]) {
176 dynset->sreg_data = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SREG_DATA]));
177 e->flags |= (1 << NFTNL_EXPR_DYNSET_SREG_DATA);
179 if (tb[NFTA_DYNSET_OP]) {
180 dynset->op = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_OP]));
181 e->flags |= (1 << NFTNL_EXPR_DYNSET_OP);
183 if (tb[NFTA_DYNSET_TIMEOUT]) {
184 dynset->timeout = be64toh(mnl_attr_get_u64(tb[NFTA_DYNSET_TIMEOUT]));
185 e->flags |= (1 << NFTNL_EXPR_DYNSET_TIMEOUT);
187 if (tb[NFTA_DYNSET_SET_NAME]) {
189 strdup(mnl_attr_get_str(tb[NFTA_DYNSET_SET_NAME]));
190 if (!dynset->set_name)
192 e->flags |= (1 << NFTNL_EXPR_DYNSET_SET_NAME);
194 if (tb[NFTA_DYNSET_SET_ID]) {
195 dynset->set_id = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SET_ID]));
196 e->flags |= (1 << NFTNL_EXPR_DYNSET_SET_ID);
198 if (tb[NFTA_DYNSET_EXPR]) {
199 e->flags |= (1 << NFTNL_EXPR_DYNSET_EXPR);
200 dynset->expr = nftnl_expr_parse(tb[NFTA_DYNSET_EXPR]);
201 if (dynset->expr == NULL)
209 nftnl_expr_dynset_json_parse(
struct nftnl_expr *e, json_t *root,
210 struct nftnl_parse_err *err)
213 const char *set_name;
217 set_name = nftnl_jansson_parse_str(root,
"set", err);
218 if (set_name != NULL)
219 nftnl_expr_set_str(e, NFTNL_EXPR_DYNSET_SET_NAME, set_name);
221 if (nftnl_jansson_parse_reg(root,
"sreg_key",
222 NFTNL_TYPE_U32, &uval32, err) == 0)
223 nftnl_expr_set_u32(e, NFTNL_EXPR_DYNSET_SREG_KEY, uval32);
225 if (nftnl_jansson_parse_reg(root,
"sreg_data",
226 NFTNL_TYPE_U32, &uval32, err) == 0)
227 nftnl_expr_set_u32(e, NFTNL_EXPR_DYNSET_SREG_DATA, uval32);
229 if (nftnl_jansson_parse_val(root,
"op", NFTNL_TYPE_U32, &uval32,
231 nftnl_expr_set_u32(e, NFTNL_EXPR_DYNSET_OP, uval32);
233 if (nftnl_jansson_parse_val(root,
"timeout", NFTNL_TYPE_U64, &uval64,
235 nftnl_expr_set_u64(e, NFTNL_EXPR_DYNSET_TIMEOUT, uval64);
245 nftnl_expr_dynset_export(
char *buf,
size_t size,
246 const struct nftnl_expr *e,
int type)
249 NFTNL_BUF_INIT(b, buf, size);
251 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SET_NAME))
252 nftnl_buf_str(&b, type, dynset->set_name, SET_NAME);
253 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_KEY))
254 nftnl_buf_u32(&b, type, dynset->sreg_key, SREG_KEY);
255 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_DATA))
256 nftnl_buf_u32(&b, type, dynset->sreg_data, SREG_DATA);
258 return nftnl_buf_done(&b);
261 static const char *op2str_array[] = {
262 [NFT_DYNSET_OP_ADD] =
"add",
263 [NFT_DYNSET_OP_UPDATE] =
"update",
266 static const char *op2str(
enum nft_dynset_ops op)
268 if (op > NFT_DYNSET_OP_UPDATE)
270 return op2str_array[op];
274 nftnl_expr_dynset_snprintf_default(
char *buf,
size_t size,
275 const struct nftnl_expr *e)
278 struct nftnl_expr *expr;
279 int remain = size, offset = 0, ret;
281 ret = snprintf(buf, remain,
"%s reg_key %u set %s ",
282 op2str(dynset->op), dynset->sreg_key, dynset->set_name);
283 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
285 if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_DATA)) {
286 ret = snprintf(buf + offset, remain,
"sreg_data %u ",
288 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
290 if (e->flags & (1 << NFTNL_EXPR_DYNSET_TIMEOUT)) {
291 ret = snprintf(buf + offset, remain,
"timeout %"PRIu64
"ms ",
293 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
295 if (e->flags & (1 << NFTNL_EXPR_DYNSET_EXPR)) {
297 ret = snprintf(buf + offset, remain,
"expr [ %s ",
299 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
301 ret = nftnl_expr_snprintf(buf + offset, remain, expr,
302 NFTNL_OUTPUT_DEFAULT,
304 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
306 ret = snprintf(buf + offset, remain,
"] ");
307 SNPRINTF_BUFFER_SIZE(ret, remain, offset);
314 nftnl_expr_dynset_snprintf(
char *buf,
size_t size, uint32_t type,
315 uint32_t flags,
const struct nftnl_expr *e)
318 case NFTNL_OUTPUT_DEFAULT:
319 return nftnl_expr_dynset_snprintf_default(buf, size, e);
320 case NFTNL_OUTPUT_XML:
321 case NFTNL_OUTPUT_JSON:
322 return nftnl_expr_dynset_export(buf, size, e, type);
329 static void nftnl_expr_dynset_free(
const struct nftnl_expr *e)
333 xfree(dynset->set_name);
336 static bool nftnl_expr_dynset_cmp(
const struct nftnl_expr *e1,
337 const struct nftnl_expr *e2)
343 if (e1->flags & (1 << NFTNL_EXPR_DYNSET_SREG_KEY))
344 eq &= (d1->sreg_key == d2->sreg_key);
345 if (e1->flags & (1 << NFTNL_EXPR_DYNSET_SREG_DATA))
346 eq &= (d1->sreg_data == d2->sreg_data);
347 if (e1->flags & (1 << NFTNL_EXPR_DYNSET_OP))
348 eq &= (d1->op == d2->op);
349 if (e1->flags & (1 << NFTNL_EXPR_DYNSET_TIMEOUT))
350 eq &= (d1->timeout == d2->timeout);
351 if (e1->flags & (1 << NFTNL_EXPR_DYNSET_EXPR))
353 if (e1->flags & (1 << NFTNL_EXPR_DYNSET_SET_NAME))
354 eq &= !strcmp(d1->set_name, d2->set_name);
355 if (e1->flags & (1 << NFTNL_EXPR_DYNSET_SET_ID))
356 eq &= (d1->set_id == d2->set_id);
361 struct expr_ops expr_ops_dynset = {
364 .max_attr = NFTA_DYNSET_MAX,
365 .free = nftnl_expr_dynset_free,
366 .cmp = nftnl_expr_dynset_cmp,
367 .set = nftnl_expr_dynset_set,
368 .get = nftnl_expr_dynset_get,
369 .parse = nftnl_expr_dynset_parse,
370 .build = nftnl_expr_dynset_build,
371 .snprintf = nftnl_expr_dynset_snprintf,
372 .json_parse = nftnl_expr_dynset_json_parse,