libnftnl adding element to a set of type ipv4_addr or ipv6_addr

libnftnl adding element to a set of type ipv4_addr or ipv6_addr

[Easynet]

Hi,

I'm building a small firewall daemon that it receives if an user is 
authenticated and then is adding his IP in a set to be allowed for 24h.
I'm new in nftnl library and I started to read the documentation and 
also the examples.

Until now I was able to add in my daemon these tools based on libnftnl:

- create / delete / get tables
- create / delete chains
- create / delete sets.

Right now I'm facing an issue that I can't understand how to build the 
nftnl packet for adding an element to my set, which has interval and 
timeout flags.

The function I'm using it looks very similar to one in libnftnl, with 
modifications:

/*
* Set add element
*/
int32_t nft_set_element_add(char *req_family, char *table_name, char 
*set_name, char *element)
{
     struct mnl_socket *nl;
     char buf[MNL_SOCKET_BUFFER_SIZE];
     struct mnl_nlmsg_batch *batch;
     struct nlmsghdr *nlh;
     uint32_t portid, seq, family;
     struct nftnl_set *s;
     struct nftnl_set_elem *e;
     uint16_t data;
     uint32_t mask;
     uint32_t data32;
     uint64_t data64;
     uint64_t timeout;

     char strAddr[32];

     in_addr_t ipv4;

     int ret;

     s = nftnl_set_alloc();
     if (s == NULL) {
         perror("OOM");
         exit(EXIT_FAILURE);
     }

     seq = time(NULL);

     family = nft_check_table_family(req_family);

     nftnl_set_set_str(s, NFTNL_SET_TABLE, table_name);
     nftnl_set_set_str(s, NFTNL_SET_NAME, set_name);

     /* Add to dummy elements to set */
     e = nftnl_set_elem_alloc();
     if (e == NULL) {
         perror("OOM");
         exit(EXIT_FAILURE);
     }

     strcpy(strAddr, "192.168.10.10");

     ipv4 = inet_addr(strAddr);
     printf("IPv4: %u\n", ipv4);
     //timeout = 3600;

     nftnl_set_elem_set(e, NFTNL_SET_ELEM_KEY, &ipv4, sizeof(ipv4));
     //nftnl_set_elem_set(e, NFTNL_SET_ELEM_TIMEOUT, &timeout , 
sizeof(timeout));
     nftnl_set_elem_add(s, e);

     batch = mnl_nlmsg_batch_start(buf, sizeof(buf));

     nftnl_batch_begin(mnl_nlmsg_batch_current(batch), seq++);
     mnl_nlmsg_batch_next(batch);

     nlh = nftnl_nlmsg_build_hdr(mnl_nlmsg_batch_current(batch),
                     NFT_MSG_NEWSETELEM, family,
                     NLM_F_CREATE | NLM_F_EXCL | NLM_F_ACK,
                     seq++);
     nftnl_set_elems_nlmsg_build_payload(nlh, s);
     nftnl_set_free(s);
     mnl_nlmsg_batch_next(batch);

     nftnl_batch_end(mnl_nlmsg_batch_current(batch), seq++);
     mnl_nlmsg_batch_next(batch);

     nl = mnl_socket_open(NETLINK_NETFILTER);
     if (nl == NULL) {
         perror("mnl_socket_open");
         exit(EXIT_FAILURE);
     }

     if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) {
         perror("mnl_socket_bind");
         exit(EXIT_FAILURE);
     }
     portid = mnl_socket_get_portid(nl);

     if (mnl_socket_sendto(nl, mnl_nlmsg_batch_head(batch),
                   mnl_nlmsg_batch_size(batch)) < 0) {
         perror("mnl_socket_send");
         return(EXIT_FAILURE);
     }

     mnl_nlmsg_batch_stop(batch);

     ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
     while (ret > 0) {
         ret = mnl_cb_run(buf, ret, 0, portid, NULL, NULL);
         if (ret <= 0)
             break;
         ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
     }
     if (ret == -1) {
         perror("error");
         return EXIT_FAILURE;
     }
     mnl_socket_close(nl);

     return EXIT_SUCCESS;
}

I was able to add timeout flag for the IP, but the IP is added as a range:

         set IPTVv4_ALLOW {
                 type ipv4_addr
                 flags interval,timeout
                 elements = { 192.168.10.10-255.255.255.255 }
         }


I couldn't find too much information in the documentation or looking 
into the nftables code or Linux Kernel. For me are too complicated to 
understand the logic behind.
Can somebody advice me how can I implement the nflnl message correctly 
to be able to add just the host for example? Or where I can find the 
info about how nftnl message should be created?

Kind regards.

Re: libnftnl adding element to a set of type ipv4_addr or ipv6_addr

[Phil Sutter]

Hi,

On Tue, Jul 18, 2023 at 09:02:02PM +0200, Easynet wrote:
> I'm building a small firewall daemon that it receives if an user is 
> authenticated and then is adding his IP in a set to be allowed for 24h.
> I'm new in nftnl library and I started to read the documentation and 
> also the examples.
> 
> Until now I was able to add in my daemon these tools based on libnftnl:
> 
> - create / delete / get tables
> - create / delete chains
> - create / delete sets.
> 
> Right now I'm facing an issue that I can't understand how to build the 
> nftnl packet for adding an element to my set, which has interval and 
> timeout flags.

With libnftnl, source is documentation. Go check nftables code on how to
use it. If you need a simpler interface to nftables, I highly recommend
using libnftables instead. You'll either have to pass strings or use a
JSON library for structured in- and output. For simple things such as
adding an element to a set, it more or less boils down to:

| struct nft_ctx *ctx = nft_ctx_new(NFT_CTX_DEFAULT);
| nft_run_cmd_from_buffer(ctx, "add element mytable myset { 123 }");
| nft_ctx_free(ctx);

Cheers, Phil

Re: libnftnl adding element to a set of type ipv4_addr or ipv6_addr

[Easynet]

Hi Phil,

Thanks for the answer. That's a very good idea. Today I saw the example 
sources of nftables using nft_run_cmd_from_buffer and I was wondering 
perhaps if I can use this function somehow.
I will simplify my code a lot. It will not be necessary to build all 
code for my mini-firewall tool and I think the foot print will be reduced.

Thanks for the idea!

Cheers.

On 7/19/2023 12:53 PM, Phil Sutter wrote:
> Hi,
>
> On Tue, Jul 18, 2023 at 09:02:02PM +0200, Easynet wrote:
>> I'm building a small firewall daemon that it receives if an user is
>> authenticated and then is adding his IP in a set to be allowed for 24h.
>> I'm new in nftnl library and I started to read the documentation and
>> also the examples.
>>
>> Until now I was able to add in my daemon these tools based on libnftnl:
>>
>> - create / delete / get tables
>> - create / delete chains
>> - create / delete sets.
>>
>> Right now I'm facing an issue that I can't understand how to build the
>> nftnl packet for adding an element to my set, which has interval and
>> timeout flags.
> With libnftnl, source is documentation. Go check nftables code on how to
> use it. If you need a simpler interface to nftables, I highly recommend
> using libnftables instead. You'll either have to pass strings or use a
> JSON library for structured in- and output. For simple things such as
> adding an element to a set, it more or less boils down to:
>
> | struct nft_ctx *ctx = nft_ctx_new(NFT_CTX_DEFAULT);
> | nft_run_cmd_from_buffer(ctx, "add element mytable myset { 123 }");
> | nft_ctx_free(ctx);
>
> Cheers, Phil