libnftnl  1.1.8
data_reg.c
1 /*
2  * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License as published
6  * by the Free Software Foundation; either version 2 of the License, or
7  * (at your option) any later version.
8  *
9  * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
10  */
11 
12 #include <stdio.h>
13 #include <stdint.h>
14 #include <string.h>
15 #include <limits.h>
16 #include <arpa/inet.h>
17 #include <errno.h>
18 #include <netinet/in.h>
19 
20 #include <libmnl/libmnl.h>
21 #include <linux/netfilter.h>
22 #include <linux/netfilter/nf_tables.h>
23 #include <libnftnl/expr.h>
24 #include <libnftnl/rule.h>
25 #include "internal.h"
26 
27 static int
28 nftnl_data_reg_value_snprintf_default(char *buf, size_t size,
29  const union nftnl_data_reg *reg,
30  uint32_t flags)
31 {
32  int remain = size, offset = 0, ret, i;
33 
34  for (i = 0; i < div_round_up(reg->len, sizeof(uint32_t)); i++) {
35  ret = snprintf(buf + offset, remain, "0x%.8x ", reg->val[i]);
36  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
37  }
38 
39  return offset;
40 }
41 
42 static int
43 nftnl_data_reg_verdict_snprintf_def(char *buf, size_t size,
44  const union nftnl_data_reg *reg,
45  uint32_t flags)
46 {
47  int remain = size, offset = 0, ret = 0;
48 
49  ret = snprintf(buf, size, "%s ", nftnl_verdict2str(reg->verdict));
50  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
51 
52  if (reg->chain != NULL) {
53  ret = snprintf(buf + offset, remain, "-> %s ", reg->chain);
54  SNPRINTF_BUFFER_SIZE(ret, remain, offset);
55  }
56 
57  return offset;
58 }
59 
60 int nftnl_data_reg_snprintf(char *buf, size_t size,
61  const union nftnl_data_reg *reg,
62  uint32_t output_format, uint32_t flags,
63  int reg_type)
64 {
65  switch(reg_type) {
66  case DATA_VALUE:
67  switch(output_format) {
68  case NFTNL_OUTPUT_DEFAULT:
69  return nftnl_data_reg_value_snprintf_default(buf, size,
70  reg, flags);
71  case NFTNL_OUTPUT_JSON:
72  case NFTNL_OUTPUT_XML:
73  default:
74  break;
75  }
76  break;
77  case DATA_VERDICT:
78  case DATA_CHAIN:
79  switch(output_format) {
80  case NFTNL_OUTPUT_DEFAULT:
81  return nftnl_data_reg_verdict_snprintf_def(buf, size,
82  reg, flags);
83  case NFTNL_OUTPUT_JSON:
84  case NFTNL_OUTPUT_XML:
85  default:
86  break;
87  }
88  break;
89  default:
90  break;
91  }
92 
93  return -1;
94 }
95 
96 static int nftnl_data_parse_cb(const struct nlattr *attr, void *data)
97 {
98  const struct nlattr **tb = data;
99  int type = mnl_attr_get_type(attr);
100 
101  if (mnl_attr_type_valid(attr, NFTA_DATA_MAX) < 0)
102  return MNL_CB_OK;
103 
104  switch(type) {
105  case NFTA_DATA_VALUE:
106  if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0)
107  abi_breakage();
108  break;
109  case NFTA_DATA_VERDICT:
110  if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
111  abi_breakage();
112  break;
113  }
114  tb[type] = attr;
115  return MNL_CB_OK;
116 }
117 
118 static int nftnl_verdict_parse_cb(const struct nlattr *attr, void *data)
119 {
120  const struct nlattr **tb = data;
121  int type = mnl_attr_get_type(attr);
122 
123  if (mnl_attr_type_valid(attr, NFTA_VERDICT_MAX) < 0)
124  return MNL_CB_OK;
125 
126  switch(type) {
127  case NFTA_VERDICT_CODE:
128  case NFTA_VERDICT_CHAIN_ID:
129  if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
130  abi_breakage();
131  break;
132  case NFTA_VERDICT_CHAIN:
133  if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
134  abi_breakage();
135  break;
136  }
137  tb[type] = attr;
138  return MNL_CB_OK;
139 }
140 
141 static int
142 nftnl_parse_verdict(union nftnl_data_reg *data, const struct nlattr *attr, int *type)
143 {
144  struct nlattr *tb[NFTA_VERDICT_MAX+1];
145 
146  if (mnl_attr_parse_nested(attr, nftnl_verdict_parse_cb, tb) < 0)
147  return -1;
148 
149  if (!tb[NFTA_VERDICT_CODE])
150  return -1;
151 
152  data->verdict = ntohl(mnl_attr_get_u32(tb[NFTA_VERDICT_CODE]));
153 
154  switch(data->verdict) {
155  case NF_ACCEPT:
156  case NF_DROP:
157  case NF_QUEUE:
158  case NFT_CONTINUE:
159  case NFT_BREAK:
160  case NFT_RETURN:
161  if (type)
162  *type = DATA_VERDICT;
163  data->len = sizeof(data->verdict);
164  break;
165  case NFT_JUMP:
166  case NFT_GOTO:
167  if (!tb[NFTA_VERDICT_CHAIN])
168  return -1;
169 
170  data->chain = strdup(mnl_attr_get_str(tb[NFTA_VERDICT_CHAIN]));
171  if (!data->chain)
172  return -1;
173 
174  if (type)
175  *type = DATA_CHAIN;
176  break;
177  default:
178  return -1;
179  }
180 
181  return 0;
182 }
183 
184 static int
185 __nftnl_parse_data(union nftnl_data_reg *data, const struct nlattr *attr)
186 {
187  void *orig = mnl_attr_get_payload(attr);
188  uint32_t data_len = mnl_attr_get_payload_len(attr);
189 
190  if (data_len == 0)
191  return -1;
192 
193  if (data_len > sizeof(data->val))
194  return -1;
195 
196  memcpy(data->val, orig, data_len);
197  data->len = data_len;
198 
199  return 0;
200 }
201 
202 int nftnl_parse_data(union nftnl_data_reg *data, struct nlattr *attr, int *type)
203 {
204  struct nlattr *tb[NFTA_DATA_MAX+1] = {};
205  int ret = 0;
206 
207  if (mnl_attr_parse_nested(attr, nftnl_data_parse_cb, tb) < 0)
208  return -1;
209 
210  if (tb[NFTA_DATA_VALUE]) {
211  if (type)
212  *type = DATA_VALUE;
213 
214  ret = __nftnl_parse_data(data, tb[NFTA_DATA_VALUE]);
215  if (ret < 0)
216  return ret;
217  }
218  if (tb[NFTA_DATA_VERDICT])
219  ret = nftnl_parse_verdict(data, tb[NFTA_DATA_VERDICT], type);
220 
221  return ret;
222 }
223 
224 void nftnl_free_verdict(const union nftnl_data_reg *data)
225 {
226  switch(data->verdict) {
227  case NFT_JUMP:
228  case NFT_GOTO:
229  xfree(data->chain);
230  break;
231  default:
232  break;
233  }
234 }