|
Packit |
7b22a4 |
/*
|
|
Packit |
7b22a4 |
* (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Packit |
7b22a4 |
*
|
|
Packit |
7b22a4 |
* This program is free software; you can redistribute it and/or modify
|
|
Packit |
7b22a4 |
* it under the terms of the GNU General Public License as published
|
|
Packit |
7b22a4 |
* by the Free Software Foundation; either version 2 of the License, or
|
|
Packit |
7b22a4 |
* (at your option) any later version.
|
|
Packit |
7b22a4 |
*
|
|
Packit |
7b22a4 |
* This code has been sponsored by Sophos Astaro <http://www.sophos.com>
|
|
Packit |
7b22a4 |
*/
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
#include <assert.h>
|
|
Packit |
7b22a4 |
#include <errno.h>
|
|
Packit |
7b22a4 |
#include <string.h>
|
|
Packit |
7b22a4 |
#include <xtables.h>
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
#include <linux/netfilter/nf_tables.h>
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
#include <libmnl/libmnl.h>
|
|
Packit |
7b22a4 |
#include <libnftnl/gen.h>
|
|
Packit |
7b22a4 |
#include <libnftnl/set.h>
|
|
Packit |
7b22a4 |
#include <libnftnl/table.h>
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
#include "nft.h"
|
|
Packit |
7b22a4 |
#include "nft-cache.h"
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int genid_cb(const struct nlmsghdr *nlh, void *data)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
uint32_t *genid = data;
|
|
Packit |
7b22a4 |
struct nftnl_gen *gen;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
gen = nftnl_gen_alloc();
|
|
Packit |
7b22a4 |
if (!gen)
|
|
Packit |
7b22a4 |
return MNL_CB_ERROR;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (nftnl_gen_nlmsg_parse(nlh, gen) < 0)
|
|
Packit |
7b22a4 |
goto out;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
*genid = nftnl_gen_get_u32(gen, NFTNL_GEN_ID);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
nftnl_gen_free(gen);
|
|
Packit |
7b22a4 |
return MNL_CB_STOP;
|
|
Packit |
7b22a4 |
out:
|
|
Packit |
7b22a4 |
nftnl_gen_free(gen);
|
|
Packit |
7b22a4 |
return MNL_CB_ERROR;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static void mnl_genid_get(struct nft_handle *h, uint32_t *genid)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
char buf[MNL_SOCKET_BUFFER_SIZE];
|
|
Packit |
7b22a4 |
struct nlmsghdr *nlh;
|
|
Packit |
7b22a4 |
int ret;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
nlh = nftnl_nlmsg_build_hdr(buf, NFT_MSG_GETGEN, 0, 0, h->seq);
|
|
Packit |
7b22a4 |
ret = mnl_talk(h, nlh, genid_cb, genid);
|
|
Packit |
7b22a4 |
if (ret == 0)
|
|
Packit |
7b22a4 |
return;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
xtables_error(RESOURCE_PROBLEM,
|
|
Packit |
7b22a4 |
"Could not fetch rule set generation id: %s\n", nft_strerror(errno));
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int nftnl_table_list_cb(const struct nlmsghdr *nlh, void *data)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
struct nftnl_table *t;
|
|
Packit |
7b22a4 |
struct nftnl_table_list *list = data;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
t = nftnl_table_alloc();
|
|
Packit |
7b22a4 |
if (t == NULL)
|
|
Packit |
7b22a4 |
goto err;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (nftnl_table_nlmsg_parse(nlh, t) < 0)
|
|
Packit |
7b22a4 |
goto out;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
nftnl_table_list_add_tail(t, list);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
return MNL_CB_OK;
|
|
Packit |
7b22a4 |
out:
|
|
Packit |
7b22a4 |
nftnl_table_free(t);
|
|
Packit |
7b22a4 |
err:
|
|
Packit |
7b22a4 |
return MNL_CB_OK;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int fetch_table_cache(struct nft_handle *h)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
char buf[16536];
|
|
Packit |
7b22a4 |
struct nlmsghdr *nlh;
|
|
Packit |
7b22a4 |
struct nftnl_table_list *list;
|
|
Packit |
7b22a4 |
int ret;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (h->cache->tables)
|
|
Packit |
7b22a4 |
return 0;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
list = nftnl_table_list_alloc();
|
|
Packit |
7b22a4 |
if (list == NULL)
|
|
Packit |
7b22a4 |
return 0;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
nlh = nftnl_rule_nlmsg_build_hdr(buf, NFT_MSG_GETTABLE, h->family,
|
|
Packit |
7b22a4 |
NLM_F_DUMP, h->seq);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
ret = mnl_talk(h, nlh, nftnl_table_list_cb, list);
|
|
Packit |
7b22a4 |
if (ret < 0 && errno == EINTR)
|
|
Packit |
7b22a4 |
assert(nft_restart(h) >= 0);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
h->cache->tables = list;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
return 1;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
struct nftnl_chain_list_cb_data {
|
|
Packit |
7b22a4 |
struct nft_handle *h;
|
|
Packit |
7b22a4 |
const struct builtin_table *t;
|
|
Packit |
7b22a4 |
};
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int nftnl_chain_list_cb(const struct nlmsghdr *nlh, void *data)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
struct nftnl_chain_list_cb_data *d = data;
|
|
Packit |
7b22a4 |
const struct builtin_table *t = d->t;
|
|
Packit |
7b22a4 |
struct nftnl_chain_list *list;
|
|
Packit |
7b22a4 |
struct nft_handle *h = d->h;
|
|
Packit |
7b22a4 |
const char *tname, *cname;
|
|
Packit |
7b22a4 |
struct nftnl_chain *c;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
c = nftnl_chain_alloc();
|
|
Packit |
7b22a4 |
if (c == NULL)
|
|
Packit |
7b22a4 |
goto err;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (nftnl_chain_nlmsg_parse(nlh, c) < 0)
|
|
Packit |
7b22a4 |
goto out;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
tname = nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (!t) {
|
|
Packit |
7b22a4 |
t = nft_table_builtin_find(h, tname);
|
|
Packit |
7b22a4 |
if (!t)
|
|
Packit |
7b22a4 |
goto out;
|
|
Packit |
7b22a4 |
} else if (strcmp(t->name, tname)) {
|
|
Packit |
7b22a4 |
goto out;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
list = h->cache->table[t->type].chains;
|
|
Packit |
7b22a4 |
cname = nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (nftnl_chain_list_lookup_byname(list, cname))
|
|
Packit |
7b22a4 |
goto out;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
nftnl_chain_list_add_tail(c, list);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
return MNL_CB_OK;
|
|
Packit |
7b22a4 |
out:
|
|
Packit |
7b22a4 |
nftnl_chain_free(c);
|
|
Packit |
7b22a4 |
err:
|
|
Packit |
7b22a4 |
return MNL_CB_OK;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
struct nftnl_set_list_cb_data {
|
|
Packit |
7b22a4 |
struct nft_handle *h;
|
|
Packit |
7b22a4 |
const struct builtin_table *t;
|
|
Packit |
7b22a4 |
};
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int nftnl_set_list_cb(const struct nlmsghdr *nlh, void *data)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
struct nftnl_set_list_cb_data *d = data;
|
|
Packit |
7b22a4 |
const struct builtin_table *t = d->t;
|
|
Packit |
7b22a4 |
struct nftnl_set_list *list;
|
|
Packit |
7b22a4 |
struct nft_handle *h = d->h;
|
|
Packit |
7b22a4 |
const char *tname, *sname;
|
|
Packit |
7b22a4 |
struct nftnl_set *s;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
s = nftnl_set_alloc();
|
|
Packit |
7b22a4 |
if (s == NULL)
|
|
Packit |
7b22a4 |
return MNL_CB_OK;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (nftnl_set_nlmsg_parse(nlh, s) < 0)
|
|
Packit |
7b22a4 |
goto out_free;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
tname = nftnl_set_get_str(s, NFTNL_SET_TABLE);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (!t)
|
|
Packit |
7b22a4 |
t = nft_table_builtin_find(h, tname);
|
|
Packit |
7b22a4 |
else if (strcmp(t->name, tname))
|
|
Packit |
7b22a4 |
goto out_free;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (!t)
|
|
Packit |
7b22a4 |
goto out_free;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
list = h->cache->table[t->type].sets;
|
|
Packit |
7b22a4 |
sname = nftnl_set_get_str(s, NFTNL_SET_NAME);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (nftnl_set_list_lookup_byname(list, sname))
|
|
Packit |
7b22a4 |
goto out_free;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
nftnl_set_list_add_tail(s, list);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
return MNL_CB_OK;
|
|
Packit |
7b22a4 |
out_free:
|
|
Packit |
7b22a4 |
nftnl_set_free(s);
|
|
Packit |
7b22a4 |
return MNL_CB_OK;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int set_elem_cb(const struct nlmsghdr *nlh, void *data)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
return nftnl_set_elems_nlmsg_parse(nlh, data) ? -1 : MNL_CB_OK;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static bool set_has_elements(struct nftnl_set *s)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
struct nftnl_set_elems_iter *iter;
|
|
Packit |
7b22a4 |
bool ret = false;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
iter = nftnl_set_elems_iter_create(s);
|
|
Packit |
7b22a4 |
if (iter) {
|
|
Packit |
7b22a4 |
ret = !!nftnl_set_elems_iter_cur(iter);
|
|
Packit |
7b22a4 |
nftnl_set_elems_iter_destroy(iter);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
return ret;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int set_fetch_elem_cb(struct nftnl_set *s, void *data)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
char buf[MNL_SOCKET_BUFFER_SIZE];
|
|
Packit |
7b22a4 |
struct nft_handle *h = data;
|
|
Packit |
7b22a4 |
struct nlmsghdr *nlh;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (set_has_elements(s))
|
|
Packit |
7b22a4 |
return 0;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
nlh = nftnl_nlmsg_build_hdr(buf, NFT_MSG_GETSETELEM, h->family,
|
|
Packit |
7b22a4 |
NLM_F_DUMP, h->seq);
|
|
Packit |
7b22a4 |
nftnl_set_elems_nlmsg_build_payload(nlh, s);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
return mnl_talk(h, nlh, set_elem_cb, s);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int fetch_set_cache(struct nft_handle *h,
|
|
Packit |
7b22a4 |
const struct builtin_table *t, const char *set)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
struct nftnl_set_list_cb_data d = {
|
|
Packit |
7b22a4 |
.h = h,
|
|
Packit |
7b22a4 |
.t = t,
|
|
Packit |
7b22a4 |
};
|
|
Packit |
7b22a4 |
struct nlmsghdr *nlh;
|
|
Packit |
7b22a4 |
char buf[16536];
|
|
Packit |
7b22a4 |
int i, ret;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (!t) {
|
|
Packit |
7b22a4 |
for (i = 0; i < NFT_TABLE_MAX; i++) {
|
|
Packit |
7b22a4 |
enum nft_table_type type = h->tables[i].type;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (!h->tables[i].name)
|
|
Packit |
7b22a4 |
continue;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
h->cache->table[type].sets = nftnl_set_list_alloc();
|
|
Packit |
7b22a4 |
if (!h->cache->table[type].sets)
|
|
Packit |
7b22a4 |
return -1;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
} else if (!h->cache->table[t->type].sets) {
|
|
Packit |
7b22a4 |
h->cache->table[t->type].sets = nftnl_set_list_alloc();
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (t && set) {
|
|
Packit |
7b22a4 |
struct nftnl_set *s = nftnl_set_alloc();
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (!s)
|
|
Packit |
7b22a4 |
return -1;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
nlh = nftnl_set_nlmsg_build_hdr(buf, NFT_MSG_GETSET, h->family,
|
|
Packit |
7b22a4 |
NLM_F_ACK, h->seq);
|
|
Packit |
7b22a4 |
nftnl_set_set_str(s, NFTNL_SET_TABLE, t->name);
|
|
Packit |
7b22a4 |
nftnl_set_set_str(s, NFTNL_SET_NAME, set);
|
|
Packit |
7b22a4 |
nftnl_set_nlmsg_build_payload(nlh, s);
|
|
Packit |
7b22a4 |
nftnl_set_free(s);
|
|
Packit |
7b22a4 |
} else {
|
|
Packit |
7b22a4 |
nlh = nftnl_set_nlmsg_build_hdr(buf, NFT_MSG_GETSET, h->family,
|
|
Packit |
7b22a4 |
NLM_F_DUMP, h->seq);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
ret = mnl_talk(h, nlh, nftnl_set_list_cb, &d);
|
|
Packit |
7b22a4 |
if (ret < 0 && errno == EINTR) {
|
|
Packit |
7b22a4 |
assert(nft_restart(h) >= 0);
|
|
Packit |
7b22a4 |
return ret;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (t && set) {
|
|
Packit |
7b22a4 |
struct nftnl_set *s;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
s = nftnl_set_list_lookup_byname(h->cache->table[t->type].sets,
|
|
Packit |
7b22a4 |
set);
|
|
Packit |
7b22a4 |
set_fetch_elem_cb(s, h);
|
|
Packit |
7b22a4 |
} else if (t) {
|
|
Packit |
7b22a4 |
nftnl_set_list_foreach(h->cache->table[t->type].sets,
|
|
Packit |
7b22a4 |
set_fetch_elem_cb, h);
|
|
Packit |
7b22a4 |
} else {
|
|
Packit |
7b22a4 |
for (i = 0; i < NFT_TABLE_MAX; i++) {
|
|
Packit |
7b22a4 |
enum nft_table_type type = h->tables[i].type;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (!h->tables[i].name)
|
|
Packit |
7b22a4 |
continue;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
nftnl_set_list_foreach(h->cache->table[type].sets,
|
|
Packit |
7b22a4 |
set_fetch_elem_cb, h);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
return ret;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int fetch_chain_cache(struct nft_handle *h,
|
|
Packit |
7b22a4 |
const struct builtin_table *t,
|
|
Packit |
7b22a4 |
const char *chain)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
struct nftnl_chain_list_cb_data d = {
|
|
Packit |
7b22a4 |
.h = h,
|
|
Packit |
7b22a4 |
.t = t,
|
|
Packit |
7b22a4 |
};
|
|
Packit |
7b22a4 |
char buf[16536];
|
|
Packit |
7b22a4 |
struct nlmsghdr *nlh;
|
|
Packit |
7b22a4 |
int i, ret;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (!t) {
|
|
Packit |
7b22a4 |
for (i = 0; i < NFT_TABLE_MAX; i++) {
|
|
Packit |
7b22a4 |
enum nft_table_type type = h->tables[i].type;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (!h->tables[i].name)
|
|
Packit |
7b22a4 |
continue;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (h->cache->table[type].chains)
|
|
Packit |
7b22a4 |
continue;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
h->cache->table[type].chains = nftnl_chain_list_alloc();
|
|
Packit |
7b22a4 |
if (!h->cache->table[type].chains)
|
|
Packit |
7b22a4 |
return -1;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
} else if (!h->cache->table[t->type].chains) {
|
|
Packit |
7b22a4 |
h->cache->table[t->type].chains = nftnl_chain_list_alloc();
|
|
Packit |
7b22a4 |
if (!h->cache->table[t->type].chains)
|
|
Packit |
7b22a4 |
return -1;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (t && chain) {
|
|
Packit |
7b22a4 |
struct nftnl_chain *c = nftnl_chain_alloc();
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (!c)
|
|
Packit |
7b22a4 |
return -1;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
nlh = nftnl_chain_nlmsg_build_hdr(buf, NFT_MSG_GETCHAIN,
|
|
Packit |
7b22a4 |
h->family, NLM_F_ACK,
|
|
Packit |
7b22a4 |
h->seq);
|
|
Packit |
7b22a4 |
nftnl_chain_set_str(c, NFTNL_CHAIN_TABLE, t->name);
|
|
Packit |
7b22a4 |
nftnl_chain_set_str(c, NFTNL_CHAIN_NAME, chain);
|
|
Packit |
7b22a4 |
nftnl_chain_nlmsg_build_payload(nlh, c);
|
|
Packit |
7b22a4 |
nftnl_chain_free(c);
|
|
Packit |
7b22a4 |
} else {
|
|
Packit |
7b22a4 |
nlh = nftnl_chain_nlmsg_build_hdr(buf, NFT_MSG_GETCHAIN,
|
|
Packit |
7b22a4 |
h->family, NLM_F_DUMP,
|
|
Packit |
7b22a4 |
h->seq);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
ret = mnl_talk(h, nlh, nftnl_chain_list_cb, &d);
|
|
Packit |
7b22a4 |
if (ret < 0 && errno == EINTR)
|
|
Packit |
7b22a4 |
assert(nft_restart(h) >= 0);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
return ret;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int nftnl_rule_list_cb(const struct nlmsghdr *nlh, void *data)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
struct nftnl_chain *c = data;
|
|
Packit |
7b22a4 |
struct nftnl_rule *r;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
r = nftnl_rule_alloc();
|
|
Packit |
7b22a4 |
if (r == NULL)
|
|
Packit |
7b22a4 |
return MNL_CB_OK;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (nftnl_rule_nlmsg_parse(nlh, r) < 0) {
|
|
Packit |
7b22a4 |
nftnl_rule_free(r);
|
|
Packit |
7b22a4 |
return MNL_CB_OK;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
nftnl_chain_rule_add_tail(r, c);
|
|
Packit |
7b22a4 |
return MNL_CB_OK;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int nft_rule_list_update(struct nftnl_chain *c, void *data)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
struct nft_handle *h = data;
|
|
Packit |
7b22a4 |
char buf[16536];
|
|
Packit |
7b22a4 |
struct nlmsghdr *nlh;
|
|
Packit |
7b22a4 |
struct nftnl_rule *rule;
|
|
Packit |
7b22a4 |
int ret;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (nftnl_rule_lookup_byindex(c, 0))
|
|
Packit |
7b22a4 |
return 0;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
rule = nftnl_rule_alloc();
|
|
Packit |
7b22a4 |
if (!rule)
|
|
Packit |
7b22a4 |
return -1;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
nftnl_rule_set_str(rule, NFTNL_RULE_TABLE,
|
|
Packit |
7b22a4 |
nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE));
|
|
Packit |
7b22a4 |
nftnl_rule_set_str(rule, NFTNL_RULE_CHAIN,
|
|
Packit |
7b22a4 |
nftnl_chain_get_str(c, NFTNL_CHAIN_NAME));
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
nlh = nftnl_rule_nlmsg_build_hdr(buf, NFT_MSG_GETRULE, h->family,
|
|
Packit |
7b22a4 |
NLM_F_DUMP, h->seq);
|
|
Packit |
7b22a4 |
nftnl_rule_nlmsg_build_payload(nlh, rule);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
ret = mnl_talk(h, nlh, nftnl_rule_list_cb, c);
|
|
Packit |
7b22a4 |
if (ret < 0 && errno == EINTR)
|
|
Packit |
7b22a4 |
assert(nft_restart(h) >= 0);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
nftnl_rule_free(rule);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (h->family == NFPROTO_BRIDGE)
|
|
Packit |
7b22a4 |
nft_bridge_chain_postprocess(h, c);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
return 0;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int fetch_rule_cache(struct nft_handle *h,
|
|
Packit |
7b22a4 |
const struct builtin_table *t, const char *chain)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
int i;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (t) {
|
|
Packit |
7b22a4 |
struct nftnl_chain_list *list;
|
|
Packit |
7b22a4 |
struct nftnl_chain *c;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
list = h->cache->table[t->type].chains;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (chain) {
|
|
Packit |
7b22a4 |
c = nftnl_chain_list_lookup_byname(list, chain);
|
|
Packit |
7b22a4 |
return nft_rule_list_update(c, h);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
return nftnl_chain_list_foreach(list, nft_rule_list_update, h);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
for (i = 0; i < NFT_TABLE_MAX; i++) {
|
|
Packit |
7b22a4 |
enum nft_table_type type = h->tables[i].type;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (!h->tables[i].name)
|
|
Packit |
7b22a4 |
continue;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (nftnl_chain_list_foreach(h->cache->table[type].chains,
|
|
Packit |
7b22a4 |
nft_rule_list_update, h))
|
|
Packit |
7b22a4 |
return -1;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
return 0;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static void
|
|
Packit |
7b22a4 |
__nft_build_cache(struct nft_handle *h, enum nft_cache_level level,
|
|
Packit |
7b22a4 |
const struct builtin_table *t, const char *set,
|
|
Packit |
7b22a4 |
const char *chain)
|
|
Packit |
7b22a4 |
{
|
|
Packit Service |
635b90 |
uint32_t genid_start, genid_stop;
|
|
Packit Service |
635b90 |
|
|
Packit |
7b22a4 |
if (level <= h->cache_level)
|
|
Packit |
7b22a4 |
return;
|
|
Packit Service |
635b90 |
retry:
|
|
Packit Service |
635b90 |
mnl_genid_get(h, &genid_start);
|
|
Packit |
7b22a4 |
|
|
Packit Service |
635b90 |
if (h->cache_level && genid_start != h->nft_genid)
|
|
Packit Service |
635b90 |
flush_chain_cache(h, NULL);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
switch (h->cache_level) {
|
|
Packit |
7b22a4 |
case NFT_CL_NONE:
|
|
Packit |
7b22a4 |
fetch_table_cache(h);
|
|
Packit |
7b22a4 |
if (level == NFT_CL_TABLES)
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
/* fall through */
|
|
Packit |
7b22a4 |
case NFT_CL_TABLES:
|
|
Packit |
7b22a4 |
fetch_chain_cache(h, t, chain);
|
|
Packit |
7b22a4 |
if (level == NFT_CL_CHAINS)
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
/* fall through */
|
|
Packit |
7b22a4 |
case NFT_CL_CHAINS:
|
|
Packit |
7b22a4 |
fetch_set_cache(h, t, set);
|
|
Packit |
7b22a4 |
if (level == NFT_CL_SETS)
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
/* fall through */
|
|
Packit |
7b22a4 |
case NFT_CL_SETS:
|
|
Packit |
7b22a4 |
fetch_rule_cache(h, t, chain);
|
|
Packit |
7b22a4 |
if (level == NFT_CL_RULES)
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
/* fall through */
|
|
Packit |
7b22a4 |
case NFT_CL_RULES:
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit Service |
635b90 |
mnl_genid_get(h, &genid_stop);
|
|
Packit Service |
635b90 |
if (genid_start != genid_stop) {
|
|
Packit Service |
635b90 |
flush_chain_cache(h, NULL);
|
|
Packit Service |
635b90 |
goto retry;
|
|
Packit Service |
635b90 |
}
|
|
Packit Service |
635b90 |
|
|
Packit |
7b22a4 |
if (!t && !chain)
|
|
Packit |
7b22a4 |
h->cache_level = level;
|
|
Packit |
7b22a4 |
else if (h->cache_level < NFT_CL_TABLES)
|
|
Packit |
7b22a4 |
h->cache_level = NFT_CL_TABLES;
|
|
Packit Service |
635b90 |
|
|
Packit Service |
635b90 |
h->nft_genid = genid_start;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
void nft_build_cache(struct nft_handle *h, struct nftnl_chain *c)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
const struct builtin_table *t;
|
|
Packit |
7b22a4 |
const char *table, *chain;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (!c)
|
|
Packit |
7b22a4 |
return __nft_build_cache(h, NFT_CL_RULES, NULL, NULL, NULL);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
table = nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE);
|
|
Packit |
7b22a4 |
chain = nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
|
|
Packit |
7b22a4 |
t = nft_table_builtin_find(h, table);
|
|
Packit |
7b22a4 |
__nft_build_cache(h, NFT_CL_RULES, t, NULL, chain);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
void nft_fake_cache(struct nft_handle *h)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
int i;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
fetch_table_cache(h);
|
|
Packit |
7b22a4 |
for (i = 0; i < NFT_TABLE_MAX; i++) {
|
|
Packit |
7b22a4 |
enum nft_table_type type = h->tables[i].type;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (!h->tables[i].name)
|
|
Packit |
7b22a4 |
continue;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
h->cache->table[type].chains = nftnl_chain_list_alloc();
|
|
Packit |
7b22a4 |
}
|
|
Packit Service |
635b90 |
h->cache_level = NFT_CL_RULES;
|
|
Packit |
7b22a4 |
mnl_genid_get(h, &h->nft_genid);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static void __nft_flush_cache(struct nft_handle *h)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
if (!h->cache_index) {
|
|
Packit |
7b22a4 |
h->cache_index++;
|
|
Packit |
7b22a4 |
h->cache = &h->__cache[h->cache_index];
|
|
Packit |
7b22a4 |
} else {
|
|
Packit |
7b22a4 |
flush_chain_cache(h, NULL);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int ____flush_rule_cache(struct nftnl_rule *r, void *data)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
nftnl_rule_list_del(r);
|
|
Packit |
7b22a4 |
nftnl_rule_free(r);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
return 0;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int __flush_rule_cache(struct nftnl_chain *c, void *data)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
return nftnl_rule_foreach(c, ____flush_rule_cache, NULL);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
int flush_rule_cache(struct nft_handle *h, const char *table,
|
|
Packit |
7b22a4 |
struct nftnl_chain *c)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
const struct builtin_table *t;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (c)
|
|
Packit |
7b22a4 |
return __flush_rule_cache(c, NULL);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
t = nft_table_builtin_find(h, table);
|
|
Packit |
7b22a4 |
if (!t || !h->cache->table[t->type].chains)
|
|
Packit |
7b22a4 |
return 0;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
return nftnl_chain_list_foreach(h->cache->table[t->type].chains,
|
|
Packit |
7b22a4 |
__flush_rule_cache, NULL);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int __flush_chain_cache(struct nftnl_chain *c, void *data)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
nftnl_chain_list_del(c);
|
|
Packit |
7b22a4 |
nftnl_chain_free(c);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
return 0;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int __flush_set_cache(struct nftnl_set *s, void *data)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
nftnl_set_list_del(s);
|
|
Packit |
7b22a4 |
nftnl_set_free(s);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
return 0;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int flush_cache(struct nft_handle *h, struct nft_cache *c,
|
|
Packit |
7b22a4 |
const char *tablename)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
const struct builtin_table *table;
|
|
Packit |
7b22a4 |
int i;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (tablename) {
|
|
Packit |
7b22a4 |
table = nft_table_builtin_find(h, tablename);
|
|
Packit |
7b22a4 |
if (!table)
|
|
Packit |
7b22a4 |
return 0;
|
|
Packit |
7b22a4 |
if (c->table[table->type].chains)
|
|
Packit |
7b22a4 |
nftnl_chain_list_foreach(c->table[table->type].chains,
|
|
Packit |
7b22a4 |
__flush_chain_cache, NULL);
|
|
Packit |
7b22a4 |
if (c->table[table->type].sets)
|
|
Packit |
7b22a4 |
nftnl_set_list_foreach(c->table[table->type].sets,
|
|
Packit |
7b22a4 |
__flush_set_cache, NULL);
|
|
Packit |
7b22a4 |
return 0;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
for (i = 0; i < NFT_TABLE_MAX; i++) {
|
|
Packit |
7b22a4 |
if (h->tables[i].name == NULL)
|
|
Packit |
7b22a4 |
continue;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (!c->table[i].chains)
|
|
Packit |
7b22a4 |
continue;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
nftnl_chain_list_free(c->table[i].chains);
|
|
Packit |
7b22a4 |
c->table[i].chains = NULL;
|
|
Packit |
7b22a4 |
if (c->table[i].sets)
|
|
Packit |
7b22a4 |
nftnl_set_list_free(c->table[i].sets);
|
|
Packit |
7b22a4 |
c->table[i].sets = NULL;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
nftnl_table_list_free(c->tables);
|
|
Packit |
7b22a4 |
c->tables = NULL;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
return 1;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
void flush_chain_cache(struct nft_handle *h, const char *tablename)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
if (!h->cache_level)
|
|
Packit |
7b22a4 |
return;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (flush_cache(h, h->cache, tablename))
|
|
Packit |
7b22a4 |
h->cache_level = NFT_CL_NONE;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
void nft_rebuild_cache(struct nft_handle *h)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
enum nft_cache_level level = h->cache_level;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (h->cache_level)
|
|
Packit |
7b22a4 |
__nft_flush_cache(h);
|
|
Packit |
7b22a4 |
|
|
Packit Service |
635b90 |
h->cache_level = NFT_CL_NONE;
|
|
Packit Service |
635b90 |
__nft_build_cache(h, level, NULL, NULL, NULL);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
void nft_release_cache(struct nft_handle *h)
|
|
Packit |
7b22a4 |
{
|
|
Packit Service |
635b90 |
if (h->cache_index)
|
|
Packit Service |
635b90 |
flush_cache(h, &h->__cache[0], NULL);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
struct nftnl_table_list *nftnl_table_list_get(struct nft_handle *h)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
__nft_build_cache(h, NFT_CL_TABLES, NULL, NULL, NULL);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
return h->cache->tables;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
struct nftnl_set_list *
|
|
Packit |
7b22a4 |
nft_set_list_get(struct nft_handle *h, const char *table, const char *set)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
const struct builtin_table *t;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
t = nft_table_builtin_find(h, table);
|
|
Packit |
7b22a4 |
if (!t)
|
|
Packit |
7b22a4 |
return NULL;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
__nft_build_cache(h, NFT_CL_RULES, t, set, NULL);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
return h->cache->table[t->type].sets;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
struct nftnl_chain_list *
|
|
Packit |
7b22a4 |
nft_chain_list_get(struct nft_handle *h, const char *table, const char *chain)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
const struct builtin_table *t;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
t = nft_table_builtin_find(h, table);
|
|
Packit |
7b22a4 |
if (!t)
|
|
Packit |
7b22a4 |
return NULL;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
__nft_build_cache(h, NFT_CL_CHAINS, t, NULL, chain);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
return h->cache->table[t->type].chains;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|