diff options
Diffstat (limited to 'package/libs/libnftnl')
3 files changed, 1704 insertions, 1 deletions
diff --git a/package/libs/libnftnl/Makefile b/package/libs/libnftnl/Makefile index fc1ee2d..149fad9 100644 --- a/package/libs/libnftnl/Makefile +++ b/package/libs/libnftnl/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=libnftnl PKG_VERSION:=1.0.9 -PKG_RELEASE:=1 +PKG_RELEASE:=2 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2 PKG_SOURCE_URL:=https://netfilter.org/projects/$(PKG_NAME)/files diff --git a/package/libs/libnftnl/patches/100-src-add-flowtable-support.patch b/package/libs/libnftnl/patches/100-src-add-flowtable-support.patch new file mode 100644 index 0000000..0d15f92 --- /dev/null +++ b/package/libs/libnftnl/patches/100-src-add-flowtable-support.patch @@ -0,0 +1,1444 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Wed, 29 Nov 2017 13:07:02 +0100 +Subject: [PATCH] src: add flowtable support + +This patch allows you to add, delete and list flowtable through the +existing netlink interface. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + create mode 100644 examples/nft-flowtable-add.c + create mode 100644 examples/nft-flowtable-del.c + create mode 100644 examples/nft-flowtable-get.c + create mode 100644 include/libnftnl/flowtable.h + create mode 100644 src/flowtable.c + +--- a/examples/Makefile.am ++++ b/examples/Makefile.am +@@ -25,6 +25,9 @@ check_PROGRAMS = nft-table-add \ + nft-obj-add \ + nft-obj-get \ + nft-obj-del \ ++ nft-flowtable-add \ ++ nft-flowtable-del \ ++ nft-flowtable-get \ + nft-ruleset-get \ + nft-ruleset-parse-file \ + nft-compat-get +@@ -104,6 +107,15 @@ nft_obj_del_LDADD = ../src/libnftnl.la $ + nft_obj_get_SOURCES = nft-obj-get.c + nft_obj_get_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS} + ++nft_flowtable_add_SOURCES = nft-flowtable-add.c ++nft_flowtable_add_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS} ++ ++nft_flowtable_del_SOURCES = nft-flowtable-del.c ++nft_flowtable_del_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS} ++ ++nft_flowtable_get_SOURCES = nft-flowtable-get.c ++nft_flowtable_get_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS} ++ + nft_ruleset_get_SOURCES = nft-ruleset-get.c + nft_ruleset_get_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS} + +--- /dev/null ++++ b/examples/nft-flowtable-add.c +@@ -0,0 +1,136 @@ ++#include <stdlib.h> ++#include <time.h> ++#include <string.h> ++#include <netinet/in.h> ++ ++#include <linux/netfilter.h> ++#include <linux/netfilter/nf_tables.h> ++ ++#include <libmnl/libmnl.h> ++#include <libnftnl/flowtable.h> ++ ++static struct nftnl_flowtable *flowtable_add_parse(int argc, char *argv[]) ++{ ++ const char *dev_array[] = { "eth0", "tap0", NULL }; ++ struct nftnl_flowtable *t; ++ int hooknum = 0; ++ ++ if (strcmp(argv[4], "ingress") == 0) ++ hooknum = NF_NETDEV_INGRESS; ++ else { ++ fprintf(stderr, "Unknown hook: %s\n", argv[4]); ++ return NULL; ++ } ++ ++ t = nftnl_flowtable_alloc(); ++ if (t == NULL) { ++ perror("OOM"); ++ return NULL; ++ } ++ nftnl_flowtable_set(t, NFTNL_FLOWTABLE_TABLE, argv[2]); ++ nftnl_flowtable_set(t, NFTNL_FLOWTABLE_NAME, argv[3]); ++ if (argc == 6) { ++ nftnl_flowtable_set_u32(t, NFTNL_FLOWTABLE_HOOKNUM, hooknum); ++ nftnl_flowtable_set_u32(t, NFTNL_FLOWTABLE_PRIO, atoi(argv[5])); ++ } ++ nftnl_flowtable_set_array(t, NFTNL_FLOWTABLE_DEVICES, dev_array); ++ ++ return t; ++} ++ ++int main(int argc, char *argv[]) ++{ ++ struct mnl_socket *nl; ++ char buf[MNL_SOCKET_BUFFER_SIZE]; ++ struct nlmsghdr *nlh; ++ uint32_t portid, seq, flowtable_seq; ++ int ret, family; ++ struct nftnl_flowtable *t; ++ struct mnl_nlmsg_batch *batch; ++ int batching; ++ ++ if (argc != 6) { ++ fprintf(stderr, "Usage: %s <family> <table> <name> <hook> <prio>\n", ++ argv[0]); ++ exit(EXIT_FAILURE); ++ } ++ ++ if (strcmp(argv[1], "ip") == 0) ++ family = NFPROTO_IPV4; ++ else if (strcmp(argv[1], "ip6") == 0) ++ family = NFPROTO_IPV6; ++ else if (strcmp(argv[1], "bridge") == 0) ++ family = NFPROTO_BRIDGE; ++ else if (strcmp(argv[1], "arp") == 0) ++ family = NFPROTO_ARP; ++ else { ++ fprintf(stderr, "Unknown family: ip, ip6, bridge, arp\n"); ++ exit(EXIT_FAILURE); ++ } ++ ++ t = flowtable_add_parse(argc, argv); ++ if (t == NULL) ++ exit(EXIT_FAILURE); ++ ++ batching = nftnl_batch_is_supported(); ++ if (batching < 0) { ++ perror("cannot talk to nfnetlink"); ++ exit(EXIT_FAILURE); ++ } ++ ++ seq = time(NULL); ++ batch = mnl_nlmsg_batch_start(buf, sizeof(buf)); ++ ++ if (batching) { ++ nftnl_batch_begin(mnl_nlmsg_batch_current(batch), seq++); ++ mnl_nlmsg_batch_next(batch); ++ } ++ ++ flowtable_seq = seq; ++ nlh = nftnl_flowtable_nlmsg_build_hdr(mnl_nlmsg_batch_current(batch), ++ NFT_MSG_NEWFLOWTABLE, family, ++ NLM_F_CREATE|NLM_F_ACK, seq++); ++ nftnl_flowtable_nlmsg_build_payload(nlh, t); ++ nftnl_flowtable_free(t); ++ mnl_nlmsg_batch_next(batch); ++ ++ if (batching) { ++ nftnl_batch_end(mnl_nlmsg_batch_current(batch), seq++); ++ mnl_nlmsg_batch_next(batch); ++ } ++ ++ nl = mnl_socket_open(NETLINK_NETFILTER); ++ if (nl == NULL) { ++ perror("mnl_socket_open"); ++ exit(EXIT_FAILURE); ++ } ++ ++ if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) { ++ perror("mnl_socket_bind"); ++ exit(EXIT_FAILURE); ++ } ++ portid = mnl_socket_get_portid(nl); ++ ++ if (mnl_socket_sendto(nl, mnl_nlmsg_batch_head(batch), ++ mnl_nlmsg_batch_size(batch)) < 0) { ++ perror("mnl_socket_send"); ++ exit(EXIT_FAILURE); ++ } ++ ++ mnl_nlmsg_batch_stop(batch); ++ ++ ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); ++ while (ret > 0) { ++ ret = mnl_cb_run(buf, ret, flowtable_seq, portid, NULL, NULL); ++ if (ret <= 0) ++ break; ++ ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); ++ } ++ if (ret == -1) { ++ perror("error"); ++ exit(EXIT_FAILURE); ++ } ++ mnl_socket_close(nl); ++ ++ return EXIT_SUCCESS; ++} +--- /dev/null ++++ b/examples/nft-flowtable-del.c +@@ -0,0 +1,122 @@ ++#include <stdlib.h> ++#include <time.h> ++#include <string.h> ++#include <netinet/in.h> ++ ++#include <linux/netfilter.h> ++#include <linux/netfilter/nf_tables.h> ++ ++#include <libmnl/libmnl.h> ++#include <libnftnl/flowtable.h> ++ ++static struct nftnl_flowtable *flowtable_del_parse(int argc, char *argv[]) ++{ ++ struct nftnl_flowtable *t; ++ ++ t = nftnl_flowtable_alloc(); ++ if (t == NULL) { ++ perror("OOM"); ++ return NULL; ++ } ++ ++ nftnl_flowtable_set(t, NFTNL_FLOWTABLE_TABLE, argv[2]); ++ nftnl_flowtable_set(t, NFTNL_FLOWTABLE_NAME, argv[3]); ++ ++ return t; ++} ++ ++int main(int argc, char *argv[]) ++{ ++ struct mnl_socket *nl; ++ struct mnl_nlmsg_batch *batch; ++ char buf[MNL_SOCKET_BUFFER_SIZE]; ++ struct nlmsghdr *nlh; ++ uint32_t portid, seq, flowtable_seq; ++ struct nftnl_flowtable *t; ++ int ret, family, batching; ++ ++ if (argc != 4) { ++ fprintf(stderr, "Usage: %s <family> <table> <flowtable>\n", ++ argv[0]); ++ exit(EXIT_FAILURE); ++ } ++ ++ if (strcmp(argv[1], "ip") == 0) ++ family = NFPROTO_IPV4; ++ else if (strcmp(argv[1], "ip6") == 0) ++ family = NFPROTO_IPV6; ++ else if (strcmp(argv[1], "bridge") == 0) ++ family = NFPROTO_BRIDGE; ++ else if (strcmp(argv[1], "arp") == 0) ++ family = NFPROTO_ARP; ++ else { ++ fprintf(stderr, "Unknown family: ip, ip6, bridge, arp\n"); ++ exit(EXIT_FAILURE); ++ } ++ ++ t = flowtable_del_parse(argc, argv); ++ if (t == NULL) ++ exit(EXIT_FAILURE); ++ ++ batching = nftnl_batch_is_supported(); ++ if (batching < 0) { ++ perror("cannot talk to nfnetlink"); ++ exit(EXIT_FAILURE); ++ } ++ ++ seq = time(NULL); ++ batch = mnl_nlmsg_batch_start(buf, sizeof(buf)); ++ ++ if (batching) { ++ nftnl_batch_begin(mnl_nlmsg_batch_current(batch), seq++); ++ mnl_nlmsg_batch_next(batch); ++ } ++ ++ flowtable_seq = seq; ++ nlh = nftnl_flowtable_nlmsg_build_hdr(mnl_nlmsg_batch_current(batch), ++ NFT_MSG_DELFLOWTABLE, family, ++ NLM_F_ACK, seq++); ++ nftnl_flowtable_nlmsg_build_payload(nlh, t); ++ nftnl_flowtable_free(t); ++ mnl_nlmsg_batch_next(batch); ++ ++ if (batching) { ++ nftnl_batch_end(mnl_nlmsg_batch_current(batch), seq++); ++ mnl_nlmsg_batch_next(batch); ++ } ++ ++ nl = mnl_socket_open(NETLINK_NETFILTER); ++ if (nl == NULL) { ++ perror("mnl_socket_open"); ++ exit(EXIT_FAILURE); ++ } ++ ++ if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) { ++ perror("mnl_socket_bind"); ++ exit(EXIT_FAILURE); ++ } ++ portid = mnl_socket_get_portid(nl); ++ ++ if (mnl_socket_sendto(nl, mnl_nlmsg_batch_head(batch), ++ mnl_nlmsg_batch_size(batch)) < 0) { ++ perror("mnl_socket_send"); ++ exit(EXIT_FAILURE); ++ } ++ ++ mnl_nlmsg_batch_stop(batch); ++ ++ ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); ++ while (ret > 0) { ++ ret = mnl_cb_run(buf, ret, flowtable_seq, portid, NULL, NULL); ++ if (ret <= 0) ++ break; ++ ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); ++ } ++ if (ret == -1) { ++ perror("error"); ++ exit(EXIT_FAILURE); ++ } ++ mnl_socket_close(nl); ++ ++ return EXIT_SUCCESS; ++} +--- /dev/null ++++ b/examples/nft-flowtable-get.c +@@ -0,0 +1,121 @@ ++#include <stdlib.h> ++#include <time.h> ++#include <string.h> ++#include <netinet/in.h> ++ ++#include <linux/netfilter.h> ++#include <linux/netfilter/nf_tables.h> ++ ++#include <libmnl/libmnl.h> ++#include <libnftnl/flowtable.h> ++ ++static int table_cb(const struct nlmsghdr *nlh, void *data) ++{ ++ struct nftnl_flowtable *t; ++ char buf[4096]; ++ uint32_t *type = data; ++ ++ t = nftnl_flowtable_alloc(); ++ if (t == NULL) { ++ perror("OOM"); ++ goto err; ++ } ++ ++ if (nftnl_flowtable_nlmsg_parse(nlh, t) < 0) { ++ perror("nftnl_flowtable_nlmsg_parse"); ++ goto err_free; ++ } ++ ++ nftnl_flowtable_snprintf(buf, sizeof(buf), t, *type, 0); ++ printf("%s\n", buf); ++ ++err_free: ++ nftnl_flowtable_free(t); ++err: ++ return MNL_CB_OK; ++} ++ ++int main(int argc, char *argv[]) ++{ ++ struct mnl_socket *nl; ++ char buf[MNL_SOCKET_BUFFER_SIZE]; ++ struct nlmsghdr *nlh; ++ uint32_t portid, seq, type = NFTNL_OUTPUT_DEFAULT; ++ struct nftnl_flowtable *t = NULL; ++ int ret, family; ++ ++ seq = time(NULL); ++ ++ if (argc < 2 || argc > 5) { ++ fprintf(stderr, "Usage: %s <family> [<table> <flowtable>] [json]\n", ++ argv[0]); ++ exit(EXIT_FAILURE); ++ } ++ ++ if (strcmp(argv[1], "ip") == 0) ++ family = NFPROTO_IPV4; ++ else if (strcmp(argv[1], "ip6") == 0) ++ family = NFPROTO_IPV6; ++ else if (strcmp(argv[1], "bridge") == 0) ++ family = NFPROTO_BRIDGE; ++ else if (strcmp(argv[1], "arp") == 0) ++ family = NFPROTO_ARP; ++ else if (strcmp(argv[1], "unspec") == 0) ++ family = NFPROTO_UNSPEC; ++ else { ++ fprintf(stderr, "Unknown family: ip, ip6, bridge, arp, unspec\n"); ++ exit(EXIT_FAILURE); ++ } ++ ++ if (argc >= 4) { ++ t = nftnl_flowtable_alloc(); ++ if (t == NULL) { ++ perror("OOM"); ++ exit(EXIT_FAILURE); ++ } ++ nlh = nftnl_flowtable_nlmsg_build_hdr(buf, NFT_MSG_GETFLOWTABLE, family, ++ NLM_F_ACK, seq); ++ nftnl_flowtable_set(t, NFTNL_FLOWTABLE_TABLE, argv[2]); ++ nftnl_flowtable_set(t, NFTNL_FLOWTABLE_NAME, argv[3]); ++ nftnl_flowtable_nlmsg_build_payload(nlh, t); ++ nftnl_flowtable_free(t); ++ } else if (argc >= 2) { ++ nlh = nftnl_flowtable_nlmsg_build_hdr(buf, NFT_MSG_GETFLOWTABLE, family, ++ NLM_F_DUMP, seq); ++ } ++ ++ if (strcmp(argv[argc-1], "json") == 0) ++ type = NFTNL_OUTPUT_JSON; ++ ++ nl = mnl_socket_open(NETLINK_NETFILTER); ++ if (nl == NULL) { ++ perror("mnl_socket_open"); ++ exit(EXIT_FAILURE); ++ } ++ ++ if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) { ++ perror("mnl_socket_bind"); ++ exit(EXIT_FAILURE); ++ } ++ portid = mnl_socket_get_portid(nl); ++ ++ if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { ++ perror("mnl_socket_send"); ++ exit(EXIT_FAILURE); ++ } ++ ++ ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); ++ while (ret > 0) { ++ ret = mnl_cb_run(buf, ret, seq, portid, table_cb, &type); ++ if (ret <= 0) ++ break; ++ ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); ++ } ++ if (ret == -1) { ++ perror("error"); ++ exit(EXIT_FAILURE); ++ } ++ mnl_socket_close(nl); ++ ++ return EXIT_SUCCESS; ++} +--- a/include/libnftnl/Makefile.am ++++ b/include/libnftnl/Makefile.am +@@ -6,6 +6,7 @@ pkginclude_HEADERS = batch.h \ + rule.h \ + expr.h \ + set.h \ ++ flowtable.h \ + ruleset.h \ + common.h \ + udata.h \ +--- /dev/null ++++ b/include/libnftnl/flowtable.h +@@ -0,0 +1,81 @@ ++#ifndef _LIBNFTNL_FLOWTABLE_H_ ++#define _LIBNFTNL_FLOWTABLE_H_ ++ ++#include <stdio.h> ++#include <stdint.h> ++#include <stdbool.h> ++#include <sys/types.h> ++ ++#include <libnftnl/common.h> ++ ++#ifdef __cplusplus ++extern "C" { ++#endif ++ ++struct nftnl_flowtable; ++ ++struct nftnl_flowtable *nftnl_flowtable_alloc(void); ++void nftnl_flowtable_free(const struct nftnl_flowtable *); ++ ++enum nftnl_flowtable_attr { ++ NFTNL_FLOWTABLE_NAME = 0, ++ NFTNL_FLOWTABLE_FAMILY, ++ NFTNL_FLOWTABLE_TABLE, ++ NFTNL_FLOWTABLE_HOOKNUM, ++ NFTNL_FLOWTABLE_PRIO = 4, ++ NFTNL_FLOWTABLE_USE, ++ NFTNL_FLOWTABLE_DEVICES, ++ __NFTNL_FLOWTABLE_MAX ++}; ++#define NFTNL_FLOWTABLE_MAX (__NFTNL_FLOWTABLE_MAX - 1) ++ ++bool nftnl_flowtable_is_set(const struct nftnl_flowtable *c, uint16_t attr); ++void nftnl_flowtable_unset(struct nftnl_flowtable *c, uint16_t attr); ++void nftnl_flowtable_set(struct nftnl_flowtable *t, uint16_t attr, const void *data); ++int nftnl_flowtable_set_data(struct nftnl_flowtable *t, uint16_t attr, ++ const void *data, uint32_t data_len); ++void nftnl_flowtable_set_u32(struct nftnl_flowtable *t, uint16_t attr, uint32_t data); ++void nftnl_flowtable_set_s32(struct nftnl_flowtable *t, uint16_t attr, int32_t data); ++int nftnl_flowtable_set_str(struct nftnl_flowtable *t, uint16_t attr, const char *str); ++void nftnl_flowtable_set_array(struct nftnl_flowtable *t, uint16_t attr, const char **data); ++ ++const void *nftnl_flowtable_get(const struct nftnl_flowtable *c, uint16_t attr); ++const void *nftnl_flowtable_get_data(const struct nftnl_flowtable *c, uint16_t attr, ++ uint32_t *data_len); ++const char *nftnl_flowtable_get_str(const struct nftnl_flowtable *c, uint16_t attr); ++uint32_t nftnl_flowtable_get_u32(const struct nftnl_flowtable *c, uint16_t attr); ++int32_t nftnl_flowtable_get_s32(const struct nftnl_flowtable *c, uint16_t attr); ++const char **nftnl_flowtable_get_array(const struct nftnl_flowtable *t, uint16_t attr); ++ ++struct nlmsghdr; ++ ++void nftnl_flowtable_nlmsg_build_payload(struct nlmsghdr *nlh, const struct nftnl_flowtable *t); ++ ++int nftnl_flowtable_parse(struct nftnl_flowtable *c, enum nftnl_parse_type type, ++ const char *data, struct nftnl_parse_err *err); ++int nftnl_flowtable_parse_file(struct nftnl_flowtable *c, enum nftnl_parse_type type, ++ FILE *fp, struct nftnl_parse_err *err); ++int nftnl_flowtable_snprintf(char *buf, size_t size, const struct nftnl_flowtable *t, uint32_t type, uint32_t flags); ++int nftnl_flowtable_fprintf(FILE *fp, const struct nftnl_flowtable *c, uint32_t type, uint32_t flags); ++ ++#define nftnl_flowtable_nlmsg_build_hdr nftnl_nlmsg_build_hdr ++int nftnl_flowtable_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_flowtable *t); ++ ++struct nftnl_flowtable_list; ++ ++struct nftnl_flowtable_list *nftnl_flowtable_list_alloc(void); ++void nftnl_flowtable_list_free(struct nftnl_flowtable_list *list); ++int nftnl_flowtable_list_is_empty(const struct nftnl_flowtable_list *list); ++void nftnl_flowtable_list_add(struct nftnl_flowtable *s, ++ struct nftnl_flowtable_list *list); ++void nftnl_flowtable_list_add_tail(struct nftnl_flowtable *s, ++ struct nftnl_flowtable_list *list); ++void nftnl_flowtable_list_del(struct nftnl_flowtable *s); ++int nftnl_flowtable_list_foreach(struct nftnl_flowtable_list *flowtable_list, ++ int (*cb)(struct nftnl_flowtable *t, void *data), void *data); ++ ++#ifdef __cplusplus ++} /* extern "C" */ ++#endif ++ ++#endif /* _LIBNFTNL_FLOWTABLE_H_ */ +--- a/include/linux/netfilter/nf_tables.h ++++ b/include/linux/netfilter/nf_tables.h +@@ -90,6 +90,9 @@ enum nft_verdicts { + * @NFT_MSG_GETOBJ: get a stateful object (enum nft_obj_attributes) + * @NFT_MSG_DELOBJ: delete a stateful object (enum nft_obj_attributes) + * @NFT_MSG_GETOBJ_RESET: get and reset a stateful object (enum nft_obj_attributes) ++ * @NFT_MSG_NEWFLOWTABLE: add new flow table (enum nft_flowtable_attributes) ++ * @NFT_MSG_GETFLOWTABLE: get flow table (enum nft_flowtable_attributes) ++ * @NFT_MSG_DELFLOWTABLE: delete flow table (enum nft_flowtable_attributes) + */ + enum nf_tables_msg_types { + NFT_MSG_NEWTABLE, +@@ -114,6 +117,9 @@ enum nf_tables_msg_types { + NFT_MSG_GETOBJ, + NFT_MSG_DELOBJ, + NFT_MSG_GETOBJ_RESET, ++ NFT_MSG_NEWFLOWTABLE, ++ NFT_MSG_GETFLOWTABLE, ++ NFT_MSG_DELFLOWTABLE, + NFT_MSG_MAX, + }; + +@@ -1303,6 +1309,53 @@ enum nft_object_attributes { + #define NFTA_OBJ_MAX (__NFTA_OBJ_MAX - 1) + + /** ++ * enum nft_flowtable_attributes - nf_tables flow table netlink attributes ++ * ++ * @NFTA_FLOWTABLE_TABLE: name of the table containing the expression (NLA_STRING) ++ * @NFTA_FLOWTABLE_NAME: name of this flow table (NLA_STRING) ++ * @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32) ++ * @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32) ++ */ ++enum nft_flowtable_attributes { ++ NFTA_FLOWTABLE_UNSPEC, ++ NFTA_FLOWTABLE_TABLE, ++ NFTA_FLOWTABLE_NAME, ++ NFTA_FLOWTABLE_HOOK, ++ NFTA_FLOWTABLE_USE, ++ __NFTA_FLOWTABLE_MAX ++}; ++#define NFTA_FLOWTABLE_MAX (__NFTA_FLOWTABLE_MAX - 1) ++ ++/** ++ * enum nft_flowtable_hook_attributes - nf_tables flow table hook netlink attributes ++ * ++ * @NFTA_FLOWTABLE_HOOK_NUM: netfilter hook number (NLA_U32) ++ * @NFTA_FLOWTABLE_HOOK_PRIORITY: netfilter hook priority (NLA_U32) ++ * @NFTA_FLOWTABLE_HOOK_DEVS: input devices this flow table is bound to (NLA_NESTED) ++ */ ++enum nft_flowtable_hook_attributes { ++ NFTA_FLOWTABLE_HOOK_UNSPEC, ++ NFTA_FLOWTABLE_HOOK_NUM, ++ NFTA_FLOWTABLE_HOOK_PRIORITY, ++ NFTA_FLOWTABLE_HOOK_DEVS, ++ __NFTA_FLOWTABLE_HOOK_MAX ++}; ++#define NFTA_FLOWTABLE_HOOK_MAX (__NFTA_FLOWTABLE_HOOK_MAX - 1) ++ ++/** ++ * enum nft_device_attributes - nf_tables device netlink attributes ++ * ++ * @NFTA_DEVICE_NAME: name of this device (NLA_STRING) ++ */ ++enum nft_devices_attributes { ++ NFTA_DEVICE_UNSPEC, ++ NFTA_DEVICE_NAME, ++ __NFTA_DEVICE_MAX ++}; ++#define NFTA_DEVICE_MAX (__NFTA_DEVICE_MAX - 1) ++ ++ ++/** + * enum nft_trace_attributes - nf_tables trace netlink attributes + * + * @NFTA_TRACE_TABLE: name of the table (NLA_STRING) +--- a/src/Makefile.am ++++ b/src/Makefile.am +@@ -8,6 +8,7 @@ libnftnl_la_LDFLAGS = -Wl,--version-scri + libnftnl_la_SOURCES = utils.c \ + batch.c \ + buffer.c \ ++ flowtable.c \ + common.c \ + gen.c \ + table.c \ +--- /dev/null ++++ b/src/flowtable.c +@@ -0,0 +1,793 @@ ++#include "internal.h" ++ ++#include <time.h> ++#include <endian.h> ++#include <stdint.h> ++#include <stdlib.h> ++#include <limits.h> ++#include <string.h> ++#include <netinet/in.h> ++#include <errno.h> ++#include <inttypes.h> ++ ++#include <libmnl/libmnl.h> ++#include <linux/netfilter/nfnetlink.h> ++#include <linux/netfilter/nf_tables.h> ++#include <linux/netfilter.h> ++#include <linux/netfilter_arp.h> ++ ++#include <libnftnl/flowtable.h> ++#include <buffer.h> ++ ++struct nftnl_flowtable { ++ struct list_head head; ++ const char *name; ++ const char *table; ++ int family; ++ uint32_t hooknum; ++ int32_t prio; ++ const char **dev_array; ++ uint32_t dev_array_len; ++ uint32_t use; ++ uint32_t flags; ++}; ++ ++struct nftnl_flowtable *nftnl_flowtable_alloc(void) ++{ ++ return calloc(1, sizeof(struct nftnl_flowtable)); ++} ++EXPORT_SYMBOL(nftnl_flowtable_alloc); ++ ++void nftnl_flowtable_free(const struct nftnl_flowtable *c) ++{ ++ int i; ++ ++ if (c->flags & (1 << NFTNL_FLOWTABLE_NAME)) ++ xfree(c->name); ++ if (c->flags & (1 << NFTNL_FLOWTABLE_TABLE)) ++ xfree(c->table); ++ if (c->flags & (1 << NFTNL_FLOWTABLE_DEVICES)) { ++ for (i = 0; i < c->dev_array_len; i++) ++ xfree(c->dev_array[i]); ++ ++ xfree(c->dev_array); ++ } ++ xfree(c); ++} ++EXPORT_SYMBOL(nftnl_flowtable_free); ++ ++bool nftnl_flowtable_is_set(const struct nftnl_flowtable *c, uint16_t attr) ++{ ++ return c->flags & (1 << attr); ++} ++EXPORT_SYMBOL(nftnl_flowtable_is_set); ++ ++void nftnl_flowtable_unset(struct nftnl_flowtable *c, uint16_t attr) ++{ ++ int i; ++ ++ if (!(c->flags & (1 << attr))) ++ return; ++ ++ switch (attr) { ++ case NFTNL_FLOWTABLE_NAME: ++ xfree(c->name); ++ break; ++ case NFTNL_FLOWTABLE_TABLE: ++ xfree(c->table); ++ break; ++ case NFTNL_FLOWTABLE_HOOKNUM: ++ case NFTNL_FLOWTABLE_PRIO: ++ case NFTNL_FLOWTABLE_USE: ++ case NFTNL_FLOWTABLE_FAMILY: ++ break; ++ case NFTNL_FLOWTABLE_DEVICES: ++ for (i = 0; i < c->dev_array_len; i++) { ++ xfree(c->dev_array[i]); ++ xfree(c->dev_array); ++ } ++ break; ++ default: ++ return; ++ } ++ ++ c->flags &= ~(1 << attr); ++} ++EXPORT_SYMBOL(nftnl_flowtable_unset); ++ ++static uint32_t nftnl_flowtable_validate[NFTNL_FLOWTABLE_MAX + 1] = { ++ [NFTNL_FLOWTABLE_HOOKNUM] = sizeof(uint32_t), ++ [NFTNL_FLOWTABLE_PRIO] = sizeof(int32_t), ++ [NFTNL_FLOWTABLE_FAMILY] = sizeof(uint32_t), ++}; ++ ++int nftnl_flowtable_set_data(struct nftnl_flowtable *c, uint16_t attr, ++ const void *data, uint32_t data_len) ++{ ++ const char **dev_array; ++ int len = 0, i; ++ ++ nftnl_assert_attr_exists(attr, NFTNL_FLOWTABLE_MAX); ++ nftnl_assert_validate(data, nftnl_flowtable_validate, attr, data_len); ++ ++ switch(attr) { ++ case NFTNL_FLOWTABLE_NAME: ++ if (c->flags & (1 << NFTNL_FLOWTABLE_NAME)) ++ xfree(c->name); ++ ++ c->name = strdup(data); ++ if (!c->name) ++ return -1; ++ break; ++ case NFTNL_FLOWTABLE_TABLE: ++ if (c->flags & (1 << NFTNL_FLOWTABLE_TABLE)) ++ xfree(c->table); ++ ++ c->table = strdup(data); ++ if (!c->table) ++ return -1; ++ break; ++ case NFTNL_FLOWTABLE_HOOKNUM: ++ memcpy(&c->hooknum, data, sizeof(c->hooknum)); ++ break; ++ case NFTNL_FLOWTABLE_PRIO: ++ memcpy(&c->prio, data, sizeof(c->prio)); ++ break; ++ case NFTNL_FLOWTABLE_FAMILY: ++ memcpy(&c->family, data, sizeof(c->family)); ++ break; ++ case NFTNL_FLOWTABLE_DEVICES: ++ dev_array = (const char **)data; ++ while (dev_array[len] != NULL) ++ len++; ++ ++ if (c->flags & (1 << NFTNL_FLOWTABLE_DEVICES)) { ++ for (i = 0; i < c->dev_array_len; i++) { ++ xfree(c->dev_array[i]); ++ xfree(c->dev_array); ++ } ++ } ++ ++ c->dev_array = calloc(len + 1, sizeof(char *)); ++ if (!c->dev_array) ++ return -1; ++ ++ for (i = 0; i < len; i++) ++ c->dev_array[i] = strdup(dev_array[i]); ++ ++ c->dev_array_len = len; ++ break; ++ } ++ c->flags |= (1 << attr); ++ return 0; ++} ++EXPORT_SYMBOL(nftnl_flowtable_set_data); ++ ++void nftnl_flowtable_set(struct nftnl_flowtable *c, uint16_t attr, const void *data) ++{ ++ nftnl_flowtable_set_data(c, attr, data, nftnl_flowtable_validate[attr]); ++} ++EXPORT_SYMBOL(nftnl_flowtable_set); ++ ++void nftnl_flowtable_set_array(struct nftnl_flowtable *c, uint16_t attr, const char **data) ++{ ++ nftnl_flowtable_set_data(c, attr, &data[0], nftnl_flowtable_validate[attr]); ++} ++EXPORT_SYMBOL(nftnl_flowtable_set_array); ++ ++void nftnl_flowtable_set_u32(struct nftnl_flowtable *c, uint16_t attr, uint32_t data) ++{ ++ nftnl_flowtable_set_data(c, attr, &data, sizeof(uint32_t)); ++} ++EXPORT_SYMBOL(nftnl_flowtable_set_u32); ++ ++void nftnl_flowtable_set_s32(struct nftnl_flowtable *c, uint16_t attr, int32_t data) ++{ ++ nftnl_flowtable_set_data(c, attr, &data, sizeof(int32_t)); ++} ++EXPORT_SYMBOL(nftnl_flowtable_set_s32); ++ ++int nftnl_flowtable_set_str(struct nftnl_flowtable *c, uint16_t attr, const char *str) ++{ ++ return nftnl_flowtable_set_data(c, attr, str, strlen(str) + 1); ++} ++EXPORT_SYMBOL(nftnl_flowtable_set_str); ++ ++const void *nftnl_flowtable_get_data(const struct nftnl_flowtable *c, ++ uint16_t attr, uint32_t *data_len) ++{ ++ if (!(c->flags & (1 << attr))) ++ return NULL; ++ ++ switch(attr) { ++ case NFTNL_FLOWTABLE_NAME: ++ *data_len = strlen(c->name) + 1; ++ return c->name; ++ case NFTNL_FLOWTABLE_TABLE: ++ *data_len = strlen(c->table) + 1; ++ return c->table; ++ case NFTNL_FLOWTABLE_HOOKNUM: ++ *data_len = sizeof(uint32_t); ++ return &c->hooknum; ++ case NFTNL_FLOWTABLE_PRIO: ++ *data_len = sizeof(int32_t); ++ return &c->prio; ++ case NFTNL_FLOWTABLE_FAMILY: ++ *data_len = sizeof(int32_t); ++ return &c->family; ++ case NFTNL_FLOWTABLE_DEVICES: ++ return &c->dev_array[0]; ++ } ++ return NULL; ++} ++EXPORT_SYMBOL(nftnl_flowtable_get_data); ++ ++const void *nftnl_flowtable_get(const struct nftnl_flowtable *c, uint16_t attr) ++{ ++ uint32_t data_len; ++ return nftnl_flowtable_get_data(c, attr, &data_len); ++} ++EXPORT_SYMBOL(nftnl_flowtable_get); ++ ++const char *nftnl_flowtable_get_str(const struct nftnl_flowtable *c, uint16_t attr) ++{ ++ return nftnl_flowtable_get(c, attr); ++} ++EXPORT_SYMBOL(nftnl_flowtable_get_str); ++ ++uint32_t nftnl_flowtable_get_u32(const struct nftnl_flowtable *c, uint16_t attr) ++{ ++ uint32_t data_len; ++ const uint32_t *val = nftnl_flowtable_get_data(c, attr, &data_len); ++ ++ nftnl_assert(val, attr, data_len == sizeof(uint32_t)); ++ ++ return val ? *val : 0; ++} ++EXPORT_SYMBOL(nftnl_flowtable_get_u32); ++ ++int32_t nftnl_flowtable_get_s32(const struct nftnl_flowtable *c, uint16_t attr) ++{ ++ uint32_t data_len; ++ const int32_t *val = nftnl_flowtable_get_data(c, attr, &data_len); ++ ++ nftnl_assert(val, attr, data_len == sizeof(int32_t)); ++ ++ return val ? *val : 0; ++} ++EXPORT_SYMBOL(nftnl_flowtable_get_s32); ++ ++const char **nftnl_flowtable_get_array(const struct nftnl_flowtable *c, uint16_t attr) ++{ ++ return (const char **)nftnl_flowtable_get(c, attr); ++} ++EXPORT_SYMBOL(nftnl_flowtable_get_array); ++ ++void nftnl_flowtable_nlmsg_build_payload(struct nlmsghdr *nlh, ++ const struct nftnl_flowtable *c) ++{ ++ int i; ++ ++ if (c->flags & (1 << NFTNL_FLOWTABLE_TABLE)) ++ mnl_attr_put_strz(nlh, NFTA_FLOWTABLE_TABLE, c->table); ++ if (c->flags & (1 << NFTNL_FLOWTABLE_NAME)) ++ mnl_attr_put_strz(nlh, NFTA_FLOWTABLE_NAME, c->name); ++ if ((c->flags & (1 << NFTNL_FLOWTABLE_HOOKNUM)) && ++ (c->flags & (1 << NFTNL_FLOWTABLE_PRIO))) { ++ struct nlattr *nest; ++ ++ nest = mnl_attr_nest_start(nlh, NFTA_FLOWTABLE_HOOK); ++ mnl_attr_put_u32(nlh, NFTA_FLOWTABLE_HOOK_NUM, htonl(c->hooknum)); ++ mnl_attr_put_u32(nlh, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(c->prio)); ++ if (c->flags & (1 << NFTNL_FLOWTABLE_DEVICES)) { ++ struct nlattr *nest_dev; ++ ++ nest_dev = mnl_attr_nest_start(nlh, ++ NFTA_FLOWTABLE_HOOK_DEVS); ++ for (i = 0; i < c->dev_array_len; i++) ++ mnl_attr_put_strz(nlh, NFTA_DEVICE_NAME, ++ c->dev_array[i]); ++ mnl_attr_nest_end(nlh, nest_dev); ++ } ++ mnl_attr_nest_end(nlh, nest); ++ } ++ if (c->flags & (1 << NFTNL_FLOWTABLE_USE)) ++ mnl_attr_put_u32(nlh, NFTA_FLOWTABLE_USE, htonl(c->use)); ++} ++EXPORT_SYMBOL(nftnl_flowtable_nlmsg_build_payload); ++ ++static int nftnl_flowtable_parse_attr_cb(const struct nlattr *attr, void *data) ++{ ++ const struct nlattr **tb = data; ++ int type = mnl_attr_get_type(attr); ++ ++ if (mnl_attr_type_valid(attr, NFTA_FLOWTABLE_MAX) < 0) ++ return MNL_CB_OK; ++ ++ switch(type) { ++ case NFTA_FLOWTABLE_NAME: ++ case NFTA_FLOWTABLE_TABLE: ++ if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0) ++ abi_breakage(); ++ break; ++ case NFTA_FLOWTABLE_HOOK: ++ if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0) ++ abi_breakage(); ++ break; ++ case NFTA_FLOWTABLE_USE: ++ if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) ++ abi_breakage(); ++ break; ++ } ++ ++ tb[type] = attr; ++ return MNL_CB_OK; ++} ++ ++static int nftnl_flowtable_parse_hook_cb(const struct nlattr *attr, void *data) ++{ ++ const struct nlattr **tb = data; ++ int type = mnl_attr_get_type(attr); ++ ++ if (mnl_attr_type_valid(attr, NFTA_FLOWTABLE_HOOK_MAX) < 0) ++ return MNL_CB_OK; ++ ++ switch(type) { ++ case NFTA_FLOWTABLE_HOOK_NUM: ++ case NFTA_FLOWTABLE_HOOK_PRIORITY: ++ if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) ++ abi_breakage(); ++ break; ++ case NFTA_FLOWTABLE_HOOK_DEVS: ++ if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0) ++ abi_breakage(); ++ break; ++ } ++ ++ tb[type] = attr; ++ return MNL_CB_OK; ++} ++ ++static int nftnl_flowtable_parse_devs(struct nlattr *nest, ++ struct nftnl_flowtable *c) ++{ ++ struct nlattr *attr; ++ char *dev_array[8]; ++ int len = 0, i; ++ ++ mnl_attr_for_each_nested(attr, nest) { ++ if (mnl_attr_get_type(attr) != NFTA_DEVICE_NAME) ++ return -1; ++ dev_array[len++] = strdup(mnl_attr_get_str(attr)); ++ if (len >= 8) ++ break; ++ } ++ ++ if (!len) ++ return -1; ++ ++ c->dev_array = calloc(len + 1, sizeof(char *)); ++ if (!c->dev_array) ++ return -1; ++ ++ c->dev_array_len = len; ++ ++ for (i = 0; i < len; i++) ++ c->dev_array[i] = strdup(dev_array[i]); ++ ++ return 0; ++} ++ ++static int nftnl_flowtable_parse_hook(struct nlattr *attr, struct nftnl_flowtable *c) ++{ ++ struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1] = {}; ++ int ret; ++ ++ if (mnl_attr_parse_nested(attr, nftnl_flowtable_parse_hook_cb, tb) < 0) ++ return -1; ++ ++ if (tb[NFTA_FLOWTABLE_HOOK_NUM]) { ++ c->hooknum = ntohl(mnl_attr_get_u32(tb[NFTA_FLOWTABLE_HOOK_NUM])); ++ c->flags |= (1 << NFTNL_FLOWTABLE_HOOKNUM); ++ } ++ if (tb[NFTA_FLOWTABLE_HOOK_PRIORITY]) { ++ c->prio = ntohl(mnl_attr_get_u32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY])); ++ c->flags |= (1 << NFTNL_FLOWTABLE_PRIO); ++ } ++ if (tb[NFTA_FLOWTABLE_HOOK_DEVS]) { ++ ret = nftnl_flowtable_parse_devs(tb[NFTA_FLOWTABLE_HOOK_DEVS], c); ++ if (ret < 0) ++ return -1; ++ c->flags |= (1 << NFTNL_FLOWTABLE_DEVICES); ++ } ++ ++ return 0; ++} ++ ++int nftnl_flowtable_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_flowtable *c) ++{ ++ struct nlattr *tb[NFTA_FLOWTABLE_MAX + 1] = {}; ++ struct nfgenmsg *nfg = mnl_nlmsg_get_payload(nlh); ++ int ret = 0; ++ ++ if (mnl_attr_parse(nlh, sizeof(*nfg), nftnl_flowtable_parse_attr_cb, tb) < 0) ++ return -1; ++ ++ if (tb[NFTA_FLOWTABLE_NAME]) { ++ if (c->flags & (1 << NFTNL_FLOWTABLE_NAME)) ++ xfree(c->name); ++ c->name = strdup(mnl_attr_get_str(tb[NFTA_FLOWTABLE_NAME])); ++ if (!c->name) ++ return -1; ++ c->flags |= (1 << NFTNL_FLOWTABLE_NAME); ++ } ++ if (tb[NFTA_FLOWTABLE_TABLE]) { ++ if (c->flags & (1 << NFTNL_FLOWTABLE_TABLE)) ++ xfree(c->table); ++ c->table = strdup(mnl_attr_get_str(tb[NFTA_FLOWTABLE_TABLE])); ++ if (!c->table) ++ return -1; ++ c->flags |= (1 << NFTNL_FLOWTABLE_TABLE); ++ } ++ if (tb[NFTA_FLOWTABLE_HOOK]) { ++ ret = nftnl_flowtable_parse_hook(tb[NFTA_FLOWTABLE_HOOK], c); ++ if (ret < 0) ++ return ret; ++ } ++ if (tb[NFTA_FLOWTABLE_USE]) { ++ c->use = ntohl(mnl_attr_get_u32(tb[NFTA_FLOWTABLE_USE])); ++ c->flags |= (1 << NFTNL_FLOWTABLE_USE); ++ } ++ ++ c->family = nfg->nfgen_family; ++ c->flags |= (1 << NFTNL_FLOWTABLE_FAMILY); ++ ++ return ret; ++} ++EXPORT_SYMBOL(nftnl_flowtable_nlmsg_parse); ++ ++static const char *nftnl_hooknum2str(int family, int hooknum) ++{ ++ switch (family) { ++ case NFPROTO_IPV4: ++ case NFPROTO_IPV6: ++ case NFPROTO_INET: ++ case NFPROTO_BRIDGE: ++ switch (hooknum) { ++ case NF_INET_PRE_ROUTING: ++ return "prerouting"; ++ case NF_INET_LOCAL_IN: ++ return "input"; ++ case NF_INET_FORWARD: ++ return "forward"; ++ case NF_INET_LOCAL_OUT: ++ return "output"; ++ case NF_INET_POST_ROUTING: ++ return "postrouting"; ++ } ++ break; ++ case NFPROTO_ARP: ++ switch (hooknum) { ++ case NF_ARP_IN: ++ return "input"; ++ case NF_ARP_OUT: ++ return "output"; ++ case NF_ARP_FORWARD: ++ return "forward"; ++ } ++ break; ++ case NFPROTO_NETDEV: ++ switch (hooknum) { ++ case NF_NETDEV_INGRESS: ++ return "ingress"; ++ } ++ break; ++ } ++ return "unknown"; ++} ++ ++static inline int nftnl_str2hooknum(int family, const char *hook) ++{ ++ int hooknum; ++ ++ for (hooknum = 0; hooknum < NF_INET_NUMHOOKS; hooknum++) { ++ if (strcmp(hook, nftnl_hooknum2str(family, hooknum)) == 0) ++ return hooknum; ++ } ++ return -1; ++} ++ ++#ifdef JSON_PARSING ++static int nftnl_jansson_parse_flowtable(struct nftnl_flowtable *c, ++ json_t *tree, ++ struct nftnl_parse_err *err) ++{ ++ const char *name, *table, *hooknum_str; ++ int32_t family, prio, hooknum; ++ json_t *root; ++ ++ root = nftnl_jansson_get_node(tree, "flowtable", err); ++ if (root == NULL) ++ return -1; ++ ++ name = nftnl_jansson_parse_str(root, "name", err); ++ if (name != NULL) ++ nftnl_flowtable_set_str(c, NFTNL_FLOWTABLE_NAME, name); ++ ++ if (nftnl_jansson_parse_family(root, &family, err) == 0) ++ nftnl_flowtable_set_u32(c, NFTNL_FLOWTABLE_FAMILY, family); ++ ++ table = nftnl_jansson_parse_str(root, "table", err); ++ ++ if (table != NULL) ++ nftnl_flowtable_set_str(c, NFTNL_FLOWTABLE_TABLE, table); ++ ++ if (nftnl_jansson_node_exist(root, "hooknum")) { ++ if (nftnl_jansson_parse_val(root, "prio", NFTNL_TYPE_S32, ++ &prio, err) == 0) ++ nftnl_flowtable_set_s32(c, NFTNL_FLOWTABLE_PRIO, prio); ++ ++ hooknum_str = nftnl_jansson_parse_str(root, "hooknum", err); ++ if (hooknum_str != NULL) { ++ hooknum = nftnl_str2hooknum(c->family, hooknum_str); ++ if (hooknum == -1) ++ return -1; ++ nftnl_flowtable_set_u32(c, NFTNL_FLOWTABLE_HOOKNUM, ++ hooknum); ++ } ++ } ++ ++ return 0; ++} ++#endif ++ ++static int nftnl_flowtable_json_parse(struct nftnl_flowtable *c, ++ const void *json, ++ struct nftnl_parse_err *err, ++ enum nftnl_parse_input input) ++{ ++#ifdef JSON_PARSING ++ json_t *tree; ++ json_error_t error; ++ int ret; ++ ++ tree = nftnl_jansson_create_root(json, &error, err, input); ++ if (tree == NULL) ++ return -1; ++ ++ ret = nftnl_jansson_parse_flowtable(c, tree, err); ++ ++ nftnl_jansson_free_root(tree); ++ ++ return ret; ++#else ++ errno = EOPNOTSUPP; ++ return -1; ++#endif ++} ++ ++static int nftnl_flowtable_do_parse(struct nftnl_flowtable *c, ++ enum nftnl_parse_type type, ++ const void *data, ++ struct nftnl_parse_err *err, ++ enum nftnl_parse_input input) ++{ ++ int ret; ++ struct nftnl_parse_err perr = {}; ++ ++ switch (type) { ++ case NFTNL_PARSE_JSON: ++ ret = nftnl_flowtable_json_parse(c, data, &perr, input); ++ break; ++ case NFTNL_PARSE_XML: ++ default: ++ ret = -1; ++ errno = EOPNOTSUPP; ++ break; ++ } ++ ++ if (err != NULL) ++ *err = perr; ++ ++ return ret; ++} ++ ++int nftnl_flowtable_parse(struct nftnl_flowtable *c, enum nftnl_parse_type type, ++ const char *data, struct nftnl_parse_err *err) ++{ ++ return nftnl_flowtable_do_parse(c, type, data, err, NFTNL_PARSE_BUFFER); ++} ++EXPORT_SYMBOL(nftnl_flowtable_parse); ++ ++int nftnl_flowtable_parse_file(struct nftnl_flowtable *c, ++ enum nftnl_parse_type type, ++ FILE *fp, struct nftnl_parse_err *err) ++{ ++ return nftnl_flowtable_do_parse(c, type, fp, err, NFTNL_PARSE_FILE); ++} ++EXPORT_SYMBOL(nftnl_flowtable_parse_file); ++ ++static int nftnl_flowtable_export(char *buf, size_t size, ++ const struct nftnl_flowtable *c, int type) ++{ ++ NFTNL_BUF_INIT(b, buf, size); ++ ++ nftnl_buf_open(&b, type, CHAIN); ++ if (c->flags & (1 << NFTNL_FLOWTABLE_NAME)) ++ nftnl_buf_str(&b, type, c->name, NAME); ++ if (c->flags & (1 << NFTNL_FLOWTABLE_TABLE)) ++ nftnl_buf_str(&b, type, c->table, TABLE); ++ if (c->flags & (1 << NFTNL_FLOWTABLE_FAMILY)) ++ nftnl_buf_str(&b, type, nftnl_family2str(c->family), FAMILY); ++ if (c->flags & (1 << NFTNL_FLOWTABLE_USE)) ++ nftnl_buf_u32(&b, type, c->use, USE); ++ if (c->flags & (1 << NFTNL_FLOWTABLE_HOOKNUM)) { ++ if (c->flags & (1 << NFTNL_FLOWTABLE_HOOKNUM)) ++ nftnl_buf_str(&b, type, nftnl_hooknum2str(c->family, ++ c->hooknum), HOOKNUM); ++ if (c->flags & (1 << NFTNL_FLOWTABLE_PRIO)) ++ nftnl_buf_s32(&b, type, c->prio, PRIO); ++ } ++ ++ nftnl_buf_close(&b, type, CHAIN); ++ ++ return nftnl_buf_done(&b); ++} ++ ++static int nftnl_flowtable_snprintf_default(char *buf, size_t size, ++ const struct nftnl_flowtable *c) ++{ ++ int ret, remain = size, offset = 0, i; ++ ++ ret = snprintf(buf, remain, "flow table %s %s use %u", ++ c->table, c->name, c->use); ++ SNPRINTF_BUFFER_SIZE(ret, remain, offset); ++ ++ if (c->flags & (1 << NFTNL_FLOWTABLE_HOOKNUM)) { ++ ret = snprintf(buf + offset, remain, " hook %s prio %d", ++ nftnl_hooknum2str(c->family, c->hooknum), ++ c->prio); ++ SNPRINTF_BUFFER_SIZE(ret, remain, offset); ++ ++ if (c->flags & (1 << NFTNL_FLOWTABLE_DEVICES)) { ++ ret = snprintf(buf + offset, remain, " dev { "); ++ SNPRINTF_BUFFER_SIZE(ret, remain, offset); ++ ++ for (i = 0; i < c->dev_array_len; i++) { ++ ret = snprintf(buf + offset, remain, " %s ", ++ c->dev_array[i]); ++ SNPRINTF_BUFFER_SIZE(ret, remain, offset); ++ } ++ ret = snprintf(buf + offset, remain, " } "); ++ SNPRINTF_BUFFER_SIZE(ret, remain, offset); ++ } ++ } ++ ++ return offset; ++} ++ ++static int nftnl_flowtable_cmd_snprintf(char *buf, size_t size, ++ const struct nftnl_flowtable *c, ++ uint32_t cmd, uint32_t type, ++ uint32_t flags) ++{ ++ int ret, remain = size, offset = 0; ++ ++ ret = nftnl_cmd_header_snprintf(buf + offset, remain, cmd, type, flags); ++ SNPRINTF_BUFFER_SIZE(ret, remain, offset); ++ ++ switch (type) { ++ case NFTNL_OUTPUT_DEFAULT: ++ ret = nftnl_flowtable_snprintf_default(buf + offset, remain, c); ++ break; ++ case NFTNL_OUTPUT_XML: ++ case NFTNL_OUTPUT_JSON: ++ ret = nftnl_flowtable_export(buf + offset, remain, c, type); ++ break; ++ default: ++ return -1; ++ } ++ ++ SNPRINTF_BUFFER_SIZE(ret, remain, offset); ++ ++ ret = nftnl_cmd_footer_snprintf(buf + offset, remain, cmd, type, flags); ++ SNPRINTF_BUFFER_SIZE(ret, remain, offset); ++ ++ return offset; ++} ++ ++int nftnl_flowtable_snprintf(char *buf, size_t size, const struct nftnl_flowtable *c, ++ uint32_t type, uint32_t flags) ++{ ++ if (size) ++ buf[0] = '\0'; ++ ++ return nftnl_flowtable_cmd_snprintf(buf, size, c, nftnl_flag2cmd(flags), ++ type, flags); ++} ++EXPORT_SYMBOL(nftnl_flowtable_snprintf); ++ ++static int nftnl_flowtable_do_snprintf(char *buf, size_t size, const void *c, ++ uint32_t cmd, uint32_t type, uint32_t flags) ++{ ++ return nftnl_flowtable_snprintf(buf, size, c, type, flags); ++} ++ ++int nftnl_flowtable_fprintf(FILE *fp, const struct nftnl_flowtable *c, ++ uint32_t type, uint32_t flags) ++{ ++ return nftnl_fprintf(fp, c, NFTNL_CMD_UNSPEC, type, flags, ++ nftnl_flowtable_do_snprintf); ++} ++EXPORT_SYMBOL(nftnl_flowtable_fprintf); ++ ++struct nftnl_flowtable_list { ++ struct list_head list; ++}; ++ ++struct nftnl_flowtable_list *nftnl_flowtable_list_alloc(void) ++{ ++ struct nftnl_flowtable_list *list; ++ ++ list = calloc(1, sizeof(struct nftnl_flowtable_list)); ++ if (list == NULL) ++ return NULL; ++ ++ INIT_LIST_HEAD(&list->list); ++ ++ return list; ++} ++EXPORT_SYMBOL(nftnl_flowtable_list_alloc); ++ ++void nftnl_flowtable_list_free(struct nftnl_flowtable_list *list) ++{ ++ struct nftnl_flowtable *s, *tmp; ++ ++ list_for_each_entry_safe(s, tmp, &list->list, head) { ++ list_del(&s->head); ++ nftnl_flowtable_free(s); ++ } ++ xfree(list); ++} ++EXPORT_SYMBOL(nftnl_flowtable_list_free); ++ ++int nftnl_flowtable_list_is_empty(const struct nftnl_flowtable_list *list) ++{ ++ return list_empty(&list->list); ++} ++EXPORT_SYMBOL(nftnl_flowtable_list_is_empty); ++ ++void nftnl_flowtable_list_add(struct nftnl_flowtable *s, ++ struct nftnl_flowtable_list *list) ++{ ++ list_add(&s->head, &list->list); ++} ++EXPORT_SYMBOL(nftnl_flowtable_list_add); ++ ++void nftnl_flowtable_list_add_tail(struct nftnl_flowtable *s, ++ struct nftnl_flowtable_list *list) ++{ ++ list_add_tail(&s->head, &list->list); ++} ++EXPORT_SYMBOL(nftnl_flowtable_list_add_tail); ++ ++void nftnl_flowtable_list_del(struct nftnl_flowtable *s) ++{ ++ list_del(&s->head); ++} ++EXPORT_SYMBOL(nftnl_flowtable_list_del); ++ ++int nftnl_flowtable_list_foreach(struct nftnl_flowtable_list *flowtable_list, ++ int (*cb)(struct nftnl_flowtable *t, void *data), void *data) ++{ ++ struct nftnl_flowtable *cur, *tmp; ++ int ret; ++ ++ list_for_each_entry_safe(cur, tmp, &flowtable_list->list, head) { ++ ret = cb(cur, data); ++ if (ret < 0) ++ return ret; ++ } ++ return 0; ++} ++EXPORT_SYMBOL(nftnl_flowtable_list_foreach); +--- a/src/libnftnl.map ++++ b/src/libnftnl.map +@@ -311,3 +311,34 @@ local: *; + LIBNFTNL_6 { + nftnl_expr_fprintf; + } LIBNFTNL_5; ++ ++LIBNFTNL_7 { ++ nftnl_flowtable_alloc; ++ nftnl_flowtable_free; ++ nftnl_flowtable_is_set; ++ nftnl_flowtable_unset; ++ nftnl_flowtable_set; ++ nftnl_flowtable_set_u32; ++ nftnl_flowtable_set_s32; ++ nftnl_flowtable_set_array; ++ nftnl_flowtable_set_str; ++ nftnl_flowtable_get; ++ nftnl_flowtable_get_u32; ++ nftnl_flowtable_get_s32; ++ nftnl_flowtable_get_array; ++ nftnl_flowtable_get_str; ++ nftnl_flowtable_parse; ++ nftnl_flowtable_parse_file; ++ nftnl_flowtable_snprintf; ++ nftnl_flowtable_fprintf; ++ nftnl_flowtable_nlmsg_build_payload; ++ nftnl_flowtable_nlmsg_parse; ++ nftnl_flowtable_list_alloc; ++ nftnl_flowtable_list_free; ++ nftnl_flowtable_list_is_empty; ++ nftnl_flowtable_list_add; ++ nftnl_flowtable_list_add_tail; ++ nftnl_flowtable_list_del; ++ nftnl_flowtable_list_foreach; ++ ++} LIBNFTNL_6; diff --git a/package/libs/libnftnl/patches/101-expr-add-flow-offload-expression.patch b/package/libs/libnftnl/patches/101-expr-add-flow-offload-expression.patch new file mode 100644 index 0000000..c7d3676 --- /dev/null +++ b/package/libs/libnftnl/patches/101-expr-add-flow-offload-expression.patch @@ -0,0 +1,259 @@ +From: Pablo Neira Ayuso <pablo@netfilter.org> +Date: Sun, 3 Dec 2017 21:05:54 +0100 +Subject: [PATCH] expr: add flow offload expression + +This patch adds the new "flow_offload" expression to select what flows +are offloaded to an existing flowtable. + +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + create mode 100644 src/expr/flow_offload.c + +--- a/include/libnftnl/expr.h ++++ b/include/libnftnl/expr.h +@@ -221,6 +221,10 @@ enum { + }; + + enum { ++ NFTNL_EXPR_FLOW_TABLE_NAME = NFTNL_EXPR_BASE, ++}; ++ ++enum { + NFTNL_EXPR_FWD_SREG_DEV = NFTNL_EXPR_BASE, + }; + +--- a/include/linux/netfilter/nf_tables.h ++++ b/include/linux/netfilter/nf_tables.h +@@ -952,6 +952,17 @@ enum nft_ct_attributes { + }; + #define NFTA_CT_MAX (__NFTA_CT_MAX - 1) + ++/** ++ * enum nft_flow_attributes - ct offload expression attributes ++ * @NFTA_FLOW_TABLE_NAME: flow table name (NLA_STRING) ++ */ ++enum nft_offload_attributes { ++ NFTA_FLOW_UNSPEC, ++ NFTA_FLOW_TABLE_NAME, ++ __NFTA_FLOW_MAX, ++}; ++#define NFTA_FLOW_MAX (__NFTA_FLOW_MAX - 1) ++ + enum nft_limit_type { + NFT_LIMIT_PKTS, + NFT_LIMIT_PKT_BYTES +--- a/src/Makefile.am ++++ b/src/Makefile.am +@@ -32,6 +32,7 @@ libnftnl_la_SOURCES = utils.c \ + expr/data_reg.c \ + expr/dup.c \ + expr/exthdr.c \ ++ expr/flow_offload.c \ + expr/fib.c \ + expr/fwd.c \ + expr/limit.c \ +--- /dev/null ++++ b/src/expr/flow_offload.c +@@ -0,0 +1,184 @@ ++#include "internal.h" ++ ++#include <stdio.h> ++#include <stdint.h> ++#include <string.h> /* for memcpy */ ++#include <arpa/inet.h> ++#include <errno.h> ++#include <libmnl/libmnl.h> ++#include <linux/netfilter/nf_tables.h> ++#include <libnftnl/rule.h> ++#include <libnftnl/expr.h> ++ ++struct nftnl_expr_flow { ++ char *table_name; ++}; ++ ++static int nftnl_expr_flow_set(struct nftnl_expr *e, uint16_t type, ++ const void *data, uint32_t data_len) ++{ ++ struct nftnl_expr_flow *flow = nftnl_expr_data(e); ++ ++ switch (type) { ++ case NFTNL_EXPR_FLOW_TABLE_NAME: ++ flow->table_name = strdup((const char *)data); ++ if (!flow->table_name) ++ return -1; ++ break; ++ default: ++ return -1; ++ } ++ return 0; ++} ++ ++static const void *nftnl_expr_flow_get(const struct nftnl_expr *e, ++ uint16_t type, uint32_t *data_len) ++{ ++ struct nftnl_expr_flow *flow = nftnl_expr_data(e); ++ ++ switch(type) { ++ case NFTNL_EXPR_FLOW_TABLE_NAME: ++ *data_len = strlen(flow->table_name) + 1; ++ return flow->table_name; ++ } ++ return NULL; ++} ++ ++static int nftnl_expr_flow_cb(const struct nlattr *attr, void *data) ++{ ++ const struct nlattr **tb = data; ++ int type = mnl_attr_get_type(attr); ++ ++ if (mnl_attr_type_valid(attr, NFTA_FLOW_MAX) < 0) ++ return MNL_CB_OK; ++ ++ switch(type) { ++ case NFTA_FLOW_TABLE_NAME: ++ if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0) ++ abi_breakage(); ++ break; ++ } ++ ++ tb[type] = attr; ++ return MNL_CB_OK; ++} ++ ++static void nftnl_expr_flow_build(struct nlmsghdr *nlh, ++ const struct nftnl_expr *e) ++{ ++ struct nftnl_expr_flow *flow = nftnl_expr_data(e); ++ ++ if (e->flags & (1 << NFTNL_EXPR_FLOW_TABLE_NAME)) ++ mnl_attr_put_strz(nlh, NFTA_FLOW_TABLE_NAME, flow->table_name); ++} ++ ++static int nftnl_expr_flow_parse(struct nftnl_expr *e, struct nlattr *attr) ++{ ++ struct nftnl_expr_flow *flow = nftnl_expr_data(e); ++ struct nlattr *tb[NFTA_FLOW_MAX+1] = {}; ++ int ret = 0; ++ ++ if (mnl_attr_parse_nested(attr, nftnl_expr_flow_cb, tb) < 0) ++ return -1; ++ ++ if (tb[NFTA_FLOW_TABLE_NAME]) { ++ flow->table_name = ++ strdup(mnl_attr_get_str(tb[NFTA_FLOW_TABLE_NAME])); ++ if (!flow->table_name) ++ return -1; ++ e->flags |= (1 << NFTNL_EXPR_FLOW_TABLE_NAME); ++ } ++ ++ return ret; ++} ++ ++static int ++nftnl_expr_flow_json_parse(struct nftnl_expr *e, json_t *root, ++ struct nftnl_parse_err *err) ++{ ++#ifdef JSON_PARSING ++ const char *table_name; ++ ++ table_name = nftnl_jansson_parse_str(root, "flowtable", err); ++ if (table_name != NULL) ++ nftnl_expr_set_str(e, NFTNL_EXPR_FLOW_TABLE_NAME, table_name); ++ ++ return 0; ++#else ++ errno = EOPNOTSUPP; ++ return -1; ++#endif ++} ++ ++static int nftnl_expr_flow_export(char *buf, size_t size, ++ const struct nftnl_expr *e, int type) ++{ ++ struct nftnl_expr_flow *l = nftnl_expr_data(e); ++ NFTNL_BUF_INIT(b, buf, size); ++ ++ if (e->flags & (1 << NFTNL_EXPR_FLOW_TABLE_NAME)) ++ nftnl_buf_str(&b, type, l->table_name, SET); ++ ++ return nftnl_buf_done(&b); ++} ++ ++static int nftnl_expr_flow_snprintf_default(char *buf, size_t size, ++ const struct nftnl_expr *e) ++{ ++ int remain = size, offset = 0, ret; ++ struct nftnl_expr_flow *l = nftnl_expr_data(e); ++ ++ ret = snprintf(buf, remain, "flowtable %s ", l->table_name); ++ SNPRINTF_BUFFER_SIZE(ret, remain, offset); ++ ++ return offset; ++} ++ ++static int nftnl_expr_flow_snprintf(char *buf, size_t size, uint32_t type, ++ uint32_t flags, const struct nftnl_expr *e) ++{ ++ switch(type) { ++ case NFTNL_OUTPUT_DEFAULT: ++ return nftnl_expr_flow_snprintf_default(buf, size, e); ++ case NFTNL_OUTPUT_XML: ++ case NFTNL_OUTPUT_JSON: ++ return nftnl_expr_flow_export(buf, size, e, type); ++ default: ++ break; ++ } ++ return -1; ++} ++ ++static void nftnl_expr_flow_free(const struct nftnl_expr *e) ++{ ++ struct nftnl_expr_flow *flow = nftnl_expr_data(e); ++ ++ xfree(flow->table_name); ++} ++ ++static bool nftnl_expr_flow_cmp(const struct nftnl_expr *e1, ++ const struct nftnl_expr *e2) ++{ ++ struct nftnl_expr_flow *l1 = nftnl_expr_data(e1); ++ struct nftnl_expr_flow *l2 = nftnl_expr_data(e2); ++ bool eq = true; ++ ++ if (e1->flags & (1 << NFTNL_EXPR_FLOW_TABLE_NAME)) ++ eq &= !strcmp(l1->table_name, l2->table_name); ++ ++ return eq; ++} ++ ++struct expr_ops expr_ops_flow = { ++ .name = "flow_offload", ++ .alloc_len = sizeof(struct nftnl_expr_flow), ++ .max_attr = NFTA_FLOW_MAX, ++ .free = nftnl_expr_flow_free, ++ .cmp = nftnl_expr_flow_cmp, ++ .set = nftnl_expr_flow_set, ++ .get = nftnl_expr_flow_get, ++ .parse = nftnl_expr_flow_parse, ++ .build = nftnl_expr_flow_build, ++ .snprintf = nftnl_expr_flow_snprintf, ++ .json_parse = nftnl_expr_flow_json_parse, ++}; +--- a/src/expr_ops.c ++++ b/src/expr_ops.c +@@ -33,6 +33,7 @@ extern struct expr_ops expr_ops_target; + extern struct expr_ops expr_ops_dynset; + extern struct expr_ops expr_ops_hash; + extern struct expr_ops expr_ops_fib; ++extern struct expr_ops expr_ops_flow; + + static struct expr_ops expr_ops_notrack = { + .name = "notrack", +@@ -69,6 +70,7 @@ static struct expr_ops *expr_ops[] = { + &expr_ops_hash, + &expr_ops_fib, + &expr_ops_objref, ++ &expr_ops_flow, + NULL, + }; + |