[PATCH 1/2 nft] mnl: print netlink message if if --debug=netlink in mnl_talk()

[PATCH 1/2 nft] mnl: print netlink message if if --debug=netlink in mnl_talk()

[Pablo Neira Ayuso]

Useful for debugging purposes.
---
 src/mnl.c |    5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/mnl.c b/src/mnl.c
index fe218fc..a711b5e 100644
--- a/src/mnl.c
+++ b/src/mnl.c
@@ -38,6 +38,11 @@ mnl_talk(struct mnl_socket *nf_sock, const void *data, unsigned int len,
 	uint32_t portid = mnl_socket_get_portid(nf_sock);
 	int ret;
 
+#ifdef DEBUG
+	if (debug_level & DEBUG_NETLINK)
+		mnl_nlmsg_fprintf(stdout, data, len, sizeof(struct nfgenmsg));
+#endif
+
 	if (mnl_socket_sendto(nf_sock, data, len) < 0)
 		return -1;
 
-- 
1.7.10.4

[PATCH 2/2 nft] netlink: fix dictionary feature

[Pablo Neira Ayuso]

This patch fixes dictionary feature, that allows you to conditionally
set packet fields based on a given selector, eg.

 add rule ip filter input meta mark set tcp dport map { 22 => 1, 23 => 2, }

This means that traffic flowing to tcp port 22 receives the packet
mark 1 and tcp port 23 receives mark 2.

This feature was partially broken by aae836a ("src: use libnftables")
although it also needs the kernel fix ("netfilter: nf_tables: fix wrong
datatype in nft_validate_data_load()").

This patch also fixes endianness issues when displaying the mark
via `list table' related to list_setelem_cb() since the byteorder
was left unset for the data part of a set element.

 meta mark set tcp dport map { telnet => 0x02000000, ssh => 0x01000000}
                                            ^                  ^
Note the wrong endianness in the example above.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/netlink.c |   14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/src/netlink.c b/src/netlink.c
index cab8cf4..59bd8e4 100644
--- a/src/netlink.c
+++ b/src/netlink.c
@@ -157,13 +157,22 @@ static struct nft_set_elem *alloc_nft_setelem(const struct expr *expr)
 		nft_set_elem_attr_set(nlse, NFT_SET_ELEM_ATTR_KEY,
 				      &nld.value, nld.len);
 		netlink_gen_data(expr->right, &nld);
-		if (expr->right->ops->type == EXPR_VERDICT) {
+		switch (expr->right->ops->type) {
+		case EXPR_VERDICT:
 			nft_set_elem_attr_set_u32(nlse, NFT_SET_ELEM_ATTR_VERDICT,
 						  expr->right->verdict);
 			if (expr->chain != NULL) {
 				nft_set_elem_attr_set(nlse, NFT_SET_ELEM_ATTR_CHAIN,
 						nld.chain, strlen(nld.chain));
 			}
+			break;
+		case EXPR_VALUE:
+			nft_set_elem_attr_set(nlse, NFT_SET_ELEM_ATTR_DATA,
+					      nld.value, nld.len);
+			break;
+		default:
+			BUG("unexpected set element expression\n");
+			break;
 		}
 	}
 
@@ -994,6 +1003,9 @@ static int list_setelem_cb(struct nft_set_elem *nlse, void *arg)
 					  set->datatype->type == TYPE_VERDICT ?
 					  NFT_REG_VERDICT : NFT_REG_1);
 		data->dtype = set->datatype;
+		data->byteorder = set->datatype->byteorder;
+		if (data->byteorder == BYTEORDER_HOST_ENDIAN)
+			mpz_switch_byteorder(data->value, data->len / BITS_PER_BYTE);
 
 		expr = mapping_expr_alloc(&internal_location, expr, data);
 	}
-- 
1.7.10.4