From: "Jose M. Guisado Gomez" <guigom@riseup.net>
To: pablo@netfilter.org
Cc: netfilter-devel@vger.kernel.org
Subject: [PATCH libnftnl 2/3] chain: add userdata and comment support
Date: Mon, 21 Sep 2020 15:28:22 +0200 [thread overview]
Message-ID: <20200921132822.55231-3-guigom@riseup.net> (raw)
In-Reply-To: <20200921132822.55231-1-guigom@riseup.net>
Adds NFTNL_CHAIN_USERDATA, in order to support userdata for chains.
Adds NFTNL_UDATA_CHAIN_COMMENT chain userdata type to support storing a
comment.
Relies on NFTA_CHAIN_USERDATA.
Signed-off-by: Jose M. Guisado Gomez <guigom@riseup.net>
---
include/libnftnl/chain.h | 1 +
include/libnftnl/udata.h | 6 ++++++
include/linux/netfilter/nf_tables.h | 2 ++
src/chain.c | 31 +++++++++++++++++++++++++++++
4 files changed, 40 insertions(+)
diff --git a/include/libnftnl/chain.h b/include/libnftnl/chain.h
index 0e57a5a..f56e581 100644
--- a/include/libnftnl/chain.h
+++ b/include/libnftnl/chain.h
@@ -34,6 +34,7 @@ enum nftnl_chain_attr {
NFTNL_CHAIN_DEVICES,
NFTNL_CHAIN_FLAGS,
NFTNL_CHAIN_ID,
+ NFTNL_CHAIN_USERDATA,
__NFTNL_CHAIN_MAX
};
#define NFTNL_CHAIN_MAX (__NFTNL_CHAIN_MAX - 1)
diff --git a/include/libnftnl/udata.h b/include/libnftnl/udata.h
index 2e38fcc..dbf3a60 100644
--- a/include/libnftnl/udata.h
+++ b/include/libnftnl/udata.h
@@ -15,6 +15,12 @@ enum nftnl_udata_table_types {
};
#define NFTNL_UDATA_TABLE_MAX (__NFTNL_UDATA_TABLE_MAX - 1)
+enum nftnl_udata_chain_types {
+ NFTNL_UDATA_CHAIN_COMMENT,
+ __NFTNL_UDATA_CHAIN_MAX
+};
+#define NFTNL_UDATA_CHAIN_MAX (__NFTNL_UDATA_CHAIN_MAX - 1)
+
enum nftnl_udata_rule_types {
NFTNL_UDATA_RULE_COMMENT,
NFTNL_UDATA_RULE_EBTABLES_POLICY,
diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
index 8099777..77d178a 100644
--- a/include/linux/netfilter/nf_tables.h
+++ b/include/linux/netfilter/nf_tables.h
@@ -197,6 +197,7 @@ enum nft_table_attributes {
* @NFTA_CHAIN_TYPE: type name of the string (NLA_NUL_STRING)
* @NFTA_CHAIN_COUNTERS: counter specification of the chain (NLA_NESTED: nft_counter_attributes)
* @NFTA_CHAIN_FLAGS: chain flags
+ * @NFTA_CHAIN_USERDATA: user data (NLA_BINARY)
*/
enum nft_chain_attributes {
NFTA_CHAIN_UNSPEC,
@@ -211,6 +212,7 @@ enum nft_chain_attributes {
NFTA_CHAIN_PAD,
NFTA_CHAIN_FLAGS,
NFTA_CHAIN_ID,
+ NFTA_CHAIN_USERDATA,
__NFTA_CHAIN_MAX
};
#define NFTA_CHAIN_MAX (__NFTA_CHAIN_MAX - 1)
diff --git a/src/chain.c b/src/chain.c
index 94efa90..aac9da6 100644
--- a/src/chain.c
+++ b/src/chain.c
@@ -51,6 +51,11 @@ struct nftnl_chain {
uint32_t flags;
uint32_t chain_id;
+ struct {
+ void *data;
+ uint32_t len;
+ } user;
+
struct list_head rule_list;
};
@@ -125,6 +130,8 @@ void nftnl_chain_free(const struct nftnl_chain *c)
xfree(c->type);
if (c->flags & (1 << NFTNL_CHAIN_DEV))
xfree(c->dev);
+ if (c->flags & (1 << NFTNL_CHAIN_USERDATA))
+ xfree(c->user.data);
if (c->flags & (1 << NFTNL_CHAIN_DEVICES)) {
for (i = 0; i < c->dev_array_len; i++)
xfree(c->dev_array[i]);
@@ -290,6 +297,16 @@ int nftnl_chain_set_data(struct nftnl_chain *c, uint16_t attr,
case NFTNL_CHAIN_ID:
memcpy(&c->chain_id, data, sizeof(c->chain_id));
break;
+ case NFTNL_CHAIN_USERDATA:
+ if (c->flags & (1 << NFTNL_CHAIN_USERDATA))
+ xfree(c->user.data);
+
+ c->user.data = malloc(data_len);
+ if (!c->user.data)
+ return -1;
+ memcpy(c->user.data, data, data_len);
+ c->user.len = data_len;
+ break;
}
c->flags |= (1 << attr);
return 0;
@@ -391,6 +408,9 @@ const void *nftnl_chain_get_data(const struct nftnl_chain *c, uint16_t attr,
case NFTNL_CHAIN_ID:
*data_len = sizeof(uint32_t);
return &c->chain_id;
+ case NFTNL_CHAIN_USERDATA:
+ *data_len = c->user.len;
+ return c->user.data;
}
return NULL;
}
@@ -513,6 +533,8 @@ void nftnl_chain_nlmsg_build_payload(struct nlmsghdr *nlh, const struct nftnl_ch
mnl_attr_put_u32(nlh, NFTA_CHAIN_FLAGS, htonl(c->chain_flags));
if (c->flags & (1 << NFTNL_CHAIN_ID))
mnl_attr_put_u32(nlh, NFTA_CHAIN_ID, htonl(c->chain_id));
+ if (c->flags & (1 << NFTNL_CHAIN_USERDATA))
+ mnl_attr_put(nlh, NFTA_CHAIN_USERDATA, c->user.len, c->user.data);
}
EXPORT_SYMBOL(nftnl_chain_rule_add);
@@ -576,6 +598,10 @@ static int nftnl_chain_parse_attr_cb(const struct nlattr *attr, void *data)
if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
abi_breakage();
break;
+ case NFTA_CHAIN_USERDATA:
+ if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0)
+ abi_breakage();
+ break;
}
tb[type] = attr;
@@ -777,6 +803,11 @@ int nftnl_chain_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_chain *c)
c->chain_id = ntohl(mnl_attr_get_u32(tb[NFTA_CHAIN_ID]));
c->flags |= (1 << NFTNL_CHAIN_ID);
}
+ if (tb[NFTA_CHAIN_USERDATA]) {
+ nftnl_chain_set_data(c, NFTNL_CHAIN_USERDATA,
+ mnl_attr_get_payload(tb[NFTA_CHAIN_USERDATA]),
+ mnl_attr_get_payload_len(tb[NFTA_CHAIN_USERDATA]));
+ }
c->family = nfg->nfgen_family;
c->flags |= (1 << NFTNL_CHAIN_FAMILY);
--
2.27.0
next prev parent reply other threads:[~2020-09-21 13:35 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-21 13:28 [PATCH 0/3] add userdata and comment support for chains Jose M. Guisado Gomez
2020-09-21 13:28 ` [PATCH nf-next 1/3] netfilter: nf_tables: add userdata attributes to nft_chain Jose M. Guisado Gomez
2020-09-21 23:49 ` Pablo Neira Ayuso
2020-09-21 13:28 ` Jose M. Guisado Gomez [this message]
2020-09-21 13:28 ` [PATCH nftables 3/3] src: add comment support for chains Jose M. Guisado Gomez
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200921132822.55231-3-guigom@riseup.net \
--to=guigom@riseup.net \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).