From: Phil Sutter <phil@nwl.cc>
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: netfilter-devel@vger.kernel.org
Subject: [libnftnl PATCH v2] utils: Add helpers for interface name wildcards
Date: Tue, 15 Jul 2025 17:15:26 +0200 [thread overview]
Message-ID: <20250715151526.14573-1-phil@nwl.cc> (raw)
Support simple (suffix) wildcards in NFTNL_CHAIN_DEV(ICES) and
NFTA_FLOWTABLE_HOOK_DEVS identified by non-NUL-terminated strings. Add
helpers converting to and from the human-readable asterisk-suffix
notation.
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
No changes since v1 apart from a rebase onto current HEAD.
This single patch supersedes the previous series "Support wildcard
netdev hooks and events" as without NEWDEV/DELDEV kernel notifications,
this is the only change needed by libnftnl to support ifname-based
hooks.
---
include/utils.h | 4 ++++
src/chain.c | 8 +++++---
src/flowtable.c | 2 +-
src/str_array.c | 2 +-
src/utils.c | 30 ++++++++++++++++++++++++++++++
5 files changed, 41 insertions(+), 5 deletions(-)
diff --git a/include/utils.h b/include/utils.h
index 247d99d19dd7f..c8e890eae2ffd 100644
--- a/include/utils.h
+++ b/include/utils.h
@@ -6,6 +6,7 @@
#include <stdint.h>
#include <string.h>
#include <stdlib.h>
+#include <libmnl/libmnl.h>
#include <libnftnl/common.h>
#include "config.h"
@@ -83,4 +84,7 @@ int nftnl_fprintf(FILE *fpconst, const void *obj, uint32_t cmd, uint32_t type,
int nftnl_set_str_attr(const char **dptr, uint32_t *flags,
uint16_t attr, const void *data, uint32_t data_len);
+void mnl_attr_put_ifname(struct nlmsghdr *nlh, int attr, const char *ifname);
+const char *mnl_attr_get_ifname(struct nlattr *attr);
+
#endif
diff --git a/src/chain.c b/src/chain.c
index 895108cddad51..17ae5568609c4 100644
--- a/src/chain.c
+++ b/src/chain.c
@@ -457,14 +457,14 @@ void nftnl_chain_nlmsg_build_payload(struct nlmsghdr *nlh, const struct nftnl_ch
mnl_attr_put_u32(nlh, NFTA_HOOK_PRIORITY, htonl(c->prio));
if (c->flags & (1 << NFTNL_CHAIN_DEV))
- mnl_attr_put_strz(nlh, NFTA_HOOK_DEV, c->dev);
+ mnl_attr_put_ifname(nlh, NFTA_HOOK_DEV, c->dev);
else if (c->flags & (1 << NFTNL_CHAIN_DEVICES)) {
struct nlattr *nest_dev;
const char *dev;
nest_dev = mnl_attr_nest_start(nlh, NFTA_HOOK_DEVS);
nftnl_str_array_foreach(dev, &c->dev_array, i)
- mnl_attr_put_strz(nlh, NFTA_DEVICE_NAME, dev);
+ mnl_attr_put_ifname(nlh, NFTA_DEVICE_NAME, dev);
mnl_attr_nest_end(nlh, nest_dev);
}
@@ -648,7 +648,9 @@ static int nftnl_chain_parse_hook(struct nlattr *attr, struct nftnl_chain *c)
c->flags |= (1 << NFTNL_CHAIN_PRIO);
}
if (tb[NFTA_HOOK_DEV]) {
- c->dev = strdup(mnl_attr_get_str(tb[NFTA_HOOK_DEV]));
+ if (c->flags & (1 << NFTNL_CHAIN_DEV))
+ xfree(c->dev);
+ c->dev = strdup(mnl_attr_get_ifname(tb[NFTA_HOOK_DEV]));
if (!c->dev)
return -1;
c->flags |= (1 << NFTNL_CHAIN_DEV);
diff --git a/src/flowtable.c b/src/flowtable.c
index fbbe0a866368d..75e86fb6d1e55 100644
--- a/src/flowtable.c
+++ b/src/flowtable.c
@@ -299,7 +299,7 @@ void nftnl_flowtable_nlmsg_build_payload(struct nlmsghdr *nlh,
nest_dev = mnl_attr_nest_start(nlh, NFTA_FLOWTABLE_HOOK_DEVS);
nftnl_str_array_foreach(dev, &c->dev_array, i)
- mnl_attr_put_strz(nlh, NFTA_DEVICE_NAME, dev);
+ mnl_attr_put_ifname(nlh, NFTA_DEVICE_NAME, dev);
mnl_attr_nest_end(nlh, nest_dev);
}
diff --git a/src/str_array.c b/src/str_array.c
index 5669c6154d394..bb75e04cb20da 100644
--- a/src/str_array.c
+++ b/src/str_array.c
@@ -56,7 +56,7 @@ int nftnl_parse_devs(struct nftnl_str_array *sa, const struct nlattr *nest)
return -1;
mnl_attr_for_each_nested(attr, nest) {
- sa->array[sa->len] = strdup(mnl_attr_get_str(attr));
+ sa->array[sa->len] = strdup(mnl_attr_get_ifname(attr));
if (!sa->array[sa->len]) {
nftnl_str_array_clear(sa);
return -1;
diff --git a/src/utils.c b/src/utils.c
index 5f2c5bff7c650..bcace0cd72788 100644
--- a/src/utils.c
+++ b/src/utils.c
@@ -13,8 +13,11 @@
#include <errno.h>
#include <inttypes.h>
+#include <libmnl/libmnl.h>
+
#include <libnftnl/common.h>
+#include <linux/if.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nf_tables.h>
@@ -146,3 +149,30 @@ int nftnl_set_str_attr(const char **dptr, uint32_t *flags,
*flags |= (1 << attr);
return 0;
}
+
+void mnl_attr_put_ifname(struct nlmsghdr *nlh, int attr, const char *ifname)
+{
+ int len = strlen(ifname) + 1;
+
+ if (ifname[len - 2] == '*')
+ len -= 2;
+
+ mnl_attr_put(nlh, attr, len, ifname);
+}
+
+const char *mnl_attr_get_ifname(struct nlattr *attr)
+{
+ size_t slen = mnl_attr_get_payload_len(attr);
+ const char *dev = mnl_attr_get_str(attr);
+ static char buf[IFNAMSIZ];
+
+ if (dev[slen - 1] == '\0')
+ return dev;
+
+ if (slen > IFNAMSIZ - 2)
+ slen = IFNAMSIZ - 2;
+
+ memcpy(buf, dev, slen);
+ memcpy(buf + slen, "*\0", 2);
+ return buf;
+}
--
2.49.0
next reply other threads:[~2025-07-15 15:15 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-07-15 15:15 Phil Sutter [this message]
2025-07-16 9:44 ` [libnftnl PATCH v2] utils: Add helpers for interface name wildcards Florian Westphal
2025-07-16 10:01 ` Phil Sutter
2025-07-16 10:07 ` Florian Westphal
2025-07-16 10:11 ` Phil Sutter
2025-07-16 14:39 ` Pablo Neira Ayuso
2025-07-16 14:42 ` Pablo Neira Ayuso
2025-07-16 14:45 ` Pablo Neira Ayuso
2025-07-16 16:12 ` Phil Sutter
2025-07-16 14:38 ` Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250715151526.14573-1-phil@nwl.cc \
--to=phil@nwl.cc \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).