[PATCH libnftnl 1/7] include: fetch stateful object updates for nf

netfilter-devel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed

* [PATCH libnftnl 1/7] include: fetch stateful object updates for nf_tables.h cache copy
@ 2016-12-09 13:31 Pablo Neira Ayuso
  2016-12-09 13:31 ` [PATCH libnftnl 2/7] src: support for stateful objects Pablo Neira Ayuso
                   ` (5 more replies)
  0 siblings, 6 replies; 7+ messages in thread
From: Pablo Neira Ayuso @ 2016-12-09 13:31 UTC (permalink / raw)
  To: netfilter-devel

This patch includes updates for the named stateful expressions.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 include/linux/netfilter/nf_tables.h | 64 +++++++++++++++++++++++++++++++++++++
 1 file changed, 64 insertions(+)

diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
index f030e59aa2ec..881d49e94569 100644
--- a/include/linux/netfilter/nf_tables.h
+++ b/include/linux/netfilter/nf_tables.h
@@ -4,6 +4,7 @@
 #define NFT_TABLE_MAXNAMELEN	32
 #define NFT_CHAIN_MAXNAMELEN	32
 #define NFT_SET_MAXNAMELEN	32
+#define NFT_OBJ_MAXNAMELEN	32
 #define NFT_USERDATA_MAXLEN	256
 
 /**
@@ -85,6 +86,10 @@ enum nft_verdicts {
  * @NFT_MSG_NEWGEN: announce a new generation, only for events (enum nft_gen_attributes)
  * @NFT_MSG_GETGEN: get the rule-set generation (enum nft_gen_attributes)
  * @NFT_MSG_TRACE: trace event (enum nft_trace_attributes)
+ * @NFT_MSG_NEWOBJ: create a stateful object (enum nft_obj_attributes)
+ * @NFT_MSG_GETOBJ: get a stateful object (enum nft_obj_attributes)
+ * @NFT_MSG_DELOBJ: delete a stateful object (enum nft_obj_attributes)
+ * @NFT_MSG_GETOBJ_RESET: get and reset a stateful object (enum nft_obj_attributes)
  */
 enum nf_tables_msg_types {
 	NFT_MSG_NEWTABLE,
@@ -105,6 +110,10 @@ enum nf_tables_msg_types {
 	NFT_MSG_NEWGEN,
 	NFT_MSG_GETGEN,
 	NFT_MSG_TRACE,
+	NFT_MSG_NEWOBJ,
+	NFT_MSG_GETOBJ,
+	NFT_MSG_DELOBJ,
+	NFT_MSG_GETOBJ_RESET,
 	NFT_MSG_MAX,
 };
 
@@ -246,6 +255,7 @@ enum nft_rule_compat_attributes {
  * @NFT_SET_MAP: set is used as a dictionary
  * @NFT_SET_TIMEOUT: set uses timeouts
  * @NFT_SET_EVAL: set contains expressions for evaluation
+ * @NFT_SET_OBJECT: set contains stateful objects
  */
 enum nft_set_flags {
 	NFT_SET_ANONYMOUS		= 0x1,
@@ -254,6 +264,7 @@ enum nft_set_flags {
 	NFT_SET_MAP			= 0x8,
 	NFT_SET_TIMEOUT			= 0x10,
 	NFT_SET_EVAL			= 0x20,
+	NFT_SET_OBJECT			= 0x40,
 };
 
 /**
@@ -295,6 +306,7 @@ enum nft_set_desc_attributes {
  * @NFTA_SET_TIMEOUT: default timeout value (NLA_U64)
  * @NFTA_SET_GC_INTERVAL: garbage collection interval (NLA_U32)
  * @NFTA_SET_USERDATA: user data (NLA_BINARY)
+ * @NFTA_SET_OBJ_TYPE: stateful object type (NLA_U32: NFT_OBJECT_*)
  */
 enum nft_set_attributes {
 	NFTA_SET_UNSPEC,
@@ -312,6 +324,7 @@ enum nft_set_attributes {
 	NFTA_SET_GC_INTERVAL,
 	NFTA_SET_USERDATA,
 	NFTA_SET_PAD,
+	NFTA_SET_OBJ_TYPE,
 	__NFTA_SET_MAX
 };
 #define NFTA_SET_MAX		(__NFTA_SET_MAX - 1)
@@ -335,6 +348,7 @@ enum nft_set_elem_flags {
  * @NFTA_SET_ELEM_EXPIRATION: expiration time (NLA_U64)
  * @NFTA_SET_ELEM_USERDATA: user data (NLA_BINARY)
  * @NFTA_SET_ELEM_EXPR: expression (NLA_NESTED: nft_expr_attributes)
+ * @NFTA_SET_ELEM_OBJREF: stateful object reference (NLA_STRING)
  */
 enum nft_set_elem_attributes {
 	NFTA_SET_ELEM_UNSPEC,
@@ -346,6 +360,7 @@ enum nft_set_elem_attributes {
 	NFTA_SET_ELEM_USERDATA,
 	NFTA_SET_ELEM_EXPR,
 	NFTA_SET_ELEM_PAD,
+	NFTA_SET_ELEM_OBJREF,
 	__NFTA_SET_ELEM_MAX
 };
 #define NFTA_SET_ELEM_MAX	(__NFTA_SET_ELEM_MAX - 1)
@@ -974,6 +989,7 @@ enum nft_queue_attributes {
 
 enum nft_quota_flags {
 	NFT_QUOTA_F_INV		= (1 << 0),
+	NFT_QUOTA_F_DEPLETED	= (1 << 1),
 };
 
 /**
@@ -981,12 +997,14 @@ enum nft_quota_flags {
  *
  * @NFTA_QUOTA_BYTES: quota in bytes (NLA_U16)
  * @NFTA_QUOTA_FLAGS: flags (NLA_U32)
+ * @NFTA_QUOTA_CONSUMED: quota already consumed in bytes (NLA_U64)
  */
 enum nft_quota_attributes {
 	NFTA_QUOTA_UNSPEC,
 	NFTA_QUOTA_BYTES,
 	NFTA_QUOTA_FLAGS,
 	NFTA_QUOTA_PAD,
+	NFTA_QUOTA_CONSUMED,
 	__NFTA_QUOTA_MAX
 };
 #define NFTA_QUOTA_MAX		(__NFTA_QUOTA_MAX - 1)
@@ -1131,6 +1149,26 @@ enum nft_fwd_attributes {
 #define NFTA_FWD_MAX	(__NFTA_FWD_MAX - 1)
 
 /**
+ * enum nft_objref_attributes - nf_tables stateful object expression netlink attributes
+ *
+ * @NFTA_OBJREF_IMM_TYPE: object type for immediate reference (NLA_U32: nft_register)
+ * @NFTA_OBJREF_IMM_NAME: object name for immediate reference (NLA_STRING)
+ * @NFTA_OBJREF_SET_SREG: source register of the data to look for (NLA_U32: nft_registers)
+ * @NFTA_OBJREF_SET_NAME: name of the set where to look for (NLA_STRING)
+ * @NFTA_OBJREF_SET_ID: id of the set where to look for in this transaction (NLA_U32)
+ */
+enum nft_objref_attributes {
+	NFTA_OBJREF_UNSPEC,
+	NFTA_OBJREF_IMM_TYPE,
+	NFTA_OBJREF_IMM_NAME,
+	NFTA_OBJREF_SET_SREG,
+	NFTA_OBJREF_SET_NAME,
+	NFTA_OBJREF_SET_ID,
+	__NFTA_OBJREF_MAX
+};
+#define NFTA_OBJREF_MAX	(__NFTA_OBJREF_MAX - 1)
+
+/**
  * enum nft_gen_attributes - nf_tables ruleset generation attributes
  *
  * @NFTA_GEN_ID: Ruleset generation ID (NLA_U32)
@@ -1178,6 +1216,32 @@ enum nft_fib_flags {
 	NFTA_FIB_F_OIF		= 1 << 4,	/* restrict to oif */
 };
 
+#define NFT_OBJECT_UNSPEC	0
+#define NFT_OBJECT_COUNTER	1
+#define NFT_OBJECT_QUOTA	2
+#define __NFT_OBJECT_MAX	3
+#define NFT_OBJECT_MAX		(__NFT_OBJECT_MAX - 1)
+
+/**
+ * enum nft_object_attributes - nf_tables stateful object netlink attributes
+ *
+ * @NFTA_OBJ_TABLE: name of the table containing the expression (NLA_STRING)
+ * @NFTA_OBJ_NAME: name of this expression type (NLA_STRING)
+ * @NFTA_OBJ_TYPE: stateful object type (NLA_U32)
+ * @NFTA_OBJ_DATA: stateful object data (NLA_NESTED)
+ * @NFTA_OBJ_USE: number of references to this expression (NLA_U32)
+ */
+enum nft_object_attributes {
+	NFTA_OBJ_UNSPEC,
+	NFTA_OBJ_TABLE,
+	NFTA_OBJ_NAME,
+	NFTA_OBJ_TYPE,
+	NFTA_OBJ_DATA,
+	NFTA_OBJ_USE,
+	__NFTA_OBJ_MAX
+};
+#define NFTA_OBJ_MAX		(__NFTA_OBJ_MAX - 1)
+
 /**
  * enum nft_trace_attributes - nf_tables trace netlink attributes
  *
-- 
2.1.4


^ permalink raw reply related	[flat|nested] 7+ messages in thread

* [PATCH libnftnl 2/7] src: support for stateful objects
  2016-12-09 13:31 [PATCH libnftnl 1/7] include: fetch stateful object updates for nf_tables.h cache copy Pablo Neira Ayuso
@ 2016-12-09 13:31 ` Pablo Neira Ayuso
  2016-12-09 13:31 ` [PATCH libnftnl 3/7] expr: add stateful object reference expression Pablo Neira Ayuso
                   ` (4 subsequent siblings)
  5 siblings, 0 replies; 7+ messages in thread
From: Pablo Neira Ayuso @ 2016-12-09 13:31 UTC (permalink / raw)
  To: netfilter-devel

This patch allows you to add, to delete and to get stateful objects,
this support two object types: counter and quota.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 examples/Makefile.am         |  12 +
 examples/nft-obj-add.c       | 123 ++++++++++
 examples/nft-obj-del.c       | 126 ++++++++++
 examples/nft-obj-get.c       | 151 ++++++++++++
 include/Makefile.am          |   1 +
 include/buffer.h             |   1 +
 include/libnftnl/Makefile.am |   1 +
 include/libnftnl/object.h    |  89 +++++++
 include/obj.h                |  55 +++++
 src/Makefile.am              |   3 +
 src/libnftnl.map             |  31 +++
 src/obj/counter.c            | 184 ++++++++++++++
 src/obj/quota.c              | 205 ++++++++++++++++
 src/object.c                 | 573 +++++++++++++++++++++++++++++++++++++++++++
 tests/Makefile.am            |   4 +
 tests/nft-object-test.c      |  78 ++++++
 tests/test-script.sh         |   1 +
 17 files changed, 1638 insertions(+)
 create mode 100644 examples/nft-obj-add.c
 create mode 100644 examples/nft-obj-del.c
 create mode 100644 examples/nft-obj-get.c
 create mode 100644 include/libnftnl/object.h
 create mode 100644 include/obj.h
 create mode 100644 src/obj/counter.c
 create mode 100644 src/obj/quota.c
 create mode 100644 src/object.c
 create mode 100644 tests/nft-object-test.c

diff --git a/examples/Makefile.am b/examples/Makefile.am
index 9dca3a15c2c4..48bc7a16c9c6 100644
--- a/examples/Makefile.am
+++ b/examples/Makefile.am
@@ -22,6 +22,9 @@ check_PROGRAMS = nft-table-add		\
 		 nft-set-elem-add	\
 		 nft-set-elem-get	\
 		 nft-set-elem-del	\
+		 nft-obj-add		\
+		 nft-obj-get		\
+		 nft-obj-del		\
 		 nft-ruleset-get	\
 		 nft-ruleset-parse-file	\
 		 nft-compat-get
@@ -92,6 +95,15 @@ nft_set_elem_del_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS}
 nft_set_elem_get_SOURCES = nft-set-elem-get.c
 nft_set_elem_get_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS}
 
+nft_obj_add_SOURCES = nft-obj-add.c
+nft_obj_add_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS}
+
+nft_obj_del_SOURCES = nft-obj-del.c
+nft_obj_del_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS}
+
+nft_obj_get_SOURCES = nft-obj-get.c
+nft_obj_get_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS}
+
 nft_ruleset_get_SOURCES = nft-ruleset-get.c
 nft_ruleset_get_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS}
 
diff --git a/examples/nft-obj-add.c b/examples/nft-obj-add.c
new file mode 100644
index 000000000000..83941c41323f
--- /dev/null
+++ b/examples/nft-obj-add.c
@@ -0,0 +1,123 @@
+/*
+ * (C) 2012-2016 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdlib.h>
+#include <time.h>
+#include <string.h>
+#include <netinet/in.h>
+
+#include <linux/netfilter.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include <libmnl/libmnl.h>
+#include <libnftnl/object.h>
+
+static struct nftnl_obj *obj_add_parse(int argc, char *argv[])
+{
+	struct nftnl_obj *t;
+	uint16_t family;
+
+	if (strcmp(argv[1], "ip") == 0)
+		family = NFPROTO_IPV4;
+	else if (strcmp(argv[1], "ip6") == 0)
+		family = NFPROTO_IPV6;
+	else if (strcmp(argv[1], "bridge") == 0)
+		family = NFPROTO_BRIDGE;
+	else if (strcmp(argv[1], "arp") == 0)
+		family = NFPROTO_ARP;
+	else {
+		fprintf(stderr, "Unknown family: ip, ip6, bridge, arp\n");
+		return NULL;
+	}
+
+	t = nftnl_obj_alloc();
+	if (t == NULL) {
+		perror("OOM");
+		return NULL;
+	}
+
+	nftnl_obj_set_u32(t, NFTNL_OBJ_FAMILY, family);
+	nftnl_obj_set_u32(t, NFTNL_OBJ_TYPE, NFT_OBJECT_COUNTER);
+	nftnl_obj_set_str(t, NFTNL_OBJ_TABLE, argv[2]);
+	nftnl_obj_set_str(t, NFTNL_OBJ_NAME, argv[3]);
+
+	return t;
+}
+
+int main(int argc, char *argv[])
+{
+	struct mnl_socket *nl;
+	char buf[MNL_SOCKET_BUFFER_SIZE];
+	struct nlmsghdr *nlh;
+	uint32_t portid, seq, obj_seq, family;
+	struct nftnl_obj *t;
+	struct mnl_nlmsg_batch *batch;
+	int ret;
+
+	if (argc != 4) {
+		fprintf(stderr, "%s <family> <table> <name>\n", argv[0]);
+		exit(EXIT_FAILURE);
+	}
+
+	t = obj_add_parse(argc, argv);
+	if (t == NULL)
+		exit(EXIT_FAILURE);
+
+	seq = time(NULL);
+	batch = mnl_nlmsg_batch_start(buf, sizeof(buf));
+
+	nftnl_batch_begin(mnl_nlmsg_batch_current(batch), seq++);
+	mnl_nlmsg_batch_next(batch);
+
+	obj_seq = seq;
+	family = nftnl_obj_get_u32(t, NFTNL_OBJ_FAMILY);
+	nlh = nftnl_nlmsg_build_hdr(mnl_nlmsg_batch_current(batch),
+				    NFT_MSG_NEWOBJ, family, NLM_F_ACK, seq++);
+	nftnl_obj_nlmsg_build_payload(nlh, t);
+	nftnl_obj_free(t);
+	mnl_nlmsg_batch_next(batch);
+
+	nftnl_batch_end(mnl_nlmsg_batch_current(batch), seq++);
+	mnl_nlmsg_batch_next(batch);
+
+	nl = mnl_socket_open(NETLINK_NETFILTER);
+	if (nl == NULL) {
+		perror("mnl_socket_open");
+		exit(EXIT_FAILURE);
+	}
+
+	if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) {
+		perror("mnl_socket_bind");
+		exit(EXIT_FAILURE);
+	}
+	portid = mnl_socket_get_portid(nl);
+
+	if (mnl_socket_sendto(nl, mnl_nlmsg_batch_head(batch),
+			      mnl_nlmsg_batch_size(batch)) < 0) {
+		perror("mnl_socket_send");
+		exit(EXIT_FAILURE);
+	}
+
+	mnl_nlmsg_batch_stop(batch);
+
+	ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
+	while (ret > 0) {
+		ret = mnl_cb_run(buf, ret, obj_seq, portid, NULL, NULL);
+		if (ret <= 0)
+			break;
+		ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
+	}
+	if (ret == -1) {
+		perror("error");
+		exit(EXIT_FAILURE);
+	}
+	mnl_socket_close(nl);
+
+	return EXIT_SUCCESS;
+}
diff --git a/examples/nft-obj-del.c b/examples/nft-obj-del.c
new file mode 100644
index 000000000000..0aa63c0c4742
--- /dev/null
+++ b/examples/nft-obj-del.c
@@ -0,0 +1,126 @@
+/*
+ * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This software has been sponsored by Sophos Astaro <http://www.sophos.com>
+ */
+
+#include <stdlib.h>
+#include <time.h>
+#include <string.h>
+#include <netinet/in.h>
+
+#include <linux/netfilter.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include <libmnl/libmnl.h>
+#include <libnftnl/object.h>
+
+static struct nftnl_obj *obj_del_parse(int argc, char *argv[])
+{
+	struct nftnl_obj *t;
+	uint16_t family;
+
+	if (strcmp(argv[1], "ip") == 0)
+		family = NFPROTO_IPV4;
+	else if (strcmp(argv[1], "ip6") == 0)
+		family = NFPROTO_IPV6;
+	else if (strcmp(argv[1], "bridge") == 0)
+		family = NFPROTO_BRIDGE;
+	else if (strcmp(argv[1], "arp") == 0)
+		family = NFPROTO_ARP;
+	else {
+		fprintf(stderr, "Unknown family: ip, ip6, bridge, arp\n");
+		return NULL;
+	}
+
+	t = nftnl_obj_alloc();
+	if (t == NULL) {
+		perror("OOM");
+		return NULL;
+	}
+
+	nftnl_obj_set_str(t, NFTNL_OBJ_TABLE, argv[2]);
+	nftnl_obj_set_str(t, NFTNL_OBJ_NAME, argv[3]);
+	nftnl_obj_set_u32(t, NFTNL_OBJ_TYPE, NFT_OBJECT_COUNTER);
+	nftnl_obj_set_u32(t, NFTNL_OBJ_FAMILY, family);
+
+	return t;
+}
+
+int main(int argc, char *argv[])
+{
+	struct mnl_socket *nl;
+	char buf[MNL_SOCKET_BUFFER_SIZE];
+	struct nlmsghdr *nlh;
+	uint32_t portid, seq, obj_seq, family;
+	struct nftnl_obj *t;
+	struct mnl_nlmsg_batch *batch;
+	int ret;
+
+	if (argc != 4) {
+		fprintf(stderr, "%s <family> <table> <name>\n", argv[0]);
+		exit(EXIT_FAILURE);
+	}
+
+	t = obj_del_parse(argc, argv);
+	if (t == NULL)
+		exit(EXIT_FAILURE);
+
+	seq = time(NULL);
+	batch = mnl_nlmsg_batch_start(buf, sizeof(buf));
+
+	nftnl_batch_begin(mnl_nlmsg_batch_current(batch), seq++);
+	mnl_nlmsg_batch_next(batch);
+
+	obj_seq = seq;
+	family = nftnl_obj_get_u32(t, NFTNL_OBJ_FAMILY);
+	nlh = nftnl_nlmsg_build_hdr(mnl_nlmsg_batch_current(batch),
+				    NFT_MSG_DELOBJ, family, NLM_F_ACK,
+				    seq++);
+	nftnl_obj_nlmsg_build_payload(nlh, t);
+	mnl_nlmsg_batch_next(batch);
+	nftnl_obj_free(t);
+
+	nftnl_batch_end(mnl_nlmsg_batch_current(batch), seq++);
+	mnl_nlmsg_batch_next(batch);
+
+	nl = mnl_socket_open(NETLINK_NETFILTER);
+	if (nl == NULL) {
+		perror("mnl_socket_open");
+		exit(EXIT_FAILURE);
+	}
+
+	if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) {
+		perror("mnl_socket_bind");
+		exit(EXIT_FAILURE);
+	}
+	portid = mnl_socket_get_portid(nl);
+
+	if (mnl_socket_sendto(nl, mnl_nlmsg_batch_head(batch),
+			      mnl_nlmsg_batch_size(batch)) < 0) {
+		perror("mnl_socket_send");
+		exit(EXIT_FAILURE);
+	}
+
+	mnl_nlmsg_batch_stop(batch);
+
+	ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
+	while (ret > 0) {
+		ret = mnl_cb_run(buf, ret, obj_seq, portid, NULL, NULL);
+		if (ret <= 0)
+			break;
+		ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
+	}
+	if (ret == -1) {
+		perror("error");
+		exit(EXIT_FAILURE);
+	}
+	mnl_socket_close(nl);
+
+	return EXIT_SUCCESS;
+}
diff --git a/examples/nft-obj-get.c b/examples/nft-obj-get.c
new file mode 100644
index 000000000000..bec33b693731
--- /dev/null
+++ b/examples/nft-obj-get.c
@@ -0,0 +1,151 @@
+/*
+ * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This software has been sponsored by Sophos Astaro <http://www.sophos.com>
+ */
+
+#include <stdlib.h>
+#include <time.h>
+#include <string.h>
+#include <netinet/in.h>
+
+#include <linux/netfilter.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include <libmnl/libmnl.h>
+#include <libnftnl/object.h>
+
+static int obj_cb(const struct nlmsghdr *nlh, void *data)
+{
+	struct nftnl_obj *t;
+	char buf[4096];
+	uint32_t *type = data;
+
+	t = nftnl_obj_alloc();
+	if (t == NULL) {
+		perror("OOM");
+		goto err;
+	}
+
+	if (nftnl_obj_nlmsg_parse(nlh, t) < 0) {
+		perror("nftnl_obj_nlmsg_parse");
+		goto err_free;
+	}
+
+	nftnl_obj_snprintf(buf, sizeof(buf), t, *type, 0);
+	printf("%s\n", buf);
+
+err_free:
+	nftnl_obj_free(t);
+err:
+	return MNL_CB_OK;
+}
+
+int main(int argc, char *argv[])
+{
+	struct mnl_socket *nl;
+	char buf[MNL_SOCKET_BUFFER_SIZE];
+	struct nlmsghdr *nlh;
+	uint32_t portid, seq, family;
+	struct nftnl_obj *t = NULL;
+	int ret;
+	uint32_t type = NFTNL_OUTPUT_DEFAULT;
+
+	if (argc < 2 || argc > 5) {
+		fprintf(stderr, "%s <family> <table> [<obj>] [<default|xml|json>]\n",
+			argv[0]);
+		return EXIT_FAILURE;
+	}
+
+	if (strcmp(argv[1], "ip") == 0)
+		family = NFPROTO_IPV4;
+	else if (strcmp(argv[1], "ip6") == 0)
+		family = NFPROTO_IPV6;
+	else if (strcmp(argv[1], "bridge") == 0)
+		family = NFPROTO_BRIDGE;
+	else if (strcmp(argv[1], "arp") == 0)
+		family = NFPROTO_ARP;
+	else if (strcmp(argv[1], "unspec") == 0)
+		family = NFPROTO_UNSPEC;
+	else {
+		fprintf(stderr, "Unknown family: ip, ip6, bridge, arp, unspec\n");
+		exit(EXIT_FAILURE);
+	}
+
+	if (strcmp(argv[argc-1], "xml") == 0) {
+		type = NFTNL_OUTPUT_XML;
+		argv[argc-1] = NULL;
+		argc--;
+	}else if (strcmp(argv[argc-1], "json") == 0) {
+		type = NFTNL_OUTPUT_JSON;
+		argv[argc-1] = NULL;
+		argc--;
+	} else if (strcmp(argv[argc - 1], "default") == 0) {
+		argc--;
+	}
+
+	if (argc == 3 || argc == 4) {
+		t = nftnl_obj_alloc();
+		if (t == NULL) {
+			perror("OOM");
+			exit(EXIT_FAILURE);
+		}
+	}
+
+	seq = time(NULL);
+	if (argc < 4) {
+		nlh = nftnl_nlmsg_build_hdr(buf, NFT_MSG_GETOBJ, family,
+					    NLM_F_DUMP, seq);
+		if (argc == 3) {
+			nftnl_obj_set(t, NFTNL_OBJ_TABLE, argv[2]);
+			nftnl_obj_nlmsg_build_payload(nlh, t);
+			nftnl_obj_free(t);
+		}
+	} else {
+		nftnl_obj_set(t, NFTNL_OBJ_TABLE, argv[2]);
+		nftnl_obj_set(t, NFTNL_OBJ_NAME, argv[3]);
+		nftnl_obj_set_u32(t, NFTNL_OBJ_TYPE, NFT_OBJECT_COUNTER);
+
+		nlh = nftnl_nlmsg_build_hdr(buf, NFT_MSG_GETOBJ, family,
+					    NLM_F_ACK, seq);
+		nftnl_obj_nlmsg_build_payload(nlh, t);
+		nftnl_obj_free(t);
+	}
+
+	nl = mnl_socket_open(NETLINK_NETFILTER);
+	if (nl == NULL) {
+		perror("mnl_socket_open");
+		exit(EXIT_FAILURE);
+	}
+
+	if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) {
+		perror("mnl_socket_bind");
+		exit(EXIT_FAILURE);
+	}
+	portid = mnl_socket_get_portid(nl);
+
+	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
+		perror("mnl_socket_send");
+		exit(EXIT_FAILURE);
+	}
+
+	ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
+	while (ret > 0) {
+		ret = mnl_cb_run(buf, ret, seq, portid, obj_cb, &type);
+		if (ret <= 0)
+			break;
+		ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
+	}
+	if (ret == -1) {
+		perror("error");
+		exit(EXIT_FAILURE);
+	}
+	mnl_socket_close(nl);
+
+	return EXIT_SUCCESS;
+}
diff --git a/include/Makefile.am b/include/Makefile.am
index a049e2e1de5d..fd4cb408a44a 100644
--- a/include/Makefile.am
+++ b/include/Makefile.am
@@ -5,6 +5,7 @@ noinst_HEADERS = internal.h	\
 		 buffer.h	\
 		 data_reg.h	\
 		 expr_ops.h	\
+		 obj.h		\
 		 linux_list.h	\
 		 set.h		\
 		 common.h	\
diff --git a/include/buffer.h b/include/buffer.h
index ab1d468af989..c5716570f9d0 100644
--- a/include/buffer.h
+++ b/include/buffer.h
@@ -41,6 +41,7 @@ int nftnl_buf_reg(struct nftnl_buf *b, int type, union nftnl_data_reg *reg,
 #define BURST			"burst"
 #define CHAIN			"chain"
 #define CODE			"code"
+#define CONSUMED		"consumed"
 #define DATA			"data"
 #define DEVICE			"device"
 #define DIR			"dir"
diff --git a/include/libnftnl/Makefile.am b/include/libnftnl/Makefile.am
index 457ec95bcbc5..6dc7b2b38590 100644
--- a/include/libnftnl/Makefile.am
+++ b/include/libnftnl/Makefile.am
@@ -2,6 +2,7 @@ pkginclude_HEADERS = batch.h		\
 		     table.h		\
 		     trace.h		\
 		     chain.h		\
+		     object.h		\
 		     rule.h		\
 		     expr.h		\
 		     set.h		\
diff --git a/include/libnftnl/object.h b/include/libnftnl/object.h
new file mode 100644
index 000000000000..074a37789734
--- /dev/null
+++ b/include/libnftnl/object.h
@@ -0,0 +1,89 @@
+#ifndef _LIBNFTNL_OBJECT_H_
+#define _LIBNFTNL_OBJECT_H_
+
+#include <stdio.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include <sys/types.h>
+
+#include <libnftnl/common.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+enum {
+	NFTNL_OBJ_TABLE		= 0,
+	NFTNL_OBJ_NAME,
+	NFTNL_OBJ_TYPE,
+	NFTNL_OBJ_FAMILY,
+	NFTNL_OBJ_USE,
+	NFTNL_OBJ_BASE		= 16,
+	__NFTNL_OBJ_MAX
+};
+#define NFTNL_OBJ_MAX (__NFTNL_OBJ_MAX - 1)
+
+enum {
+	NFTNL_OBJ_CTR_PKTS	= NFTNL_OBJ_BASE,
+	NFTNL_OBJ_CTR_BYTES,
+};
+
+enum {
+	NFTNL_OBJ_QUOTA_BYTES	= NFTNL_OBJ_BASE,
+	NFTNL_OBJ_QUOTA_CONSUMED,
+	NFTNL_OBJ_QUOTA_FLAGS,
+};
+
+struct nftnl_obj;
+
+struct nftnl_obj *nftnl_obj_alloc(void);
+void nftnl_obj_free(const struct nftnl_obj *ne);
+
+bool nftnl_obj_is_set(const struct nftnl_obj *ne, uint16_t attr);
+void nftnl_obj_unset(struct nftnl_obj *ne, uint16_t attr);
+void nftnl_obj_set_data(struct nftnl_obj *ne, uint16_t attr, const void *data,
+			uint32_t data_len);
+void nftnl_obj_set(struct nftnl_obj *ne, uint16_t attr, const void *data);
+void nftnl_obj_set_u32(struct nftnl_obj *ne, uint16_t attr, uint32_t val);
+void nftnl_obj_set_u64(struct nftnl_obj *obj, uint16_t attr, uint64_t val);
+void nftnl_obj_set_str(struct nftnl_obj *ne, uint16_t attr, const char *str);
+const void *nftnl_obj_get_data(struct nftnl_obj *ne, uint16_t attr,
+			       uint32_t *data_len);
+const void *nftnl_obj_get(struct nftnl_obj *ne, uint16_t attr);
+uint32_t nftnl_obj_get_u32(struct nftnl_obj *ne, uint16_t attr);
+uint64_t nftnl_obj_get_u64(struct nftnl_obj *obj, uint16_t attr);
+const char *nftnl_obj_get_str(struct nftnl_obj *ne, uint16_t attr);
+
+void nftnl_obj_nlmsg_build_payload(struct nlmsghdr *nlh,
+				   const struct nftnl_obj *ne);
+int nftnl_obj_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_obj *ne);
+int nftnl_obj_parse(struct nftnl_obj *ne, enum nftnl_parse_type type,
+		    const char *data, struct nftnl_parse_err *err);
+int nftnl_obj_parse_file(struct nftnl_obj *ne, enum nftnl_parse_type type,
+			 FILE *fp, struct nftnl_parse_err *err);
+int nftnl_obj_snprintf(char *buf, size_t size, const struct nftnl_obj *ne,
+		       uint32_t type, uint32_t flags);
+int nftnl_obj_fprintf(FILE *fp, const struct nftnl_obj *ne, uint32_t type,
+		      uint32_t flags);
+
+struct nftnl_obj_list;
+struct nftnl_obj_list *nftnl_obj_list_alloc(void);
+void nftnl_obj_list_free(struct nftnl_obj_list *list);
+int nftnl_obj_list_is_empty(struct nftnl_obj_list *list);
+void nftnl_obj_list_add(struct nftnl_obj *r, struct nftnl_obj_list *list);
+void nftnl_obj_list_add_tail(struct nftnl_obj *r, struct nftnl_obj_list *list);
+void nftnl_obj_list_del(struct nftnl_obj *t);
+int nftnl_obj_list_foreach(struct nftnl_obj_list *table_list,
+			   int (*cb)(struct nftnl_obj *t, void *data),
+			   void *data);
+
+struct nftnl_obj_list_iter;
+struct nftnl_obj_list_iter *nftnl_obj_list_iter_create(struct nftnl_obj_list *l);
+struct nftnl_obj *nftnl_obj_list_iter_next(struct nftnl_obj_list_iter *iter);
+void nftnl_obj_list_iter_destroy(struct nftnl_obj_list_iter *iter);
+
+#ifdef __cplusplusg
+} /* extern "C" */
+#endif
+
+#endif /* _OBJ_H_ */
diff --git a/include/obj.h b/include/obj.h
new file mode 100644
index 000000000000..edbf023f5cdd
--- /dev/null
+++ b/include/obj.h
@@ -0,0 +1,55 @@
+#ifndef _OBJ_OPS_H_
+#define _OBJ_OPS_H_
+
+#include <stdint.h>
+#include "internal.h"
+
+struct nlattr;
+struct nlmsghdr;
+struct nftnl_obj;
+
+struct nftnl_obj {
+	struct list_head	head;
+	struct obj_ops		*ops;
+
+	const char		*table;
+	const char		*name;
+
+	uint32_t		family;
+	uint32_t		use;
+
+	uint32_t		flags;
+
+	union {
+		struct nftnl_obj_counter {
+			uint64_t	pkts;
+			uint64_t	bytes;
+		} counter;
+		struct nftnl_obj_quota {
+			uint64_t        bytes;
+			uint64_t	consumed;
+			uint32_t        flags;
+		} quota;
+	} data;
+};
+
+struct obj_ops {
+	const char *name;
+	uint32_t type;
+	size_t	alloc_len;
+	int	max_attr;
+	int	(*set)(struct nftnl_obj *e, uint16_t type, const void *data, uint32_t data_len);
+	const void *(*get)(const struct nftnl_obj *e, uint16_t type, uint32_t *data_len);
+	int	(*parse)(struct nftnl_obj *e, struct nlattr *attr);
+	void	(*build)(struct nlmsghdr *nlh, const struct nftnl_obj *e);
+	int	(*snprintf)(char *buf, size_t len, uint32_t type, uint32_t flags, const struct nftnl_obj *e);
+	int	(*json_parse)(struct nftnl_obj *e, json_t *data,
+			      struct nftnl_parse_err *err);
+};
+
+extern struct obj_ops obj_ops_counter;
+extern struct obj_ops obj_ops_quota;
+
+#define nftnl_obj_data(obj) (void *)&obj->data
+
+#endif
diff --git a/src/Makefile.am b/src/Makefile.am
index e1e4144526c3..909c6a668b77 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -13,6 +13,7 @@ libnftnl_la_SOURCES = utils.c		\
 		      table.c		\
 		      trace.c		\
 		      chain.c		\
+		      object.c		\
 		      rule.c		\
 		      set.c		\
 		      set_elem.c	\
@@ -50,4 +51,6 @@ libnftnl_la_SOURCES = utils.c		\
 		      expr/masq.c	\
 		      expr/redir.c	\
 		      expr/hash.c	\
+		      obj/counter.c	\
+		      obj/quota.c	\
 		      libnftnl.map
diff --git a/src/libnftnl.map b/src/libnftnl.map
index abed8b9e1295..64b9b0ba4f1f 100644
--- a/src/libnftnl.map
+++ b/src/libnftnl.map
@@ -533,3 +533,34 @@ LIBNFTNL_4.2 {
 	nftnl_rule_cmp;
 	nftnl_expr_cmp;
 } LIBNFTNL_4.1;
+
+LIBNFTNL_4.3 {
+	nftnl_obj_alloc;
+	nftnl_obj_free;
+	nftnl_obj_is_set;
+	nftnl_obj_unset;
+	nftnl_obj_set;
+	nftnl_obj_get;
+	nftnl_obj_set_u32;
+	nftnl_obj_set_u64;
+	nftnl_obj_set_str;
+	nftnl_obj_get_u32;
+	nftnl_obj_get_str;
+	nftnl_obj_get_u64;
+	nftnl_obj_parse;
+	nftnl_obj_parse_file;
+	nftnl_obj_snprintf;
+	nftnl_obj_fprintf;
+	nftnl_obj_nlmsg_build_payload;
+	nftnl_obj_nlmsg_parse;
+	nftnl_obj_list_alloc;
+	nftnl_obj_list_free;
+	nftnl_obj_list_is_empty;
+	nftnl_obj_list_foreach;
+	nftnl_obj_list_add;
+	nftnl_obj_list_add_tail;
+	nftnl_obj_list_del;
+	nftnl_obj_list_iter_create;
+	nftnl_obj_list_iter_next;
+	nftnl_obj_list_iter_destroy;
+} LIBNFTNL_4.2;
diff --git a/src/obj/counter.c b/src/obj/counter.c
new file mode 100644
index 000000000000..beadc93a8c35
--- /dev/null
+++ b/src/obj/counter.c
@@ -0,0 +1,184 @@
+/*
+ * (C) 2012-2016 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <inttypes.h>
+
+#include <linux/netfilter/nf_tables.h>
+
+#include <libmnl/libmnl.h>
+#include <libnftnl/object.h>
+
+#include "internal.h"
+#include "obj.h"
+
+static int
+nftnl_obj_counter_set(struct nftnl_obj *e, uint16_t type,
+			  const void *data, uint32_t data_len)
+{
+	struct nftnl_obj_counter *ctr = nftnl_obj_data(e);
+
+	switch(type) {
+	case NFTNL_OBJ_CTR_BYTES:
+		ctr->bytes = *((uint64_t *)data);
+		break;
+	case NFTNL_OBJ_CTR_PKTS:
+		ctr->pkts = *((uint64_t *)data);
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_obj_counter_get(const struct nftnl_obj *e, uint16_t type,
+			  uint32_t *data_len)
+{
+	struct nftnl_obj_counter *ctr = nftnl_obj_data(e);
+
+	switch(type) {
+	case NFTNL_OBJ_CTR_BYTES:
+		*data_len = sizeof(ctr->bytes);
+		return &ctr->bytes;
+	case NFTNL_OBJ_CTR_PKTS:
+		*data_len = sizeof(ctr->pkts);
+		return &ctr->pkts;
+	}
+	return NULL;
+}
+
+static int nftnl_obj_counter_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_COUNTER_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_COUNTER_BYTES:
+	case NFTA_COUNTER_PACKETS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_obj_counter_build(struct nlmsghdr *nlh, const struct nftnl_obj *e)
+{
+	struct nftnl_obj_counter *ctr = nftnl_obj_data(e);
+
+	if (e->flags & (1 << NFTNL_OBJ_CTR_BYTES))
+		mnl_attr_put_u64(nlh, NFTA_COUNTER_BYTES, htobe64(ctr->bytes));
+	if (e->flags & (1 << NFTNL_OBJ_CTR_PKTS))
+		mnl_attr_put_u64(nlh, NFTA_COUNTER_PACKETS, htobe64(ctr->pkts));
+}
+
+static int
+nftnl_obj_counter_parse(struct nftnl_obj *e, struct nlattr *attr)
+{
+	struct nftnl_obj_counter *ctr = nftnl_obj_data(e);
+	struct nlattr *tb[NFTA_COUNTER_MAX+1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_obj_counter_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_COUNTER_BYTES]) {
+		ctr->bytes = be64toh(mnl_attr_get_u64(tb[NFTA_COUNTER_BYTES]));
+		e->flags |= (1 << NFTNL_OBJ_CTR_BYTES);
+	}
+	if (tb[NFTA_COUNTER_PACKETS]) {
+		ctr->pkts = be64toh(mnl_attr_get_u64(tb[NFTA_COUNTER_PACKETS]));
+		e->flags |= (1 << NFTNL_OBJ_CTR_PKTS);
+	}
+
+	return 0;
+}
+
+static int
+nftnl_obj_counter_json_parse(struct nftnl_obj *e, json_t *root,
+				 struct nftnl_parse_err *err)
+{
+#ifdef JSON_PARSING
+	uint64_t uval64;
+
+	if (nftnl_jansson_parse_val(root, "pkts", NFTNL_TYPE_U64, &uval64,
+				  err) == 0)
+		nftnl_obj_set_u64(e, NFTNL_OBJ_CTR_PKTS, uval64);
+
+	if (nftnl_jansson_parse_val(root, "bytes", NFTNL_TYPE_U64, &uval64,
+				  err) == 0)
+		nftnl_obj_set_u64(e, NFTNL_OBJ_CTR_BYTES, uval64);
+
+	return 0;
+#else
+	errno = EOPNOTSUPP;
+	return -1;
+#endif
+}
+
+static int nftnl_obj_counter_export(char *buf, size_t size,
+				    const struct nftnl_obj *e, int type)
+{
+	struct nftnl_obj_counter *ctr = nftnl_obj_data(e);
+	NFTNL_BUF_INIT(b, buf, size);
+
+	if (e->flags & (1 << NFTNL_OBJ_CTR_PKTS))
+		nftnl_buf_u64(&b, type, ctr->pkts, PKTS);
+	if (e->flags & (1 << NFTNL_OBJ_CTR_BYTES))
+		nftnl_buf_u64(&b, type, ctr->bytes, BYTES);
+
+	return nftnl_buf_done(&b);
+}
+
+static int nftnl_obj_counter_snprintf_default(char *buf, size_t len,
+					       const struct nftnl_obj *e)
+{
+	struct nftnl_obj_counter *ctr = nftnl_obj_data(e);
+
+	return snprintf(buf, len, "pkts %"PRIu64" bytes %"PRIu64" ",
+			ctr->pkts, ctr->bytes);
+}
+
+static int nftnl_obj_counter_snprintf(char *buf, size_t len, uint32_t type,
+				       uint32_t flags,
+				       const struct nftnl_obj *e)
+{
+	switch (type) {
+	case NFTNL_OUTPUT_DEFAULT:
+		return nftnl_obj_counter_snprintf_default(buf, len, e);
+	case NFTNL_OUTPUT_XML:
+	case NFTNL_OUTPUT_JSON:
+		return nftnl_obj_counter_export(buf, len, e, type);
+	default:
+		break;
+	}
+	return -1;
+}
+
+struct obj_ops obj_ops_counter = {
+	.name		= "counter",
+	.type		= NFT_OBJECT_COUNTER,
+	.alloc_len	= sizeof(struct nftnl_obj_counter),
+	.max_attr	= NFTA_COUNTER_MAX,
+	.set		= nftnl_obj_counter_set,
+	.get		= nftnl_obj_counter_get,
+	.parse		= nftnl_obj_counter_parse,
+	.build		= nftnl_obj_counter_build,
+	.snprintf	= nftnl_obj_counter_snprintf,
+	.json_parse	= nftnl_obj_counter_json_parse,
+};
diff --git a/src/obj/quota.c b/src/obj/quota.c
new file mode 100644
index 000000000000..d5757b29d40d
--- /dev/null
+++ b/src/obj/quota.c
@@ -0,0 +1,205 @@
+/*
+ * (C) 2012-2016 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <inttypes.h>
+
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/object.h>
+
+#include "obj.h"
+
+static int nftnl_obj_quota_set(struct nftnl_obj *e, uint16_t type,
+				const void *data, uint32_t data_len)
+{
+	struct nftnl_obj_quota *quota = nftnl_obj_data(e);
+
+	switch (type) {
+	case NFTNL_OBJ_QUOTA_BYTES:
+		quota->bytes = *((uint64_t *)data);
+		break;
+	case NFTNL_OBJ_QUOTA_CONSUMED:
+		quota->consumed = *((uint64_t *)data);
+		break;
+	case NFTNL_OBJ_QUOTA_FLAGS:
+		quota->flags = *((uint32_t *)data);
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *nftnl_obj_quota_get(const struct nftnl_obj *e,
+					uint16_t type, uint32_t *data_len)
+{
+	struct nftnl_obj_quota *quota = nftnl_obj_data(e);
+
+	switch (type) {
+	case NFTNL_OBJ_QUOTA_BYTES:
+		*data_len = sizeof(quota->bytes);
+		return &quota->bytes;
+	case NFTNL_OBJ_QUOTA_CONSUMED:
+		*data_len = sizeof(quota->consumed);
+		return &quota->consumed;
+	case NFTNL_OBJ_QUOTA_FLAGS:
+		*data_len = sizeof(quota->flags);
+		return &quota->flags;
+	}
+	return NULL;
+}
+
+static int nftnl_obj_quota_cb(const struct nlattr *attr, void *data)
+{
+	int type = mnl_attr_get_type(attr);
+	const struct nlattr **tb = data;
+
+	if (mnl_attr_type_valid(attr, NFTA_QUOTA_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_QUOTA_BYTES:
+	case NFTA_QUOTA_CONSUMED:
+		if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
+			abi_breakage();
+		break;
+	case NFTA_QUOTA_FLAGS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_obj_quota_build(struct nlmsghdr *nlh, const struct nftnl_obj *e)
+{
+	struct nftnl_obj_quota *quota = nftnl_obj_data(e);
+
+	if (e->flags & (1 << NFTNL_OBJ_QUOTA_BYTES))
+		mnl_attr_put_u64(nlh, NFTA_QUOTA_BYTES, htobe64(quota->bytes));
+	if (e->flags & (1 << NFTNL_OBJ_QUOTA_CONSUMED))
+		mnl_attr_put_u64(nlh, NFTA_QUOTA_CONSUMED,
+				 htobe64(quota->consumed));
+	if (e->flags & (1 << NFTNL_OBJ_QUOTA_FLAGS))
+		mnl_attr_put_u32(nlh, NFTA_QUOTA_FLAGS, htonl(quota->flags));
+}
+
+static int
+nftnl_obj_quota_parse(struct nftnl_obj *e, struct nlattr *attr)
+{
+	struct nftnl_obj_quota *quota = nftnl_obj_data(e);
+	struct nlattr *tb[NFTA_QUOTA_MAX + 1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_obj_quota_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_QUOTA_BYTES]) {
+		quota->bytes = be64toh(mnl_attr_get_u64(tb[NFTA_QUOTA_BYTES]));
+		e->flags |= (1 << NFTNL_OBJ_QUOTA_BYTES);
+	}
+	if (tb[NFTA_QUOTA_CONSUMED]) {
+		quota->consumed =
+			be64toh(mnl_attr_get_u64(tb[NFTA_QUOTA_CONSUMED]));
+		e->flags |= (1 << NFTNL_OBJ_QUOTA_CONSUMED);
+	}
+	if (tb[NFTA_QUOTA_FLAGS]) {
+		quota->flags = ntohl(mnl_attr_get_u32(tb[NFTA_QUOTA_FLAGS]));
+		e->flags |= (1 << NFTNL_OBJ_QUOTA_FLAGS);
+	}
+
+	return 0;
+}
+
+static int
+nftnl_obj_quota_json_parse(struct nftnl_obj *e, json_t *root,
+				 struct nftnl_parse_err *err)
+{
+#ifdef JSON_PARSING
+	uint64_t bytes;
+	uint32_t flags;
+
+	if (nftnl_jansson_parse_val(root, "bytes", NFTNL_TYPE_U64, &bytes,
+				  err) == 0)
+		nftnl_obj_set_u64(e, NFTNL_OBJ_QUOTA_BYTES, bytes);
+	if (nftnl_jansson_parse_val(root, "consumed", NFTNL_TYPE_U64, &bytes,
+				    err) == 0)
+		nftnl_obj_set_u64(e, NFTNL_OBJ_QUOTA_CONSUMED, bytes);
+	if (nftnl_jansson_parse_val(root, "flags", NFTNL_TYPE_U32, &flags,
+				  err) == 0)
+		nftnl_obj_set_u32(e, NFTNL_OBJ_QUOTA_FLAGS, flags);
+
+	return 0;
+#else
+	errno = EOPNOTSUPP;
+	return -1;
+#endif
+}
+
+static int nftnl_obj_quota_export(char *buf, size_t size,
+				   const struct nftnl_obj *e, int type)
+{
+	struct nftnl_obj_quota *quota = nftnl_obj_data(e);
+	NFTNL_BUF_INIT(b, buf, size);
+
+	if (e->flags & (1 << NFTNL_OBJ_QUOTA_BYTES))
+		nftnl_buf_u64(&b, type, quota->bytes, BYTES);
+	if (e->flags & (1 << NFTNL_OBJ_QUOTA_CONSUMED))
+		nftnl_buf_u64(&b, type, quota->consumed, CONSUMED);
+	if (e->flags & (1 << NFTNL_OBJ_QUOTA_FLAGS))
+		nftnl_buf_u32(&b, type, quota->flags, FLAGS);
+
+	return nftnl_buf_done(&b);
+}
+
+static int nftnl_obj_quota_snprintf_default(char *buf, size_t len,
+					       const struct nftnl_obj *e)
+{
+	struct nftnl_obj_quota *quota = nftnl_obj_data(e);
+
+	return snprintf(buf, len, "bytes %"PRIu64" flags %u ",
+			quota->bytes, quota->flags);
+}
+
+static int nftnl_obj_quota_snprintf(char *buf, size_t len, uint32_t type,
+				       uint32_t flags,
+				       const struct nftnl_obj *e)
+{
+	switch (type) {
+	case NFTNL_OUTPUT_DEFAULT:
+		return nftnl_obj_quota_snprintf_default(buf, len, e);
+	case NFTNL_OUTPUT_XML:
+	case NFTNL_OUTPUT_JSON:
+		return nftnl_obj_quota_export(buf, len, e, type);
+	default:
+		break;
+	}
+	return -1;
+}
+
+struct obj_ops obj_ops_quota = {
+	.name		= "quota",
+	.type		= NFT_OBJECT_QUOTA,
+	.alloc_len	= sizeof(struct nftnl_obj_quota),
+	.max_attr	= NFTA_QUOTA_MAX,
+	.set		= nftnl_obj_quota_set,
+	.get		= nftnl_obj_quota_get,
+	.parse		= nftnl_obj_quota_parse,
+	.build		= nftnl_obj_quota_build,
+	.snprintf	= nftnl_obj_quota_snprintf,
+	.json_parse	= nftnl_obj_quota_json_parse,
+};
diff --git a/src/object.c b/src/object.c
new file mode 100644
index 000000000000..0190e9409797
--- /dev/null
+++ b/src/object.c
@@ -0,0 +1,573 @@
+/*
+ * (C) 2012-2016 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+#include "internal.h"
+
+#include <time.h>
+#include <endian.h>
+#include <stdint.h>
+#include <limits.h>
+#include <stdlib.h>
+#include <string.h>
+#include <netinet/in.h>
+#include <errno.h>
+
+#include <libmnl/libmnl.h>
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include <libnftnl/object.h>
+#include <buffer.h>
+#include "obj.h"
+
+static struct obj_ops *obj_ops[] = {
+	[NFT_OBJECT_COUNTER]	= &obj_ops_counter,
+	[NFT_OBJECT_QUOTA]	= &obj_ops_quota,
+};
+
+static struct obj_ops *nftnl_obj_ops_lookup(uint32_t type)
+{
+	if (type > NFT_OBJECT_QUOTA)
+		return NULL;
+
+	return obj_ops[type];
+}
+
+struct nftnl_obj *nftnl_obj_alloc(void)
+{
+	return calloc(1, sizeof(struct nftnl_obj));
+}
+EXPORT_SYMBOL(nftnl_obj_alloc);
+
+void nftnl_obj_free(const struct nftnl_obj *obj)
+{
+	if (obj->flags & (1 << NFTNL_OBJ_TABLE))
+		xfree(obj->table);
+	if (obj->flags & (1 << NFTNL_OBJ_NAME))
+		xfree(obj->name);
+
+	xfree(obj);
+}
+EXPORT_SYMBOL(nftnl_obj_free);
+
+bool nftnl_obj_is_set(const struct nftnl_obj *obj, uint16_t attr)
+{
+	return obj->flags & (1 << attr);
+}
+EXPORT_SYMBOL(nftnl_obj_is_set);
+
+static uint32_t nftnl_obj_validate[NFTNL_OBJ_MAX + 1] = {
+	[NFTNL_OBJ_FAMILY]	= sizeof(uint32_t),
+	[NFTNL_OBJ_USE]		= sizeof(uint32_t),
+};
+
+void nftnl_obj_set_data(struct nftnl_obj *obj, uint16_t attr,
+			const void *data, uint32_t data_len)
+{
+	if (attr < NFTNL_OBJ_MAX)
+		nftnl_assert_validate(data, nftnl_obj_validate, attr, data_len);
+
+	switch (attr) {
+	case NFTNL_OBJ_TABLE:
+		xfree(obj->table);
+		obj->table = strdup(data);
+		break;
+	case NFTNL_OBJ_NAME:
+		xfree(obj->name);
+		obj->name = strdup(data);
+		break;
+	case NFTNL_OBJ_TYPE:
+		obj->ops = nftnl_obj_ops_lookup(*((uint32_t *)data));
+		break;
+	case NFTNL_OBJ_FAMILY:
+		obj->family = *((uint32_t *)data);
+		break;
+	case NFTNL_OBJ_USE:
+		obj->use = *((uint32_t *)data);
+		break;
+	default:
+		if (obj->ops)
+			obj->ops->set(obj, attr, data, data_len);
+		break;
+	}
+	obj->flags |= (1 << attr);
+}
+EXPORT_SYMBOL(nftnl_obj_set_data);
+
+void nftnl_obj_set(struct nftnl_obj *obj, uint16_t attr, const void *data)
+{
+	nftnl_obj_set_data(obj, attr, data, nftnl_obj_validate[attr]);
+}
+EXPORT_SYMBOL(nftnl_obj_set);
+
+void nftnl_obj_set_u32(struct nftnl_obj *obj, uint16_t attr, uint32_t val)
+{
+	nftnl_obj_set_data(obj, attr, &val, sizeof(uint32_t));
+}
+EXPORT_SYMBOL(nftnl_obj_set_u32);
+
+void nftnl_obj_set_u64(struct nftnl_obj *obj, uint16_t attr, uint64_t val)
+{
+	nftnl_obj_set_data(obj, attr, &val, sizeof(uint64_t));
+}
+EXPORT_SYMBOL(nftnl_obj_set_u64);
+
+void nftnl_obj_set_str(struct nftnl_obj *obj, uint16_t attr, const char *str)
+{
+	nftnl_obj_set_data(obj, attr, str, 0);
+}
+EXPORT_SYMBOL(nftnl_obj_set_str);
+
+const void *nftnl_obj_get_data(struct nftnl_obj *obj, uint16_t attr,
+			       uint32_t *data_len)
+{
+	if (!(obj->flags & (1 << attr)))
+		return NULL;
+
+	switch(attr) {
+	case NFTNL_OBJ_TABLE:
+		return obj->table;
+	case NFTNL_OBJ_NAME:
+		return obj->name;
+	case NFTNL_OBJ_TYPE:
+		if (!obj->ops)
+			return NULL;
+
+		*data_len = sizeof(uint32_t);
+		return &obj->ops->type;
+	case NFTNL_OBJ_FAMILY:
+		*data_len = sizeof(uint32_t);
+		return &obj->family;
+	case NFTNL_OBJ_USE:
+		*data_len = sizeof(uint32_t);
+		return &obj->use;
+	default:
+		if (obj->ops)
+			return obj->ops->get(obj, attr, data_len);
+		break;
+	}
+	return NULL;
+}
+EXPORT_SYMBOL(nftnl_obj_get_data);
+
+const void *nftnl_obj_get(struct nftnl_obj *obj, uint16_t attr)
+{
+	uint32_t data_len;
+	return nftnl_obj_get_data(obj, attr, &data_len);
+}
+EXPORT_SYMBOL(nftnl_obj_get);
+
+uint32_t nftnl_obj_get_u32(struct nftnl_obj *obj, uint16_t attr)
+{
+	const void *ret = nftnl_obj_get(obj, attr);
+	return ret == NULL ? 0 : *((uint32_t *)ret);
+}
+EXPORT_SYMBOL(nftnl_obj_get_u32);
+
+uint64_t nftnl_obj_get_u64(struct nftnl_obj *obj, uint16_t attr)
+{
+	const void *ret = nftnl_obj_get(obj, attr);
+	return ret == NULL ? 0 : *((uint64_t *)ret);
+}
+EXPORT_SYMBOL(nftnl_obj_get_u64);
+
+const char *nftnl_obj_get_str(struct nftnl_obj *obj, uint16_t attr)
+{
+	return nftnl_obj_get(obj, attr);
+}
+EXPORT_SYMBOL(nftnl_obj_get_str);
+
+void nftnl_obj_nlmsg_build_payload(struct nlmsghdr *nlh,
+				   const struct nftnl_obj *obj)
+{
+	if (obj->flags & (1 << NFTNL_OBJ_TABLE))
+		mnl_attr_put_strz(nlh, NFTA_OBJ_TABLE, obj->table);
+	if (obj->flags & (1 << NFTNL_OBJ_NAME))
+		mnl_attr_put_strz(nlh, NFTA_OBJ_NAME, obj->name);
+	if (obj->flags & (1 << NFTNL_OBJ_TYPE))
+		mnl_attr_put_u32(nlh, NFTA_OBJ_TYPE, htonl(obj->ops->type));
+
+	if (obj->ops) {
+		struct nlattr *nest = mnl_attr_nest_start(nlh, NFTA_OBJ_DATA);
+
+		obj->ops->build(nlh, obj);
+		mnl_attr_nest_end(nlh, nest);
+	}
+}
+EXPORT_SYMBOL(nftnl_obj_nlmsg_build_payload);
+
+static int nftnl_obj_parse_attr_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_OBJ_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_OBJ_TABLE:
+	case NFTA_OBJ_NAME:
+		if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
+			abi_breakage();
+		break;
+	case NFTA_OBJ_DATA:
+		if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
+			abi_breakage();
+		break;
+	case NFTA_OBJ_USE:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+int nftnl_obj_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_obj *obj)
+{
+	struct nfgenmsg *nfg = mnl_nlmsg_get_payload(nlh);
+	struct nlattr *tb[NFTA_OBJ_MAX + 1] = {};
+	int err;
+
+	if (mnl_attr_parse(nlh, sizeof(*nfg), nftnl_obj_parse_attr_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_OBJ_TABLE]) {
+		obj->table = strdup(mnl_attr_get_str(tb[NFTA_OBJ_TABLE]));
+		obj->flags |= (1 << NFTNL_OBJ_TABLE);
+	}
+	if (tb[NFTA_OBJ_NAME]) {
+		obj->name = strdup(mnl_attr_get_str(tb[NFTA_OBJ_NAME]));
+		obj->flags |= (1 << NFTNL_OBJ_NAME);
+	}
+	if (tb[NFTA_OBJ_TYPE]) {
+		uint32_t type = ntohl(mnl_attr_get_u32(tb[NFTA_OBJ_TYPE]));
+
+		obj->ops = nftnl_obj_ops_lookup(type);
+		obj->flags |= (1 << NFTNL_OBJ_TYPE);
+	}
+	if (tb[NFTA_OBJ_DATA]) {
+		if (obj->ops) {
+			err = obj->ops->parse(obj, tb[NFTA_OBJ_DATA]);
+			if (err < 0)
+				return err;
+		}
+	}
+	if (tb[NFTA_OBJ_USE]) {
+		obj->use = ntohl(mnl_attr_get_u32(tb[NFTA_OBJ_USE]));
+		obj->flags |= (1 << NFTNL_OBJ_USE);
+	}
+
+	obj->family = nfg->nfgen_family;
+	obj->flags |= (1 << NFTNL_OBJ_FAMILY);
+
+	return 0;
+}
+EXPORT_SYMBOL(nftnl_obj_nlmsg_parse);
+
+#ifdef JSON_PARSING
+static int nftnl_jansson_parse_obj(struct nftnl_obj *t, json_t *tree,
+			    struct nftnl_parse_err *err)
+{
+	const char *str;
+	json_t *root;
+
+	root = nftnl_jansson_get_node(tree, "obj", err);
+	if (root == NULL)
+		return -1;
+
+	str = nftnl_jansson_parse_str(root, "table", err);
+	if (str != NULL)
+		nftnl_obj_set_str(t, NFTNL_OBJ_TABLE, str);
+
+	str = nftnl_jansson_parse_str(root, "name", err);
+	if (str != NULL)
+		nftnl_obj_set_str(t, NFTNL_OBJ_NAME, str);
+
+	return 0;
+}
+#endif
+
+static int nftnl_obj_json_parse(struct nftnl_obj *t, const void *json,
+				struct nftnl_parse_err *err,
+				enum nftnl_parse_input input)
+{
+#ifdef JSON_PARSING
+	json_t *tree;
+	json_error_t error;
+	int ret;
+
+	tree = nftnl_jansson_create_root(json, &error, err, input);
+	if (tree == NULL)
+		return -1;
+
+	ret = nftnl_jansson_parse_obj(t, tree, err);
+
+	nftnl_jansson_free_root(tree);
+
+	return ret;
+#else
+	errno = EOPNOTSUPP;
+	return -1;
+#endif
+}
+
+static int nftnl_obj_do_parse(struct nftnl_obj *obj, enum nftnl_parse_type type,
+			      const void *data, struct nftnl_parse_err *err,
+			      enum nftnl_parse_input input)
+{
+	struct nftnl_parse_err perr;
+	int ret;
+
+	switch (type) {
+	case NFTNL_PARSE_JSON:
+		ret = nftnl_obj_json_parse(obj, data, &perr, input);
+		break;
+	case NFTNL_PARSE_XML:
+	default:
+		ret = -1;
+		errno = EOPNOTSUPP;
+		break;
+	}
+
+	if (err != NULL)
+		*err = perr;
+
+	return ret;
+}
+
+int nftnl_obj_parse(struct nftnl_obj *obj, enum nftnl_parse_type type,
+		      const char *data, struct nftnl_parse_err *err)
+{
+	return nftnl_obj_do_parse(obj, type, data, err, NFTNL_PARSE_BUFFER);
+}
+EXPORT_SYMBOL(nftnl_obj_parse);
+
+int nftnl_obj_parse_file(struct nftnl_obj *obj, enum nftnl_parse_type type,
+			   FILE *fp, struct nftnl_parse_err *err)
+{
+	return nftnl_obj_do_parse(obj, type, fp, err, NFTNL_PARSE_FILE);
+}
+EXPORT_SYMBOL(nftnl_obj_parse_file);
+
+static int nftnl_obj_export(char *buf, size_t size,
+			    const struct nftnl_obj *obj,
+			    uint32_t type, uint32_t flags)
+{
+	int ret = 0;
+
+	NFTNL_BUF_INIT(b, buf, size);
+
+	nftnl_buf_open(&b, type, TABLE);
+	if (obj->flags & (1 << NFTNL_OBJ_TABLE))
+		nftnl_buf_str(&b, type, obj->name, NAME);
+	if (obj->flags & (1 << NFTNL_OBJ_NAME))
+		nftnl_buf_str(&b, type, obj->name, NAME);
+	if (obj->flags & (1 << NFTNL_OBJ_FAMILY))
+		nftnl_buf_str(&b, type, nftnl_family2str(obj->family), FAMILY);
+	if (obj->flags & (1 << NFTNL_OBJ_USE))
+		nftnl_buf_u32(&b, type, obj->use, USE);
+
+	if (obj->ops)
+		ret = obj->ops->snprintf(buf + b.len, size - b.len, type,
+					 flags, obj);
+
+	b.len += ret;
+	nftnl_buf_close(&b, type, TABLE);
+
+	return nftnl_buf_done(&b);
+}
+
+static int nftnl_obj_snprintf_dflt(char *buf, size_t size,
+				   const struct nftnl_obj *obj,
+				   uint32_t type, uint32_t flags)
+{
+	int ret, len = size, offset = 0;
+
+	ret = snprintf(buf, size, "table %s name %s use %u [ %s ",
+		       obj->table, obj->name, obj->use, obj->ops->name);
+	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+	if (obj->ops) {
+		ret = obj->ops->snprintf(buf + offset, offset, type, flags, obj);
+		SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+	}
+	ret = snprintf(buf + offset, offset, "]");
+	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+	return offset;
+}
+
+static int nftnl_obj_cmd_snprintf(char *buf, size_t size,
+				    const struct nftnl_obj *obj, uint32_t cmd,
+				    uint32_t type, uint32_t flags)
+{
+	int ret, len = size, offset = 0;
+
+	ret = nftnl_cmd_header_snprintf(buf + offset, len, cmd, type, flags);
+	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+	switch (type) {
+	case NFT_OUTPUT_DEFAULT:
+		ret = nftnl_obj_snprintf_dflt(buf + offset, len, obj, type,
+					      flags);
+		break;
+	case NFT_OUTPUT_JSON:
+		ret = nftnl_obj_export(buf + offset, len, obj, type, flags);
+		break;
+	case NFT_OUTPUT_XML:
+	default:
+		return -1;
+	}
+	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+	ret = nftnl_cmd_footer_snprintf(buf + offset, len, cmd, type, flags);
+	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+	return offset;
+}
+
+int nftnl_obj_snprintf(char *buf, size_t size, const struct nftnl_obj *obj,
+		       uint32_t type, uint32_t flags)
+{
+	return nftnl_obj_cmd_snprintf(buf, size, obj, nftnl_flag2cmd(flags),
+				      type, flags);
+}
+EXPORT_SYMBOL(nftnl_obj_snprintf);
+
+static int nftnl_obj_do_snprintf(char *buf, size_t size, const void *obj,
+				 uint32_t cmd, uint32_t type, uint32_t flags)
+{
+	return nftnl_obj_snprintf(buf, size, obj, type, flags);
+}
+
+int nftnl_obj_fprintf(FILE *fp, const struct nftnl_obj *obj, uint32_t type,
+		      uint32_t flags)
+{
+	return nftnl_fprintf(fp, obj, NFT_CMD_UNSPEC, type, flags,
+			     nftnl_obj_do_snprintf);
+}
+EXPORT_SYMBOL(nftnl_obj_fprintf);
+
+struct nftnl_obj_list {
+	struct list_head list;
+};
+
+struct nftnl_obj_list *nftnl_obj_list_alloc(void)
+{
+	struct nftnl_obj_list *list;
+
+	list = calloc(1, sizeof(struct nftnl_obj_list));
+	if (list == NULL)
+		return NULL;
+
+	INIT_LIST_HEAD(&list->list);
+
+	return list;
+}
+EXPORT_SYMBOL(nftnl_obj_list_alloc);
+
+void nftnl_obj_list_free(struct nftnl_obj_list *list)
+{
+	struct nftnl_obj *r, *tmp;
+
+	list_for_each_entry_safe(r, tmp, &list->list, head) {
+		list_del(&r->head);
+		nftnl_obj_free(r);
+	}
+	xfree(list);
+}
+EXPORT_SYMBOL(nftnl_obj_list_free);
+
+int nftnl_obj_list_is_empty(struct nftnl_obj_list *list)
+{
+	return list_empty(&list->list);
+}
+EXPORT_SYMBOL(nftnl_obj_list_is_empty);
+
+void nftnl_obj_list_add(struct nftnl_obj *r, struct nftnl_obj_list *list)
+{
+	list_add(&r->head, &list->list);
+}
+EXPORT_SYMBOL(nftnl_obj_list_add);
+
+void nftnl_obj_list_add_tail(struct nftnl_obj *r,
+			       struct nftnl_obj_list *list)
+{
+	list_add_tail(&r->head, &list->list);
+}
+EXPORT_SYMBOL(nftnl_obj_list_add_tail);
+
+void nftnl_obj_list_del(struct nftnl_obj *t)
+{
+	list_del(&t->head);
+}
+EXPORT_SYMBOL(nftnl_obj_list_del);
+
+int nftnl_obj_list_foreach(struct nftnl_obj_list *table_list,
+			     int (*cb)(struct nftnl_obj *t, void *data),
+			     void *data)
+{
+	struct nftnl_obj *cur, *tmp;
+	int ret;
+
+	list_for_each_entry_safe(cur, tmp, &table_list->list, head) {
+		ret = cb(cur, data);
+		if (ret < 0)
+			return ret;
+	}
+	return 0;
+}
+EXPORT_SYMBOL(nftnl_obj_list_foreach);
+
+struct nftnl_obj_list_iter {
+	struct nftnl_obj_list	*list;
+	struct nftnl_obj	*cur;
+};
+
+struct nftnl_obj_list_iter *
+nftnl_obj_list_iter_create(struct nftnl_obj_list *l)
+{
+	struct nftnl_obj_list_iter *iter;
+
+	iter = calloc(1, sizeof(struct nftnl_obj_list_iter));
+	if (iter == NULL)
+		return NULL;
+
+	iter->list = l;
+	if (nftnl_obj_list_is_empty(l))
+		iter->cur = NULL;
+	else
+		iter->cur = list_entry(l->list.next, struct nftnl_obj, head);
+
+	return iter;
+}
+EXPORT_SYMBOL(nftnl_obj_list_iter_create);
+
+struct nftnl_obj *nftnl_obj_list_iter_next(struct nftnl_obj_list_iter *iter)
+{
+	struct nftnl_obj *r = iter->cur;
+
+	if (r == NULL)
+		return NULL;
+
+	/* get next table, if any */
+	iter->cur = list_entry(iter->cur->head.next, struct nftnl_obj, head);
+	if (&iter->cur->head == iter->list->list.next)
+		return NULL;
+
+	return r;
+}
+EXPORT_SYMBOL(nftnl_obj_list_iter_next);
+
+void nftnl_obj_list_iter_destroy(struct nftnl_obj_list_iter *iter)
+{
+	xfree(iter);
+}
+EXPORT_SYMBOL(nftnl_obj_list_iter_destroy);
diff --git a/tests/Makefile.am b/tests/Makefile.am
index d51895974406..812ebff17126 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -6,6 +6,7 @@ EXTRA_DIST =		test-script.sh			\
 check_PROGRAMS = 	nft-parsing-test		\
 			nft-table-test			\
 			nft-chain-test			\
+			nft-object-test			\
 			nft-rule-test			\
 			nft-set-test			\
 			nft-expr_bitwise-test		\
@@ -43,6 +44,9 @@ nft_table_test_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS}
 nft_chain_test_SOURCES = nft-chain-test.c
 nft_chain_test_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS}
 
+nft_object_test_SOURCES = nft-object-test.c
+nft_object_test_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS}
+
 nft_rule_test_SOURCES = nft-rule-test.c
 nft_rule_test_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS}
 
diff --git a/tests/nft-object-test.c b/tests/nft-object-test.c
new file mode 100644
index 000000000000..d2ca44415341
--- /dev/null
+++ b/tests/nft-object-test.c
@@ -0,0 +1,78 @@
+/*
+ * (C) 2013 by Ana Rey Botello <anarey@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <netinet/in.h>
+
+#include <linux/netfilter/nf_tables.h>
+#include <libnftnl/object.h>
+
+static int test_ok = 1;
+
+static void print_err(const char *msg)
+{
+	test_ok = 0;
+	printf("\033[31mERROR:\e[0m %s\n", msg);
+}
+
+static void cmp_nftnl_obj(struct nftnl_obj *a, struct nftnl_obj *b)
+{
+	if (strcmp(nftnl_obj_get_str(a, NFTNL_OBJ_TABLE),
+		   nftnl_obj_get_str(b, NFTNL_OBJ_TABLE)) != 0)
+		print_err("table name mismatches");
+	if (strcmp(nftnl_obj_get_str(a, NFTNL_OBJ_NAME),
+		   nftnl_obj_get_str(b, NFTNL_OBJ_NAME)) != 0)
+		print_err("name mismatches");
+	if (nftnl_obj_get_u32(a, NFTNL_OBJ_FAMILY) !=
+	    nftnl_obj_get_u32(b, NFTNL_OBJ_FAMILY))
+		print_err("family mismatches");
+	if (nftnl_obj_get_u32(a, NFTNL_OBJ_TYPE) !=
+	    nftnl_obj_get_u32(b, NFTNL_OBJ_TYPE))
+		print_err("type mismatches");
+}
+
+int main(int argc, char *argv[])
+{
+	char buf[4096];
+	struct nlmsghdr *nlh;
+	struct nftnl_obj *a;
+	struct nftnl_obj *b;
+
+	a = nftnl_obj_alloc();
+	b = nftnl_obj_alloc();
+	if (a == NULL || b == NULL)
+		print_err("OOM");
+
+	nftnl_obj_set_str(a, NFTNL_OBJ_TABLE, "test");
+	nftnl_obj_set_str(a, NFTNL_OBJ_NAME, "test");
+	nftnl_obj_set_u32(a, NFTNL_OBJ_FAMILY, AF_INET);
+	nftnl_obj_set_u32(a, NFTNL_OBJ_USE, 1);
+	nftnl_obj_set_u64(a, NFTNL_OBJ_CTR_BYTES, 0x12345678abcd);
+	nftnl_obj_set_u64(a, NFTNL_OBJ_CTR_PKTS, 0xcd12345678ab);
+
+	/* cmd extracted from include/linux/netfilter/nf_tables.h */
+	nlh = nftnl_nlmsg_build_hdr(buf, NFT_MSG_NEWOBJ, AF_INET, 0, 1234);
+	nftnl_obj_nlmsg_build_payload(nlh, a);
+
+	if (nftnl_obj_nlmsg_parse(nlh, b) < 0)
+		print_err("parsing problems");
+
+	cmp_nftnl_obj(a, b);
+
+	nftnl_obj_free(a);
+	nftnl_obj_free(b);
+	if (!test_ok)
+		exit(EXIT_FAILURE);
+
+	printf("%s: \033[32mOK\e[0m\n", argv[0]);
+	return EXIT_SUCCESS;
+}
diff --git a/tests/test-script.sh b/tests/test-script.sh
index 3244f802e1cb..743e514da698 100755
--- a/tests/test-script.sh
+++ b/tests/test-script.sh
@@ -27,4 +27,5 @@
 ./nft-rule-test
 ./nft-set-test
 ./nft-table-test
+./nft-object-test
 ./nft-parsing-test -d jsonfiles
-- 
2.1.4


^ permalink raw reply related	[flat|nested] 7+ messages in thread

* [PATCH libnftnl 3/7] expr: add stateful object reference expression
  2016-12-09 13:31 [PATCH libnftnl 1/7] include: fetch stateful object updates for nf_tables.h cache copy Pablo Neira Ayuso
  2016-12-09 13:31 ` [PATCH libnftnl 2/7] src: support for stateful objects Pablo Neira Ayuso
@ 2016-12-09 13:31 ` Pablo Neira Ayuso
  2016-12-09 13:31 ` [PATCH libnftnl 4/7] set: add NFTNL_SET_OBJ_TYPE attribute Pablo Neira Ayuso
                   ` (3 subsequent siblings)
  5 siblings, 0 replies; 7+ messages in thread
From: Pablo Neira Ayuso @ 2016-12-09 13:31 UTC (permalink / raw)
  To: netfilter-devel

This patch adds a new "objref" expression that you can use to refer to
stateful objects from rules.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 include/libnftnl/expr.h      |   5 +
 src/Makefile.am              |   1 +
 src/expr/objref.c            | 215 +++++++++++++++++++++++++++++++++++++++++++
 src/expr_ops.c               |   2 +
 src/object.c                 |   5 +
 tests/Makefile.am            |   4 +
 tests/nft-expr_objref-test.c |  96 +++++++++++++++++++
 tests/test-script.sh         |   1 +
 8 files changed, 329 insertions(+)
 create mode 100644 src/expr/objref.c
 create mode 100644 tests/nft-expr_objref-test.c

diff --git a/include/libnftnl/expr.h b/include/libnftnl/expr.h
index 979241aac535..f6ea69dfacae 100644
--- a/include/libnftnl/expr.h
+++ b/include/libnftnl/expr.h
@@ -234,6 +234,11 @@ enum {
 	NFTNL_EXPR_FIB_FLAGS,
 };
 
+enum {
+	NFTNL_EXPR_OBJREF_IMM_TYPE	= NFTNL_EXPR_BASE,
+	NFTNL_EXPR_OBJREF_IMM_NAME,
+};
+
 /*
  * Compat
  */
diff --git a/src/Makefile.am b/src/Makefile.am
index 909c6a668b77..485a8c4acbef 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -42,6 +42,7 @@ libnftnl_la_SOURCES = utils.c		\
 		      expr/meta.c	\
 		      expr/numgen.c	\
 		      expr/nat.c	\
+		      expr/objref.c	\
 		      expr/payload.c	\
 		      expr/queue.c	\
 		      expr/quota.c	\
diff --git a/src/expr/objref.c b/src/expr/objref.c
new file mode 100644
index 000000000000..01bea7b8b4b1
--- /dev/null
+++ b/src/expr/objref.c
@@ -0,0 +1,215 @@
+/*
+ * (C) 2016 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <inttypes.h>
+
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_objref {
+	struct {
+		uint32_t	type;
+		const char	*name;
+	} imm;
+};
+
+static int nftnl_expr_objref_set(struct nftnl_expr *e, uint16_t type,
+				 const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_objref *objref = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_OBJREF_IMM_TYPE:
+		objref->imm.type = *((uint32_t *)data);
+		break;
+	case NFTNL_EXPR_OBJREF_IMM_NAME:
+		objref->imm.name = strdup(data);
+		if (!objref->imm.name)
+			return -1;
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *nftnl_expr_objref_get(const struct nftnl_expr *e,
+					 uint16_t type, uint32_t *data_len)
+{
+	struct nftnl_expr_objref *objref = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_OBJREF_IMM_TYPE:
+		*data_len = sizeof(objref->imm.type);
+		return &objref->imm.type;
+	case NFTNL_EXPR_OBJREF_IMM_NAME:
+		*data_len = strlen(objref->imm.name) + 1;
+		return objref->imm.name;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_objref_cb(const struct nlattr *attr, void *data)
+{
+	int type = mnl_attr_get_type(attr);
+	const struct nlattr **tb = data;
+
+	if (mnl_attr_type_valid(attr, NFTA_OBJREF_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_OBJREF_IMM_TYPE:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_OBJREF_IMM_NAME:
+		if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void nftnl_expr_objref_build(struct nlmsghdr *nlh,
+				    const struct nftnl_expr *e)
+{
+	struct nftnl_expr_objref *objref = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_OBJREF_IMM_TYPE))
+		mnl_attr_put_u32(nlh, NFTA_OBJREF_IMM_TYPE,
+				 htonl(objref->imm.type));
+	if (e->flags & (1 << NFTNL_EXPR_OBJREF_IMM_NAME))
+		mnl_attr_put_str(nlh, NFTA_OBJREF_IMM_NAME, objref->imm.name);
+}
+
+static int nftnl_expr_objref_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_objref *objref = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_OBJREF_MAX + 1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_objref_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_OBJREF_IMM_TYPE]) {
+		objref->imm.type =
+			ntohl(mnl_attr_get_u32(tb[NFTA_OBJREF_IMM_TYPE]));
+		e->flags |= (1 << NFTNL_EXPR_OBJREF_IMM_TYPE);
+	}
+	if (tb[NFTA_OBJREF_IMM_NAME]) {
+		objref->imm.name =
+			strdup(mnl_attr_get_str(tb[NFTA_OBJREF_IMM_NAME]));
+		e->flags |= (1 << NFTNL_EXPR_OBJREF_IMM_NAME);
+	}
+
+	return 0;
+}
+
+static int
+nftnl_expr_objref_json_parse(struct nftnl_expr *e, json_t *root,
+			     struct nftnl_parse_err *err)
+{
+#ifdef JSON_PARSING
+	uint32_t uval32;
+	const char *str;
+
+	if (nftnl_jansson_node_exist(root, "name")) {
+		str = nftnl_jansson_parse_str(root, "name", err);
+		if (str == NULL)
+			return -1;
+
+		nftnl_expr_set_str(e, NFTNL_EXPR_OBJREF_IMM_NAME, str);
+	}
+
+	if (nftnl_jansson_parse_val(root, "type", NFTNL_TYPE_U32, &uval32,
+				    err) == 0)
+		nftnl_expr_set_u32(e, NFTNL_EXPR_OBJREF_IMM_TYPE, uval32);
+
+	return 0;
+#else
+	errno = EOPNOTSUPP;
+	return -1;
+#endif
+}
+
+static int nftnl_expr_objref_export(char *buf, size_t size,
+				    const struct nftnl_expr *e, int type)
+{
+	struct nftnl_expr_objref *objref = nftnl_expr_data(e);
+	NFTNL_BUF_INIT(b, buf, size);
+
+	if (e->flags & (1 << NFTNL_EXPR_OBJREF_IMM_TYPE))
+		nftnl_buf_u32(&b, type, objref->imm.type, BYTES);
+	if (e->flags & (1 << NFTNL_EXPR_OBJREF_IMM_NAME))
+		nftnl_buf_str(&b, type, objref->imm.name, NAME);
+
+	return nftnl_buf_done(&b);
+}
+
+static int nftnl_expr_objref_snprintf_default(char *buf, size_t len,
+					      const struct nftnl_expr *e)
+{
+	struct nftnl_expr_objref *objref = nftnl_expr_data(e);
+
+	return snprintf(buf, len, "type %u name %s ",
+			objref->imm.type, objref->imm.name);
+}
+
+static int nftnl_expr_objref_snprintf(char *buf, size_t len, uint32_t type,
+				      uint32_t flags,
+				      const struct nftnl_expr *e)
+{
+	switch (type) {
+	case NFTNL_OUTPUT_DEFAULT:
+		return nftnl_expr_objref_snprintf_default(buf, len, e);
+	case NFTNL_OUTPUT_XML:
+	case NFTNL_OUTPUT_JSON:
+		return nftnl_expr_objref_export(buf, len, e, type);
+	default:
+		break;
+	}
+	return -1;
+}
+
+static bool nftnl_expr_objref_cmp(const struct nftnl_expr *e1,
+				   const struct nftnl_expr *e2)
+{
+	struct nftnl_expr_objref *c1 = nftnl_expr_data(e1);
+	struct nftnl_expr_objref *c2 = nftnl_expr_data(e2);
+	bool eq = true;
+
+	if (e1->flags & (1 << NFTNL_EXPR_OBJREF_IMM_TYPE))
+		eq &= (c1->imm.type == c2->imm.type);
+	if (e1->flags & (1 << NFTNL_EXPR_OBJREF_IMM_NAME))
+		eq &= !strcmp(c1->imm.name, c2->imm.name);
+
+	return eq;
+}
+
+struct expr_ops expr_ops_objref = {
+	.name		= "objref",
+	.alloc_len	= sizeof(struct nftnl_expr_objref),
+	.max_attr	= NFTA_OBJREF_MAX,
+	.cmp		= nftnl_expr_objref_cmp,
+	.set		= nftnl_expr_objref_set,
+	.get		= nftnl_expr_objref_get,
+	.parse		= nftnl_expr_objref_parse,
+	.build		= nftnl_expr_objref_build,
+	.snprintf	= nftnl_expr_objref_snprintf,
+	.json_parse	= nftnl_expr_objref_json_parse,
+};
diff --git a/src/expr_ops.c b/src/expr_ops.c
index 4d7d1fab4577..7a0e1e3d0a26 100644
--- a/src/expr_ops.c
+++ b/src/expr_ops.c
@@ -21,6 +21,7 @@ extern struct expr_ops expr_ops_match;
 extern struct expr_ops expr_ops_meta;
 extern struct expr_ops expr_ops_ng;
 extern struct expr_ops expr_ops_nat;
+extern struct expr_ops expr_ops_objref;
 extern struct expr_ops expr_ops_payload;
 extern struct expr_ops expr_ops_range;
 extern struct expr_ops expr_ops_redir;
@@ -67,6 +68,7 @@ static struct expr_ops *expr_ops[] = {
 	&expr_ops_dynset,
 	&expr_ops_hash,
 	&expr_ops_fib,
+	&expr_ops_objref,
 	NULL,
 };
 
diff --git a/src/object.c b/src/object.c
index 0190e9409797..0d3dc2b1e678 100644
--- a/src/object.c
+++ b/src/object.c
@@ -276,6 +276,7 @@ static int nftnl_jansson_parse_obj(struct nftnl_obj *t, json_t *tree,
 			    struct nftnl_parse_err *err)
 {
 	const char *str;
+	uint32_t type;
 	json_t *root;
 
 	root = nftnl_jansson_get_node(tree, "obj", err);
@@ -290,6 +291,10 @@ static int nftnl_jansson_parse_obj(struct nftnl_obj *t, json_t *tree,
 	if (str != NULL)
 		nftnl_obj_set_str(t, NFTNL_OBJ_NAME, str);
 
+	if (nftnl_jansson_parse_val(root, "type", NFTNL_TYPE_U32, &type,
+				    err) < 0)
+		nftnl_obj_set_u32(t, NFTNL_OBJ_TYPE, type);
+
 	return 0;
 }
 #endif
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 812ebff17126..1467d99aa62c 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -26,6 +26,7 @@ check_PROGRAMS = 	nft-parsing-test		\
 			nft-expr_meta-test		\
 			nft-expr_numgen-test		\
 			nft-expr_nat-test		\
+			nft-expr_objref-test		\
 			nft-expr_payload-test		\
 			nft-expr_queue-test		\
 			nft-expr_range-test             \
@@ -104,6 +105,9 @@ nft_expr_numgen_test_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS}
 nft_expr_nat_test_SOURCES = nft-expr_nat-test.c
 nft_expr_nat_test_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS}
 
+nft_expr_objref_test_SOURCES = nft-expr_objref-test.c
+nft_expr_objref_test_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS}
+
 nft_expr_payload_test_SOURCES = nft-expr_payload-test.c
 nft_expr_payload_test_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS}
 
diff --git a/tests/nft-expr_objref-test.c b/tests/nft-expr_objref-test.c
new file mode 100644
index 000000000000..ae4da9ac8cb4
--- /dev/null
+++ b/tests/nft-expr_objref-test.c
@@ -0,0 +1,96 @@
+/*
+ * (C) 2013 by Ana Rey Botello <anarey@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <netinet/in.h>
+#include <netinet/ip.h>
+#include <linux/netfilter/nf_tables.h>
+#include <libmnl/libmnl.h>
+#include <libnftnl/rule.h>
+#include <libnftnl/expr.h>
+
+static int test_ok = 1;
+
+static void print_err(const char *msg)
+{
+	test_ok = 0;
+	printf("\033[31mERROR:\e[0m %s\n", msg);
+}
+
+static void cmp_nftnl_expr(struct nftnl_expr *rule_a,
+			      struct nftnl_expr *rule_b)
+{
+	if (nftnl_expr_get_u32(rule_a, NFTNL_EXPR_OBJREF_IMM_TYPE) !=
+	    nftnl_expr_get_u32(rule_b, NFTNL_EXPR_OBJREF_IMM_TYPE))
+		print_err("Expr NFTNL_EXPR_OBJREF_IMM_TYPE mismatches");
+	if (strcmp(nftnl_expr_get_str(rule_a, NFTNL_EXPR_OBJREF_IMM_NAME),
+		   nftnl_expr_get_str(rule_b, NFTNL_EXPR_OBJREF_IMM_NAME)))
+		print_err("Expr NFTNL_EXPR_OBJREF_IMM_NAME mismatches");
+}
+
+int main(int argc, char *argv[])
+{
+	struct nftnl_rule *a, *b;
+	struct nftnl_expr *ex;
+	struct nlmsghdr *nlh;
+	char buf[4096];
+	struct nftnl_expr_iter *iter_a, *iter_b;
+	struct nftnl_expr *rule_a, *rule_b;
+	char *name = "test_set_01243";
+
+	a = nftnl_rule_alloc();
+	b = nftnl_rule_alloc();
+	if (a == NULL || b == NULL)
+		print_err("OOM");
+	ex = nftnl_expr_alloc("lookup");
+	if (ex == NULL)
+		print_err("OOM");
+
+	nftnl_expr_set_u32(ex, NFTNL_EXPR_OBJREF_IMM_TYPE, 0x78123456);
+	nftnl_expr_set_str(ex, NFTNL_EXPR_OBJREF_IMM_NAME,  name);
+
+	nftnl_rule_add_expr(a, ex);
+
+	nlh = nftnl_nlmsg_build_hdr(buf, NFT_MSG_NEWRULE, AF_INET, 0, 1234);
+	nftnl_rule_nlmsg_build_payload(nlh, a);
+
+	if (nftnl_rule_nlmsg_parse(nlh, b) < 0)
+		print_err("parsing problems");
+
+	iter_a = nftnl_expr_iter_create(a);
+	iter_b = nftnl_expr_iter_create(b);
+	if (iter_a == NULL || iter_b == NULL)
+		print_err("OOM");
+	rule_a = nftnl_expr_iter_next(iter_a);
+	rule_b = nftnl_expr_iter_next(iter_b);
+	if (rule_a == NULL || rule_b == NULL)
+		print_err("OOM");
+
+	cmp_nftnl_expr(rule_a, rule_b);
+
+	if (nftnl_expr_iter_next(iter_a) != NULL ||
+	    nftnl_expr_iter_next(iter_b) != NULL)
+		print_err("More 1 expr.");
+
+	nftnl_expr_iter_destroy(iter_a);
+	nftnl_expr_iter_destroy(iter_b);
+	nftnl_rule_free(a);
+	nftnl_rule_free(b);
+
+	if (!test_ok)
+		exit(EXIT_FAILURE);
+
+	printf("%s: \033[32mOK\e[0m\n", argv[0]);
+
+	return EXIT_SUCCESS;
+}
diff --git a/tests/test-script.sh b/tests/test-script.sh
index 743e514da698..2bd7ef0e6716 100755
--- a/tests/test-script.sh
+++ b/tests/test-script.sh
@@ -19,6 +19,7 @@
 ./nft-expr_range-test
 ./nft-expr_redir-test
 ./nft-expr_nat-test
+./nft-expr_objref-test
 ./nft-expr_payload-test
 ./nft-expr_quota-test
 ./nft-expr_reject-test
-- 
2.1.4


^ permalink raw reply related	[flat|nested] 7+ messages in thread

* [PATCH libnftnl 4/7] set: add NFTNL_SET_OBJ_TYPE attribute
  2016-12-09 13:31 [PATCH libnftnl 1/7] include: fetch stateful object updates for nf_tables.h cache copy Pablo Neira Ayuso
  2016-12-09 13:31 ` [PATCH libnftnl 2/7] src: support for stateful objects Pablo Neira Ayuso
  2016-12-09 13:31 ` [PATCH libnftnl 3/7] expr: add stateful object reference expression Pablo Neira Ayuso
@ 2016-12-09 13:31 ` Pablo Neira Ayuso
  2016-12-09 13:31 ` [PATCH libnftnl 5/7] set_elem: add NFTNL_SET_ELEM_OBJREF attribute Pablo Neira Ayuso
                   ` (2 subsequent siblings)
  5 siblings, 0 replies; 7+ messages in thread
From: Pablo Neira Ayuso @ 2016-12-09 13:31 UTC (permalink / raw)
  To: netfilter-devel

This new attribute specifies the stateful object type this set stores.
Similar to data type, but specific to store objects. You must set the
NFT_SET_OBJECT flag to use this.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 include/libnftnl/set.h |  1 +
 include/set.h          |  1 +
 src/set.c              | 27 +++++++++++++++++++++++++++
 3 files changed, 29 insertions(+)

diff --git a/include/libnftnl/set.h b/include/libnftnl/set.h
index adeb16c66e2b..0c978d916e4e 100644
--- a/include/libnftnl/set.h
+++ b/include/libnftnl/set.h
@@ -23,6 +23,7 @@ enum nftnl_set_attr {
 	NFTNL_SET_TIMEOUT,
 	NFTNL_SET_GC_INTERVAL,
 	NFTNL_SET_USERDATA,
+	NFTNL_SET_OBJ_TYPE,
 	__NFTNL_SET_MAX
 };
 #define NFTNL_SET_MAX (__NFTNL_SET_MAX - 1)
diff --git a/include/set.h b/include/set.h
index 85bd389a3bd8..c6deb73f54f4 100644
--- a/include/set.h
+++ b/include/set.h
@@ -14,6 +14,7 @@ struct nftnl_set {
 	uint32_t		key_len;
 	uint32_t		data_type;
 	uint32_t		data_len;
+	uint32_t		obj_type;
 	struct {
 		void		*data;
 		uint32_t	len;
diff --git a/src/set.c b/src/set.c
index a42b713c6f87..14d28b502c1d 100644
--- a/src/set.c
+++ b/src/set.c
@@ -80,6 +80,7 @@ void nftnl_set_unset(struct nftnl_set *s, uint16_t attr)
 	case NFTNL_SET_KEY_LEN:
 	case NFTNL_SET_DATA_TYPE:
 	case NFTNL_SET_DATA_LEN:
+	case NFTNL_SET_OBJ_TYPE:
 	case NFTNL_SET_FAMILY:
 	case NFTNL_SET_ID:
 	case NFTNL_SET_POLICY:
@@ -104,6 +105,7 @@ static uint32_t nftnl_set_validate[NFTNL_SET_MAX + 1] = {
 	[NFTNL_SET_KEY_LEN]		= sizeof(uint32_t),
 	[NFTNL_SET_DATA_TYPE]	= sizeof(uint32_t),
 	[NFTNL_SET_DATA_LEN]		= sizeof(uint32_t),
+	[NFTNL_SET_OBJ_TYPE]		= sizeof(uint32_t),
 	[NFTNL_SET_FAMILY]		= sizeof(uint32_t),
 	[NFTNL_SET_POLICY]		= sizeof(uint32_t),
 	[NFTNL_SET_DESC_SIZE]	= sizeof(uint32_t),
@@ -149,6 +151,9 @@ int nftnl_set_set_data(struct nftnl_set *s, uint16_t attr, const void *data,
 	case NFTNL_SET_DATA_LEN:
 		s->data_len = *((uint32_t *)data);
 		break;
+	case NFTNL_SET_OBJ_TYPE:
+		s->obj_type = *((uint32_t *)data);
+		break;
 	case NFTNL_SET_FAMILY:
 		s->family = *((uint32_t *)data);
 		break;
@@ -235,6 +240,9 @@ const void *nftnl_set_get_data(const struct nftnl_set *s, uint16_t attr,
 	case NFTNL_SET_DATA_LEN:
 		*data_len = sizeof(uint32_t);
 		return &s->data_len;
+	case NFTNL_SET_OBJ_TYPE:
+		*data_len = sizeof(uint32_t);
+		return &s->obj_type;
 	case NFTNL_SET_FAMILY:
 		*data_len = sizeof(uint32_t);
 		return &s->family;
@@ -360,6 +368,8 @@ void nftnl_set_nlmsg_build_payload(struct nlmsghdr *nlh, struct nftnl_set *s)
 		mnl_attr_put_u32(nlh, NFTA_SET_DATA_TYPE, htonl(s->data_type));
 	if (s->flags & (1 << NFTNL_SET_DATA_LEN))
 		mnl_attr_put_u32(nlh, NFTA_SET_DATA_LEN, htonl(s->data_len));
+	if (s->flags & (1 << NFTNL_SET_OBJ_TYPE))
+		mnl_attr_put_u32(nlh, NFTA_SET_OBJ_TYPE, htonl(s->obj_type));
 	if (s->flags & (1 << NFTNL_SET_ID))
 		mnl_attr_put_u32(nlh, NFTA_SET_ID, htonl(s->id));
 	if (s->flags & (1 << NFTNL_SET_POLICY))
@@ -498,6 +508,10 @@ int nftnl_set_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_set *s)
 		s->data_len = ntohl(mnl_attr_get_u32(tb[NFTA_SET_DATA_LEN]));
 		s->flags |= (1 << NFTNL_SET_DATA_LEN);
 	}
+	if (tb[NFTA_SET_OBJ_TYPE]) {
+		s->obj_type = ntohl(mnl_attr_get_u32(tb[NFTA_SET_OBJ_TYPE]));
+		s->flags |= (1 << NFTNL_SET_OBJ_TYPE);
+	}
 	if (tb[NFTA_SET_ID]) {
 		s->id = ntohl(mnl_attr_get_u32(tb[NFTA_SET_ID]));
 		s->flags |= (1 << NFTNL_SET_ID);
@@ -586,6 +600,14 @@ static int nftnl_jansson_parse_set_info(struct nftnl_set *s, json_t *tree,
 		nftnl_set_set_u32(s, NFTNL_SET_DATA_LEN, data_len);
 	}
 
+	if (nftnl_jansson_node_exist(root, "obj_type")) {
+		if (nftnl_jansson_parse_val(root, "obj_type", NFTNL_TYPE_U32,
+					  &data_type, err) < 0)
+			return -1;
+
+		nftnl_set_set_u32(s, NFTNL_SET_OBJ_TYPE, data_type);
+	}
+
 	if (nftnl_jansson_node_exist(root, "policy")) {
 		if (nftnl_jansson_parse_val(root, "policy", NFTNL_TYPE_U32,
 					  &policy, err) < 0)
@@ -759,6 +781,11 @@ static int nftnl_set_snprintf_json(char *buf, size_t size,
 		ret = snprintf(buf + offset, len, ",\"data_len\":%u", s->data_len);
 		SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
 	}
+	if (s->flags & (1 << NFTNL_SET_OBJ_TYPE)) {
+		ret = snprintf(buf + offset, len,
+				  ",\"obj_type\":%u", s->obj_type);
+		SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+	}
 
 	if (s->flags & (1 << NFTNL_SET_POLICY)) {
 		ret = snprintf(buf + offset, len, ",\"policy\":%u",
-- 
2.1.4


^ permalink raw reply related	[flat|nested] 7+ messages in thread

* [PATCH libnftnl 5/7] set_elem: add NFTNL_SET_ELEM_OBJREF attribute
  2016-12-09 13:31 [PATCH libnftnl 1/7] include: fetch stateful object updates for nf_tables.h cache copy Pablo Neira Ayuso
                   ` (2 preceding siblings ...)
  2016-12-09 13:31 ` [PATCH libnftnl 4/7] set: add NFTNL_SET_OBJ_TYPE attribute Pablo Neira Ayuso
@ 2016-12-09 13:31 ` Pablo Neira Ayuso
  2016-12-09 13:31 ` [PATCH libnftnl 6/7] expr: objref: add support for stateful object maps Pablo Neira Ayuso
  2016-12-09 13:31 ` [PATCH libnftnl 7/7] quota: support for consumed bytes Pablo Neira Ayuso
  5 siblings, 0 replies; 7+ messages in thread
From: Pablo Neira Ayuso @ 2016-12-09 13:31 UTC (permalink / raw)
  To: netfilter-devel

This new attribute allows us to attach stateful objects to elements for
map lookups. This new attribute identifies the object through its name.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 include/libnftnl/set.h |  1 +
 include/set_elem.h     |  1 +
 src/set_elem.c         | 27 +++++++++++++++++++++++++++
 3 files changed, 29 insertions(+)

diff --git a/include/libnftnl/set.h b/include/libnftnl/set.h
index 0c978d916e4e..4c59ab27946f 100644
--- a/include/libnftnl/set.h
+++ b/include/libnftnl/set.h
@@ -96,6 +96,7 @@ enum {
 	NFTNL_SET_ELEM_EXPIRATION,
 	NFTNL_SET_ELEM_USERDATA,
 	NFTNL_SET_ELEM_EXPR,
+	NFTNL_SET_ELEM_OBJREF,
 };
 
 struct nftnl_set_elem;
diff --git a/include/set_elem.h b/include/set_elem.h
index 60cecc939016..d6244e60873a 100644
--- a/include/set_elem.h
+++ b/include/set_elem.h
@@ -12,6 +12,7 @@ struct nftnl_set_elem {
 	uint32_t		flags;
 	uint64_t		timeout;
 	uint64_t		expiration;
+	const char		*objref;
 	struct {
 		void		*data;
 		uint32_t	len;
diff --git a/src/set_elem.c b/src/set_elem.c
index 083c597e2f8e..fa8747641ee0 100644
--- a/src/set_elem.c
+++ b/src/set_elem.c
@@ -50,6 +50,9 @@ void nftnl_set_elem_free(struct nftnl_set_elem *s)
 	if (s->flags & (1 << NFTNL_SET_ELEM_USERDATA))
 		xfree(s->user.data);
 
+	if (s->flags & (1 << NFTNL_SET_ELEM_OBJREF))
+		xfree(s->objref);
+
 	xfree(s);
 }
 EXPORT_SYMBOL_ALIAS(nftnl_set_elem_free, nft_set_elem_free);
@@ -82,6 +85,9 @@ void nftnl_set_elem_unset(struct nftnl_set_elem *s, uint16_t attr)
 	case NFTNL_SET_ELEM_EXPR:
 		nftnl_expr_free(s->expr);
 		break;
+	case NFTNL_SET_ELEM_OBJREF:
+		xfree(s->objref);
+		break;
 	default:
 		return;
 	}
@@ -129,6 +135,14 @@ int nftnl_set_elem_set(struct nftnl_set_elem *s, uint16_t attr,
 		memcpy(s->user.data, data, data_len);
 		s->user.len = data_len;
 		break;
+	case NFTNL_SET_ELEM_OBJREF:
+		if (s->flags & (1 << NFTNL_SET_ELEM_OBJREF))
+			xfree(s->objref);
+
+		s->objref = strdup(data);
+		if (!s->objref)
+			return -1;
+		break;
 	}
 	s->flags |= (1 << attr);
 	return -1;
@@ -185,6 +199,9 @@ const void *nftnl_set_elem_get(struct nftnl_set_elem *s, uint16_t attr, uint32_t
 		return s->user.data;
 	case NFTNL_SET_ELEM_EXPR:
 		return s->expr;
+	case NFTNL_SET_ELEM_OBJREF:
+		*data_len = strlen(s->objref) + 1;
+		return s->objref;
 	}
 	return NULL;
 }
@@ -271,6 +288,8 @@ void nftnl_set_elem_nlmsg_build_payload(struct nlmsghdr *nlh,
 	}
 	if (e->flags & (1 << NFTNL_SET_ELEM_USERDATA))
 		mnl_attr_put(nlh, NFTA_SET_ELEM_USERDATA, e->user.len, e->user.data);
+	if (e->flags & (1 << NFTNL_SET_ELEM_OBJREF))
+		mnl_attr_put_strz(nlh, NFTA_SET_ELEM_OBJREF, e->objref);
 }
 
 static void nftnl_set_elem_nlmsg_build_def(struct nlmsghdr *nlh,
@@ -423,6 +442,14 @@ static int nftnl_set_elems_parse2(struct nftnl_set *s, const struct nlattr *nest
 		memcpy(e->user.data, udata, e->user.len);
 		e->flags |= (1 << NFTNL_RULE_USERDATA);
 	}
+	if (tb[NFTA_SET_ELEM_OBJREF]) {
+		e->objref = strdup(mnl_attr_get_str(tb[NFTA_SET_ELEM_OBJREF]));
+		if (e->objref == NULL) {
+			ret = -1;
+			goto out_set_elem;
+		}
+		e->flags |= (1 << NFTNL_SET_ELEM_OBJREF);
+	}
 
 	/* Add this new element to this set */
 	list_add_tail(&e->head, &s->element_list);
-- 
2.1.4


^ permalink raw reply related	[flat|nested] 7+ messages in thread

* [PATCH libnftnl 6/7] expr: objref: add support for stateful object maps
  2016-12-09 13:31 [PATCH libnftnl 1/7] include: fetch stateful object updates for nf_tables.h cache copy Pablo Neira Ayuso
                   ` (3 preceding siblings ...)
  2016-12-09 13:31 ` [PATCH libnftnl 5/7] set_elem: add NFTNL_SET_ELEM_OBJREF attribute Pablo Neira Ayuso
@ 2016-12-09 13:31 ` Pablo Neira Ayuso
  2016-12-09 13:31 ` [PATCH libnftnl 7/7] quota: support for consumed bytes Pablo Neira Ayuso
  5 siblings, 0 replies; 7+ messages in thread
From: Pablo Neira Ayuso @ 2016-12-09 13:31 UTC (permalink / raw)
  To: netfilter-devel

If the NFT_SET_OBJECT flag is set, then this set stores a mapping
between any random user-defined arbitrary key and one stateful object.
Very useful for performance lookups.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 include/libnftnl/expr.h |  3 +++
 src/expr/objref.c       | 72 +++++++++++++++++++++++++++++++++++++++++++++++--
 2 files changed, 73 insertions(+), 2 deletions(-)

diff --git a/include/libnftnl/expr.h b/include/libnftnl/expr.h
index f6ea69dfacae..ee0784928550 100644
--- a/include/libnftnl/expr.h
+++ b/include/libnftnl/expr.h
@@ -237,6 +237,9 @@ enum {
 enum {
 	NFTNL_EXPR_OBJREF_IMM_TYPE	= NFTNL_EXPR_BASE,
 	NFTNL_EXPR_OBJREF_IMM_NAME,
+	NFTNL_EXPR_OBJREF_SET_SREG,
+	NFTNL_EXPR_OBJREF_SET_NAME,
+	NFTNL_EXPR_OBJREF_SET_ID,
 };
 
 /*
diff --git a/src/expr/objref.c b/src/expr/objref.c
index 01bea7b8b4b1..4cfa3cbfbd2b 100644
--- a/src/expr/objref.c
+++ b/src/expr/objref.c
@@ -25,6 +25,11 @@ struct nftnl_expr_objref {
 		uint32_t	type;
 		const char	*name;
 	} imm;
+	struct {
+		uint32_t	sreg;
+		const char	*name;
+		uint32_t	id;
+	} set;
 };
 
 static int nftnl_expr_objref_set(struct nftnl_expr *e, uint16_t type,
@@ -41,6 +46,17 @@ static int nftnl_expr_objref_set(struct nftnl_expr *e, uint16_t type,
 		if (!objref->imm.name)
 			return -1;
 		break;
+	case NFTNL_EXPR_OBJREF_SET_SREG:
+		objref->set.sreg = *((uint32_t *)data);
+		break;
+	case NFTNL_EXPR_OBJREF_SET_NAME:
+		objref->set.name = strdup(data);
+		if (!objref->set.name)
+			return -1;
+		break;
+	case NFTNL_EXPR_OBJREF_SET_ID:
+		objref->set.id = *((uint32_t *)data);
+		break;
 	default:
 		return -1;
 	}
@@ -59,6 +75,15 @@ static const void *nftnl_expr_objref_get(const struct nftnl_expr *e,
 	case NFTNL_EXPR_OBJREF_IMM_NAME:
 		*data_len = strlen(objref->imm.name) + 1;
 		return objref->imm.name;
+	case NFTNL_EXPR_OBJREF_SET_SREG:
+		*data_len = sizeof(objref->set.sreg);
+		return &objref->set.sreg;
+	case NFTNL_EXPR_OBJREF_SET_NAME:
+		*data_len = strlen(objref->set.name) + 1;
+		return objref->set.name;
+	case NFTNL_EXPR_OBJREF_SET_ID:
+		*data_len = sizeof(objref->set.id);
+		return &objref->set.id;
 	}
 	return NULL;
 }
@@ -77,9 +102,15 @@ static int nftnl_expr_objref_cb(const struct nlattr *attr, void *data)
 			abi_breakage();
 		break;
 	case NFTA_OBJREF_IMM_NAME:
+	case NFTA_OBJREF_SET_NAME:
 		if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
 			abi_breakage();
 		break;
+	case NFTA_OBJREF_SET_SREG:
+	case NFTA_OBJREF_SET_ID:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
 	}
 
 	tb[type] = attr;
@@ -96,6 +127,14 @@ static void nftnl_expr_objref_build(struct nlmsghdr *nlh,
 				 htonl(objref->imm.type));
 	if (e->flags & (1 << NFTNL_EXPR_OBJREF_IMM_NAME))
 		mnl_attr_put_str(nlh, NFTA_OBJREF_IMM_NAME, objref->imm.name);
+	if (e->flags & (1 << NFTNL_EXPR_OBJREF_SET_SREG))
+		mnl_attr_put_u32(nlh, NFTA_OBJREF_SET_SREG,
+				 htonl(objref->set.sreg));
+	if (e->flags & (1 << NFTNL_EXPR_OBJREF_SET_NAME))
+		mnl_attr_put_str(nlh, NFTA_OBJREF_SET_NAME, objref->set.name);
+	if (e->flags & (1 << NFTNL_EXPR_OBJREF_SET_ID))
+		mnl_attr_put_u32(nlh, NFTA_OBJREF_SET_ID,
+				 htonl(objref->set.id));
 }
 
 static int nftnl_expr_objref_parse(struct nftnl_expr *e, struct nlattr *attr)
@@ -116,6 +155,21 @@ static int nftnl_expr_objref_parse(struct nftnl_expr *e, struct nlattr *attr)
 			strdup(mnl_attr_get_str(tb[NFTA_OBJREF_IMM_NAME]));
 		e->flags |= (1 << NFTNL_EXPR_OBJREF_IMM_NAME);
 	}
+	if (tb[NFTA_OBJREF_SET_SREG]) {
+		objref->set.sreg =
+			ntohl(mnl_attr_get_u32(tb[NFTA_OBJREF_SET_SREG]));
+		e->flags |= (1 << NFTNL_EXPR_OBJREF_SET_SREG);
+	}
+	if (tb[NFTA_OBJREF_SET_NAME]) {
+		objref->set.name =
+			strdup(mnl_attr_get_str(tb[NFTA_OBJREF_SET_NAME]));
+		e->flags |= (1 << NFTNL_EXPR_OBJREF_SET_NAME);
+	}
+	if (tb[NFTA_OBJREF_SET_ID]) {
+		objref->set.id =
+			ntohl(mnl_attr_get_u32(tb[NFTA_OBJREF_SET_ID]));
+		e->flags |= (1 << NFTNL_EXPR_OBJREF_SET_ID);
+	}
 
 	return 0;
 }
@@ -157,6 +211,10 @@ static int nftnl_expr_objref_export(char *buf, size_t size,
 		nftnl_buf_u32(&b, type, objref->imm.type, BYTES);
 	if (e->flags & (1 << NFTNL_EXPR_OBJREF_IMM_NAME))
 		nftnl_buf_str(&b, type, objref->imm.name, NAME);
+	if (e->flags & (1 << NFTNL_EXPR_OBJREF_SET_SREG))
+		nftnl_buf_u32(&b, type, objref->set.sreg, SREG);
+	if (e->flags & (1 << NFTNL_EXPR_OBJREF_SET_NAME))
+		nftnl_buf_str(&b, type, objref->set.name, SET);
 
 	return nftnl_buf_done(&b);
 }
@@ -166,8 +224,12 @@ static int nftnl_expr_objref_snprintf_default(char *buf, size_t len,
 {
 	struct nftnl_expr_objref *objref = nftnl_expr_data(e);
 
-	return snprintf(buf, len, "type %u name %s ",
-			objref->imm.type, objref->imm.name);
+	if (e->flags & (1 << NFTNL_EXPR_OBJREF_SET_SREG))
+		return snprintf(buf, len, "sreg %u set %s id %u ",
+				objref->set.sreg, objref->set.name, objref->set.id);
+	else
+		return snprintf(buf, len, "type %u name %s ",
+				objref->imm.type, objref->imm.name);
 }
 
 static int nftnl_expr_objref_snprintf(char *buf, size_t len, uint32_t type,
@@ -197,6 +259,12 @@ static bool nftnl_expr_objref_cmp(const struct nftnl_expr *e1,
 		eq &= (c1->imm.type == c2->imm.type);
 	if (e1->flags & (1 << NFTNL_EXPR_OBJREF_IMM_NAME))
 		eq &= !strcmp(c1->imm.name, c2->imm.name);
+	if (e1->flags & (1 << NFTNL_EXPR_OBJREF_SET_SREG))
+		eq &= (c1->set.sreg == c2->set.sreg);
+	if (e1->flags & (1 << NFTNL_EXPR_OBJREF_SET_NAME))
+		eq &= !strcmp(c1->set.name, c2->set.name);
+	if (e1->flags & (1 << NFTNL_EXPR_OBJREF_SET_ID))
+		eq &= (c1->set.id == c2->set.id);
 
 	return eq;
 }
-- 
2.1.4


^ permalink raw reply related	[flat|nested] 7+ messages in thread

* [PATCH libnftnl 7/7] quota: support for consumed bytes
  2016-12-09 13:31 [PATCH libnftnl 1/7] include: fetch stateful object updates for nf_tables.h cache copy Pablo Neira Ayuso
                   ` (4 preceding siblings ...)
  2016-12-09 13:31 ` [PATCH libnftnl 6/7] expr: objref: add support for stateful object maps Pablo Neira Ayuso
@ 2016-12-09 13:31 ` Pablo Neira Ayuso
  5 siblings, 0 replies; 7+ messages in thread
From: Pablo Neira Ayuso @ 2016-12-09 13:31 UTC (permalink / raw)
  To: netfilter-devel

This patch extends the quota support to account for consumed bytes.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 include/libnftnl/expr.h |  1 +
 src/expr/quota.c        | 26 +++++++++++++++++++++++---
 2 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/include/libnftnl/expr.h b/include/libnftnl/expr.h
index ee0784928550..74e986de6b4b 100644
--- a/include/libnftnl/expr.h
+++ b/include/libnftnl/expr.h
@@ -196,6 +196,7 @@ enum {
 enum {
 	NFTNL_EXPR_QUOTA_BYTES	= NFTNL_EXPR_BASE,
 	NFTNL_EXPR_QUOTA_FLAGS,
+	NFTNL_EXPR_QUOTA_CONSUMED,
 };
 
 enum {
diff --git a/src/expr/quota.c b/src/expr/quota.c
index 7740b24c45f3..667e6e17c28c 100644
--- a/src/expr/quota.c
+++ b/src/expr/quota.c
@@ -22,6 +22,7 @@
 
 struct nftnl_expr_quota {
 	uint64_t	bytes;
+	uint64_t	consumed;
 	uint32_t	flags;
 };
 
@@ -34,6 +35,9 @@ static int nftnl_expr_quota_set(struct nftnl_expr *e, uint16_t type,
 	case NFTNL_EXPR_QUOTA_BYTES:
 		quota->bytes = *((uint64_t *)data);
 		break;
+	case NFTNL_EXPR_QUOTA_CONSUMED:
+		quota->consumed = *((uint64_t *)data);
+		break;
 	case NFTNL_EXPR_QUOTA_FLAGS:
 		quota->flags = *((uint32_t *)data);
 		break;
@@ -52,6 +56,9 @@ static const void *nftnl_expr_quota_get(const struct nftnl_expr *e,
 	case NFTNL_EXPR_QUOTA_BYTES:
 		*data_len = sizeof(quota->bytes);
 		return &quota->bytes;
+	case NFTNL_EXPR_QUOTA_CONSUMED:
+		*data_len = sizeof(quota->consumed);
+		return &quota->consumed;
 	case NFTNL_EXPR_QUOTA_FLAGS:
 		*data_len = sizeof(quota->flags);
 		return &quota->flags;
@@ -69,6 +76,7 @@ static int nftnl_expr_quota_cb(const struct nlattr *attr, void *data)
 
 	switch(type) {
 	case NFTA_QUOTA_BYTES:
+	case NFTA_QUOTA_CONSUMED:
 		if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
 			abi_breakage();
 		break;
@@ -89,6 +97,8 @@ nftnl_expr_quota_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
 
 	if (e->flags & (1 << NFTNL_EXPR_QUOTA_BYTES))
 		mnl_attr_put_u64(nlh, NFTA_QUOTA_BYTES, htobe64(quota->bytes));
+	if (e->flags & (1 << NFTNL_EXPR_QUOTA_CONSUMED))
+		mnl_attr_put_u64(nlh, NFTA_QUOTA_CONSUMED, htobe64(quota->consumed));
 	if (e->flags & (1 << NFTNL_EXPR_QUOTA_FLAGS))
 		mnl_attr_put_u32(nlh, NFTA_QUOTA_FLAGS, htonl(quota->flags));
 }
@@ -106,6 +116,10 @@ nftnl_expr_quota_parse(struct nftnl_expr *e, struct nlattr *attr)
 		quota->bytes = be64toh(mnl_attr_get_u64(tb[NFTA_QUOTA_BYTES]));
 		e->flags |= (1 << NFTNL_EXPR_QUOTA_BYTES);
 	}
+	if (tb[NFTA_QUOTA_CONSUMED]) {
+		quota->consumed = be64toh(mnl_attr_get_u64(tb[NFTA_QUOTA_CONSUMED]));
+		e->flags |= (1 << NFTNL_EXPR_QUOTA_CONSUMED);
+	}
 	if (tb[NFTA_QUOTA_FLAGS]) {
 		quota->flags = ntohl(mnl_attr_get_u32(tb[NFTA_QUOTA_FLAGS]));
 		e->flags |= (1 << NFTNL_EXPR_QUOTA_FLAGS);
@@ -119,12 +133,15 @@ nftnl_expr_quota_json_parse(struct nftnl_expr *e, json_t *root,
 				 struct nftnl_parse_err *err)
 {
 #ifdef JSON_PARSING
-	uint64_t bytes;
+	uint64_t bytes, consumed;
 	uint32_t flags;
 
 	if (nftnl_jansson_parse_val(root, "bytes", NFTNL_TYPE_U64, &bytes,
 				  err) == 0)
 		nftnl_expr_set_u64(e, NFTNL_EXPR_QUOTA_BYTES, bytes);
+	if (nftnl_jansson_parse_val(root, "consumed", NFTNL_TYPE_U64, &consumed,
+				  err) == 0)
+		nftnl_expr_set_u64(e, NFTNL_EXPR_QUOTA_CONSUMED, consumed);
 	if (nftnl_jansson_parse_val(root, "flags", NFTNL_TYPE_U32, &flags,
 				  err) == 0)
 		nftnl_expr_set_u32(e, NFTNL_EXPR_QUOTA_FLAGS, flags);
@@ -144,6 +161,8 @@ static int nftnl_expr_quota_export(char *buf, size_t size,
 
 	if (e->flags & (1 << NFTNL_EXPR_QUOTA_BYTES))
 		nftnl_buf_u64(&b, type, quota->bytes, BYTES);
+	if (e->flags & (1 << NFTNL_EXPR_QUOTA_CONSUMED))
+		nftnl_buf_u64(&b, type, quota->consumed, CONSUMED);
 	if (e->flags & (1 << NFTNL_EXPR_QUOTA_FLAGS))
 		nftnl_buf_u32(&b, type, quota->flags, FLAGS);
 
@@ -155,8 +174,9 @@ static int nftnl_expr_quota_snprintf_default(char *buf, size_t len,
 {
 	struct nftnl_expr_quota *quota = nftnl_expr_data(e);
 
-	return snprintf(buf, len, "bytes %"PRIu64" flags %u ",
-			quota->bytes, quota->flags);
+	return snprintf(buf, len,
+			"bytes %"PRIu64" consumed %"PRIu64" flags %u ",
+			quota->bytes, quota->consumed, quota->flags);
 }
 
 static int nftnl_expr_quota_snprintf(char *buf, size_t len, uint32_t type,
-- 
2.1.4


^ permalink raw reply related	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2016-12-09 13:32 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-12-09 13:31 [PATCH libnftnl 1/7] include: fetch stateful object updates for nf_tables.h cache copy Pablo Neira Ayuso
2016-12-09 13:31 ` [PATCH libnftnl 2/7] src: support for stateful objects Pablo Neira Ayuso
2016-12-09 13:31 ` [PATCH libnftnl 3/7] expr: add stateful object reference expression Pablo Neira Ayuso
2016-12-09 13:31 ` [PATCH libnftnl 4/7] set: add NFTNL_SET_OBJ_TYPE attribute Pablo Neira Ayuso
2016-12-09 13:31 ` [PATCH libnftnl 5/7] set_elem: add NFTNL_SET_ELEM_OBJREF attribute Pablo Neira Ayuso
2016-12-09 13:31 ` [PATCH libnftnl 6/7] expr: objref: add support for stateful object maps Pablo Neira Ayuso
2016-12-09 13:31 ` [PATCH libnftnl 7/7] quota: support for consumed bytes Pablo Neira Ayuso

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).