* [PATCH libnftnl 1/3] common: get rid of nftnl_batch_build_hdr()
@ 2017-02-15 10:43 Pablo Neira Ayuso
2017-02-15 10:43 ` [PATCH libnftnl 2/3] common: return nlmsghdr in nftnl_batch_{begin,end}() Pablo Neira Ayuso
2017-02-15 10:43 ` [PATCH libnftnl 3/3] rule: add NFTA_RULE_ID attribute Pablo Neira Ayuso
0 siblings, 2 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2017-02-15 10:43 UTC (permalink / raw)
To: netfilter-devel
Add __nftnl_nlmsg_build_hdr() so nftnl_batch_build_hdr() and
nftnl_nlmsg_build_hdr() share the same code.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/libnftnl/common.h | 4 ++--
src/common.c | 41 ++++++++++++++++++-----------------------
2 files changed, 20 insertions(+), 25 deletions(-)
diff --git a/include/libnftnl/common.h b/include/libnftnl/common.h
index b9c6ff3e2e54..f67f1866560f 100644
--- a/include/libnftnl/common.h
+++ b/include/libnftnl/common.h
@@ -41,8 +41,8 @@ enum nftnl_parse_type {
struct nftnl_parse_err;
-struct nlmsghdr *nftnl_nlmsg_build_hdr(char *buf, uint16_t cmd, uint16_t family,
- uint16_t type, uint32_t seq);
+struct nlmsghdr *nftnl_nlmsg_build_hdr(char *buf, uint16_t type, uint16_t family,
+ uint16_t flags, uint32_t seq);
struct nftnl_parse_err *nftnl_parse_err_alloc(void);
void nftnl_parse_err_free(struct nftnl_parse_err *);
diff --git a/src/common.c b/src/common.c
index 8b001fe8da97..0f23785e05d3 100644
--- a/src/common.c
+++ b/src/common.c
@@ -22,24 +22,33 @@
#include <errno.h>
#include "internal.h"
-struct nlmsghdr *nftnl_nlmsg_build_hdr(char *buf, uint16_t cmd, uint16_t family,
- uint16_t type, uint32_t seq)
+static struct nlmsghdr *__nftnl_nlmsg_build_hdr(char *buf, uint16_t type,
+ uint16_t family,
+ uint16_t flags, uint32_t seq,
+ uint16_t res_id)
{
struct nlmsghdr *nlh;
struct nfgenmsg *nfh;
nlh = mnl_nlmsg_put_header(buf);
- nlh->nlmsg_type = (NFNL_SUBSYS_NFTABLES << 8) | cmd;
- nlh->nlmsg_flags = NLM_F_REQUEST | type;
+ nlh->nlmsg_type = type;
+ nlh->nlmsg_flags = NLM_F_REQUEST | flags;
nlh->nlmsg_seq = seq;
nfh = mnl_nlmsg_put_extra_header(nlh, sizeof(struct nfgenmsg));
nfh->nfgen_family = family;
nfh->version = NFNETLINK_V0;
- nfh->res_id = 0;
+ nfh->res_id = res_id;
return nlh;
}
+
+struct nlmsghdr *nftnl_nlmsg_build_hdr(char *buf, uint16_t type, uint16_t family,
+ uint16_t flags, uint32_t seq)
+{
+ return __nftnl_nlmsg_build_hdr(buf, (NFNL_SUBSYS_NFTABLES << 8) | type,
+ family, flags, seq, 0);
+}
EXPORT_SYMBOL(nftnl_nlmsg_build_hdr);
struct nftnl_parse_err *nftnl_parse_err_alloc(void)
@@ -156,31 +165,17 @@ int nftnl_cmd_footer_fprintf(FILE *fp, uint32_t cmd, uint32_t type,
nftnl_cmd_footer_fprintf_cb);
}
-static void nftnl_batch_build_hdr(char *buf, uint16_t type, uint32_t seq)
-{
- struct nlmsghdr *nlh;
- struct nfgenmsg *nfg;
-
- nlh = mnl_nlmsg_put_header(buf);
- nlh->nlmsg_type = type;
- nlh->nlmsg_flags = NLM_F_REQUEST;
- nlh->nlmsg_seq = seq;
-
- nfg = mnl_nlmsg_put_extra_header(nlh, sizeof(*nfg));
- nfg->nfgen_family = AF_UNSPEC;
- nfg->version = NFNETLINK_V0;
- nfg->res_id = NFNL_SUBSYS_NFTABLES;
-}
-
void nftnl_batch_begin(char *buf, uint32_t seq)
{
- nftnl_batch_build_hdr(buf, NFNL_MSG_BATCH_BEGIN, seq);
+ __nftnl_nlmsg_build_hdr(buf, NFNL_MSG_BATCH_BEGIN, AF_UNSPEC, 0, seq,
+ NFNL_SUBSYS_NFTABLES);
}
EXPORT_SYMBOL(nftnl_batch_begin);
void nftnl_batch_end(char *buf, uint32_t seq)
{
- nftnl_batch_build_hdr(buf, NFNL_MSG_BATCH_END, seq);
+ __nftnl_nlmsg_build_hdr(buf, NFNL_MSG_BATCH_END, AF_UNSPEC, 0, seq,
+ NFNL_SUBSYS_NFTABLES);
}
EXPORT_SYMBOL(nftnl_batch_end);
--
2.1.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH libnftnl 2/3] common: return nlmsghdr in nftnl_batch_{begin,end}()
2017-02-15 10:43 [PATCH libnftnl 1/3] common: get rid of nftnl_batch_build_hdr() Pablo Neira Ayuso
@ 2017-02-15 10:43 ` Pablo Neira Ayuso
2017-02-15 10:43 ` [PATCH libnftnl 3/3] rule: add NFTA_RULE_ID attribute Pablo Neira Ayuso
1 sibling, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2017-02-15 10:43 UTC (permalink / raw)
To: netfilter-devel
Useful to append netlink attributes after the batch headers.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/libnftnl/common.h | 4 ++--
src/common.c | 12 ++++++------
2 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/include/libnftnl/common.h b/include/libnftnl/common.h
index f67f1866560f..62c8f6b5e0a3 100644
--- a/include/libnftnl/common.h
+++ b/include/libnftnl/common.h
@@ -49,7 +49,7 @@ void nftnl_parse_err_free(struct nftnl_parse_err *);
int nftnl_parse_perror(const char *str, struct nftnl_parse_err *err);
int nftnl_batch_is_supported(void);
-void nftnl_batch_begin(char *buf, uint32_t seq);
-void nftnl_batch_end(char *buf, uint32_t seq);
+struct nlmsghdr *nftnl_batch_begin(char *buf, uint32_t seq);
+struct nlmsghdr *nftnl_batch_end(char *buf, uint32_t seq);
#endif
diff --git a/src/common.c b/src/common.c
index 0f23785e05d3..a95883c19080 100644
--- a/src/common.c
+++ b/src/common.c
@@ -165,17 +165,17 @@ int nftnl_cmd_footer_fprintf(FILE *fp, uint32_t cmd, uint32_t type,
nftnl_cmd_footer_fprintf_cb);
}
-void nftnl_batch_begin(char *buf, uint32_t seq)
+struct nlmsghdr *nftnl_batch_begin(char *buf, uint32_t seq)
{
- __nftnl_nlmsg_build_hdr(buf, NFNL_MSG_BATCH_BEGIN, AF_UNSPEC, 0, seq,
- NFNL_SUBSYS_NFTABLES);
+ return __nftnl_nlmsg_build_hdr(buf, NFNL_MSG_BATCH_BEGIN, AF_UNSPEC,
+ 0, seq, NFNL_SUBSYS_NFTABLES);
}
EXPORT_SYMBOL(nftnl_batch_begin);
-void nftnl_batch_end(char *buf, uint32_t seq)
+struct nlmsghdr *nftnl_batch_end(char *buf, uint32_t seq)
{
- __nftnl_nlmsg_build_hdr(buf, NFNL_MSG_BATCH_END, AF_UNSPEC, 0, seq,
- NFNL_SUBSYS_NFTABLES);
+ return __nftnl_nlmsg_build_hdr(buf, NFNL_MSG_BATCH_END, AF_UNSPEC,
+ 0, seq, NFNL_SUBSYS_NFTABLES);
}
EXPORT_SYMBOL(nftnl_batch_end);
--
2.1.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH libnftnl 3/3] rule: add NFTA_RULE_ID attribute
2017-02-15 10:43 [PATCH libnftnl 1/3] common: get rid of nftnl_batch_build_hdr() Pablo Neira Ayuso
2017-02-15 10:43 ` [PATCH libnftnl 2/3] common: return nlmsghdr in nftnl_batch_{begin,end}() Pablo Neira Ayuso
@ 2017-02-15 10:43 ` Pablo Neira Ayuso
1 sibling, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2017-02-15 10:43 UTC (permalink / raw)
To: netfilter-devel
This patch adds the new NFTA_RULE_ID attribute.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/libnftnl/rule.h | 1 +
include/linux/netfilter/nf_tables.h | 2 ++
src/rule.c | 38 ++++++++++++++++++++++++++++++++++++-
3 files changed, 40 insertions(+), 1 deletion(-)
diff --git a/include/libnftnl/rule.h b/include/libnftnl/rule.h
index ae329d22d09c..947994364bd8 100644
--- a/include/libnftnl/rule.h
+++ b/include/libnftnl/rule.h
@@ -27,6 +27,7 @@ enum nftnl_rule_attr {
NFTNL_RULE_COMPAT_FLAGS,
NFTNL_RULE_POSITION,
NFTNL_RULE_USERDATA,
+ NFTNL_RULE_ID,
__NFTNL_RULE_MAX
};
#define NFTNL_RULE_MAX (__NFTNL_RULE_MAX - 1)
diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
index b00a05d1ee56..be101d1aa89c 100644
--- a/include/linux/netfilter/nf_tables.h
+++ b/include/linux/netfilter/nf_tables.h
@@ -207,6 +207,7 @@ enum nft_chain_attributes {
* @NFTA_RULE_COMPAT: compatibility specifications of the rule (NLA_NESTED: nft_rule_compat_attributes)
* @NFTA_RULE_POSITION: numeric handle of the previous rule (NLA_U64)
* @NFTA_RULE_USERDATA: user data (NLA_BINARY, NFT_USERDATA_MAXLEN)
+ * @NFTA_RULE_ID: uniquely identifies a rule in a transaction (NLA_U32)
*/
enum nft_rule_attributes {
NFTA_RULE_UNSPEC,
@@ -218,6 +219,7 @@ enum nft_rule_attributes {
NFTA_RULE_POSITION,
NFTA_RULE_USERDATA,
NFTA_RULE_PAD,
+ NFTA_RULE_ID,
__NFTA_RULE_MAX
};
#define NFTA_RULE_MAX (__NFTA_RULE_MAX - 1)
diff --git a/src/rule.c b/src/rule.c
index 02d013bbeac3..31cd3ed7dc99 100644
--- a/src/rule.c
+++ b/src/rule.c
@@ -38,6 +38,7 @@ struct nftnl_rule {
const char *chain;
uint64_t handle;
uint64_t position;
+ uint32_t id;
struct {
void *data;
uint32_t len;
@@ -105,6 +106,7 @@ void nftnl_rule_unset(struct nftnl_rule *r, uint16_t attr)
case NFTNL_RULE_COMPAT_FLAGS:
case NFTNL_RULE_POSITION:
case NFTNL_RULE_FAMILY:
+ case NFTNL_RULE_ID:
break;
case NFTNL_RULE_USERDATA:
xfree(r->user.data);
@@ -120,7 +122,8 @@ static uint32_t nftnl_rule_validate[NFTNL_RULE_MAX + 1] = {
[NFTNL_RULE_COMPAT_PROTO] = sizeof(uint32_t),
[NFTNL_RULE_COMPAT_FLAGS] = sizeof(uint32_t),
[NFTNL_RULE_FAMILY] = sizeof(uint32_t),
- [NFTNL_RULE_POSITION] = sizeof(uint64_t),
+ [NFTNL_RULE_POSITION] = sizeof(uint64_t),
+ [NFTNL_RULE_ID] = sizeof(uint32_t),
};
int nftnl_rule_set_data(struct nftnl_rule *r, uint16_t attr,
@@ -172,6 +175,9 @@ int nftnl_rule_set_data(struct nftnl_rule *r, uint16_t attr,
memcpy(r->user.data, data, data_len);
r->user.len = data_len;
break;
+ case NFTNL_RULE_ID:
+ r->id = *((uint32_t *)data);
+ break;
}
r->flags |= (1 << attr);
return 0;
@@ -233,6 +239,9 @@ const void *nftnl_rule_get_data(const struct nftnl_rule *r, uint16_t attr,
case NFTNL_RULE_USERDATA:
*data_len = r->user.len;
return r->user.data;
+ case NFTNL_RULE_ID:
+ *data_len = sizeof(uint32_t);
+ return &r->id;
}
return NULL;
}
@@ -322,6 +331,8 @@ void nftnl_rule_nlmsg_build_payload(struct nlmsghdr *nlh, struct nftnl_rule *r)
htonl(r->compat.flags));
mnl_attr_nest_end(nlh, nest);
}
+ if (r->flags & (1 << NFTNL_RULE_ID))
+ mnl_attr_put_u32(nlh, NFTA_RULE_ID, htonl(r->id));
}
EXPORT_SYMBOL(nftnl_rule_nlmsg_build_payload);
@@ -361,6 +372,10 @@ static int nftnl_rule_parse_attr_cb(const struct nlattr *attr, void *data)
if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0)
abi_breakage();
break;
+ case NFTA_RULE_ID:
+ if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+ abi_breakage();
+ break;
}
tb[type] = attr;
@@ -484,6 +499,10 @@ int nftnl_rule_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_rule *r)
memcpy(r->user.data, udata, r->user.len);
r->flags |= (1 << NFTNL_RULE_USERDATA);
}
+ if (tb[NFTA_RULE_ID]) {
+ r->id = ntohl(mnl_attr_get_u32(tb[NFTA_RULE_ID]));
+ r->flags |= (1 << NFTNL_RULE_ID);
+ }
r->family = nfg->nfgen_family;
r->flags |= (1 << NFTNL_RULE_FAMILY);
@@ -562,6 +581,13 @@ int nftnl_jansson_parse_rule(struct nftnl_rule *r, json_t *tree,
nftnl_rule_set_u64(r, NFTNL_RULE_POSITION, uval64);
}
+ if (nftnl_jansson_node_exist(root, "id")) {
+ if (nftnl_jansson_parse_val(root, "id", NFTNL_TYPE_U32,
+ &uval32, err) < 0)
+ goto err;
+ nftnl_rule_set_u32(r, NFTNL_RULE_COMPAT_PROTO, uval32);
+ }
+
array = json_object_get(root, "expr");
if (array == NULL) {
err->error = NFTNL_PARSE_EMISSINGNODE;
@@ -692,6 +718,11 @@ static int nftnl_rule_snprintf_json(char *buf, size_t size,
SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
}
+ if (r->flags & (1 << NFTNL_RULE_ID)) {
+ ret = snprintf(buf+offset, len, "\"id\":%u,", r->id);
+ SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+ }
+
ret = snprintf(buf+offset, len, "\"expr\":[");
SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
@@ -760,6 +791,11 @@ static int nftnl_rule_snprintf_default(char *buf, size_t size,
SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
}
+ if (r->flags & (1 << NFTNL_RULE_ID)) {
+ ret = snprintf(buf + offset, len, "%u ", r->id);
+ SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+ }
+
ret = snprintf(buf+offset, len, "\n");
SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
--
2.1.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-02-15 10:43 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-02-15 10:43 [PATCH libnftnl 1/3] common: get rid of nftnl_batch_build_hdr() Pablo Neira Ayuso
2017-02-15 10:43 ` [PATCH libnftnl 2/3] common: return nlmsghdr in nftnl_batch_{begin,end}() Pablo Neira Ayuso
2017-02-15 10:43 ` [PATCH libnftnl 3/3] rule: add NFTA_RULE_ID attribute Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).