libnftnl  1.1.9
data_reg.c
1 /*
2  * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License as published
6  * by the Free Software Foundation; either version 2 of the License, or
7  * (at your option) any later version.
8  *
9  * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
10  */
11 
12 #include <stdio.h>
13 #include <stdint.h>
14 #include <string.h>
15 #include <limits.h>
16 #include <arpa/inet.h>
17 #include <errno.h>
18 #include <netinet/in.h>
19 
20 #include <libmnl/libmnl.h>
21 #include <linux/netfilter.h>
22 #include <linux/netfilter/nf_tables.h>
23 #include <libnftnl/expr.h>
24 #include <libnftnl/rule.h>
25 #include "internal.h"
26 
27 static int
28 nftnl_data_reg_value_snprintf_default(char *buf, size_t size,
29  const union nftnl_data_reg *reg,
30  uint32_t flags)
31 {
32  const char *pfx = flags & DATA_F_NOPFX ? "" : "0x";
33  int remain = size, offset = 0, ret, i;
34 
35 
36 
37  for (i = 0; i < div_round_up(reg->len, sizeof(uint32_t)); i++) {
38  ret = snprintf(buf + offset, remain,
39  "%s%.8x ", pfx, reg->val[i]);
40  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
41  }
42 
43  return offset;
44 }
45 
46 static int
47 nftnl_data_reg_verdict_snprintf_def(char *buf, size_t size,
48  const union nftnl_data_reg *reg,
49  uint32_t flags)
50 {
51  int remain = size, offset = 0, ret = 0;
52 
53  ret = snprintf(buf, size, "%s ", nftnl_verdict2str(reg->verdict));
54  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
55 
56  if (reg->chain != NULL) {
57  ret = snprintf(buf + offset, remain, "-> %s ", reg->chain);
58  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
59  }
60 
61  return offset;
62 }
63 
64 int nftnl_data_reg_snprintf(char *buf, size_t size,
65  const union nftnl_data_reg *reg,
66  uint32_t output_format, uint32_t flags,
67  int reg_type)
68 {
69  switch(reg_type) {
70  case DATA_VALUE:
71  switch(output_format) {
72  case NFTNL_OUTPUT_DEFAULT:
73  return nftnl_data_reg_value_snprintf_default(buf, size,
74  reg, flags);
75  case NFTNL_OUTPUT_JSON:
76  case NFTNL_OUTPUT_XML:
77  default:
78  break;
79  }
80  break;
81  case DATA_VERDICT:
82  case DATA_CHAIN:
83  switch(output_format) {
84  case NFTNL_OUTPUT_DEFAULT:
85  return nftnl_data_reg_verdict_snprintf_def(buf, size,
86  reg, flags);
87  case NFTNL_OUTPUT_JSON:
88  case NFTNL_OUTPUT_XML:
89  default:
90  break;
91  }
92  break;
93  default:
94  break;
95  }
96 
97  return -1;
98 }
99 
100 static int nftnl_data_parse_cb(const struct nlattr *attr, void *data)
101 {
102  const struct nlattr **tb = data;
103  int type = mnl_attr_get_type(attr);
104 
105  if (mnl_attr_type_valid(attr, NFTA_DATA_MAX) < 0)
106  return MNL_CB_OK;
107 
108  switch(type) {
109  case NFTA_DATA_VALUE:
110  if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0)
111  abi_breakage();
112  break;
113  case NFTA_DATA_VERDICT:
114  if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
115  abi_breakage();
116  break;
117  }
118  tb[type] = attr;
119  return MNL_CB_OK;
120 }
121 
122 static int nftnl_verdict_parse_cb(const struct nlattr *attr, void *data)
123 {
124  const struct nlattr **tb = data;
125  int type = mnl_attr_get_type(attr);
126 
127  if (mnl_attr_type_valid(attr, NFTA_VERDICT_MAX) < 0)
128  return MNL_CB_OK;
129 
130  switch(type) {
131  case NFTA_VERDICT_CODE:
132  case NFTA_VERDICT_CHAIN_ID:
133  if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
134  abi_breakage();
135  break;
136  case NFTA_VERDICT_CHAIN:
137  if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
138  abi_breakage();
139  break;
140  }
141  tb[type] = attr;
142  return MNL_CB_OK;
143 }
144 
145 static int
146 nftnl_parse_verdict(union nftnl_data_reg *data, const struct nlattr *attr, int *type)
147 {
148  struct nlattr *tb[NFTA_VERDICT_MAX+1];
149 
150  if (mnl_attr_parse_nested(attr, nftnl_verdict_parse_cb, tb) < 0)
151  return -1;
152 
153  if (!tb[NFTA_VERDICT_CODE])
154  return -1;
155 
156  data->verdict = ntohl(mnl_attr_get_u32(tb[NFTA_VERDICT_CODE]));
157 
158  switch(data->verdict) {
159  case NF_ACCEPT:
160  case NF_DROP:
161  case NF_QUEUE:
162  case NFT_CONTINUE:
163  case NFT_BREAK:
164  case NFT_RETURN:
165  if (type)
166  *type = DATA_VERDICT;
167  data->len = sizeof(data->verdict);
168  break;
169  case NFT_JUMP:
170  case NFT_GOTO:
171  if (!tb[NFTA_VERDICT_CHAIN])
172  return -1;
173 
174  data->chain = strdup(mnl_attr_get_str(tb[NFTA_VERDICT_CHAIN]));
175  if (!data->chain)
176  return -1;
177 
178  if (type)
179  *type = DATA_CHAIN;
180  break;
181  default:
182  return -1;
183  }
184 
185  return 0;
186 }
187 
188 static int
189 __nftnl_parse_data(union nftnl_data_reg *data, const struct nlattr *attr)
190 {
191  void *orig = mnl_attr_get_payload(attr);
192  uint32_t data_len = mnl_attr_get_payload_len(attr);
193 
194  if (data_len == 0)
195  return -1;
196 
197  if (data_len > sizeof(data->val))
198  return -1;
199 
200  memcpy(data->val, orig, data_len);
201  data->len = data_len;
202 
203  return 0;
204 }
205 
206 int nftnl_parse_data(union nftnl_data_reg *data, struct nlattr *attr, int *type)
207 {
208  struct nlattr *tb[NFTA_DATA_MAX+1] = {};
209  int ret = 0;
210 
211  if (mnl_attr_parse_nested(attr, nftnl_data_parse_cb, tb) < 0)
212  return -1;
213 
214  if (tb[NFTA_DATA_VALUE]) {
215  if (type)
216  *type = DATA_VALUE;
217 
218  ret = __nftnl_parse_data(data, tb[NFTA_DATA_VALUE]);
219  if (ret < 0)
220  return ret;
221  }
222  if (tb[NFTA_DATA_VERDICT])
223  ret = nftnl_parse_verdict(data, tb[NFTA_DATA_VERDICT], type);
224 
225  return ret;
226 }
227 
228 void nftnl_free_verdict(const union nftnl_data_reg *data)
229 {
230  switch(data->verdict) {
231  case NFT_JUMP:
232  case NFT_GOTO:
233  xfree(data->chain);
234  break;
235  default:
236  break;
237  }
238 }