/* libnfnetlink.c: generic library for communication with netfilter

 *

 * (C) 2002-2006 by Harald Welte <laforge@gnumonks.org>

 * (C) 2006-2011 by Pablo Neira Ayuso <pablo@netfilter.org>

 *

 * Based on some original ideas from Jay Schulist <jschlst@samba.org>

 *

 * Development of this code funded by Astaro AG (http://www.astaro.com)

 *

 * This program is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 as published

 * by the Free Software Foundation.

 *

 * 2005-09-14 Pablo Neira Ayuso <pablo@netfilter.org>: 

 * 	Define structure nfnlhdr

 * 	Added __be64_to_cpu function

 *	Use NFA_TYPE macro to get the attribute type

 *

 * 2006-01-14 Harald Welte <laforge@netfilter.org>:

 * 	introduce nfnl_subsys_handle

 *

 * 2006-01-15 Pablo Neira Ayuso <pablo@netfilter.org>:

 * 	set missing subsys_id in nfnl_subsys_open

 * 	set missing nfnlh->local.nl_pid in nfnl_open

 *

 * 2006-01-26 Harald Welte <laforge@netfilter.org>:

 * 	remove bogus nfnlh->local.nl_pid from nfnl_open ;)

 * 	add 16bit attribute functions

 *

 * 2006-07-03 Pablo Neira Ayuso <pablo@netfilter.org>:

 * 	add iterator API

 * 	add replacements for nfnl_listen and nfnl_talk

 * 	fix error handling

 * 	add assertions

 * 	add documentation

 * 	minor cleanups

 */

#include <stdlib.h>

#include <stdio.h>

#include <unistd.h>

#include <errno.h>

#include <string.h>

#include <time.h>

#include <netinet/in.h>

#include <assert.h>

#include <linux/types.h>

#include <sys/socket.h>

#include <sys/uio.h>

#include <linux/netlink.h>

#include <libnfnetlink/libnfnetlink.h>

#ifndef NETLINK_ADD_MEMBERSHIP

#define NETLINK_ADD_MEMBERSHIP 1

#endif

#ifndef SOL_NETLINK

#define SOL_NETLINK 270

#endif

#define nfnl_error(format, args...) \

	fprintf(stderr, "%s: " format "\n", __FUNCTION__, ## args)

#ifdef _NFNL_DEBUG

#define nfnl_debug_dump_packet nfnl_dump_packet

#else

#define nfnl_debug_dump_packet(a, b, ...)

#endif

struct nfnl_subsys_handle {

	struct nfnl_handle 	*nfnlh;

	u_int32_t		subscriptions;

	u_int8_t		subsys_id;

	u_int8_t		cb_count;

	struct nfnl_callback 	*cb;	/* array of callbacks */

};

#define		NFNL_MAX_SUBSYS			16 /* enough for now */

#define NFNL_F_SEQTRACK_ENABLED		(1 << 0)

struct nfnl_handle {

	int			fd;

	struct sockaddr_nl	local;

	struct sockaddr_nl	peer;

	u_int32_t		subscriptions;

	u_int32_t		seq;

	u_int32_t		dump;

	u_int32_t		rcv_buffer_size;	/* for nfnl_catch */

	u_int32_t		flags;

	struct nlmsghdr 	*last_nlhdr;

	struct nfnl_subsys_handle subsys[NFNL_MAX_SUBSYS+1];

};

void nfnl_dump_packet(struct nlmsghdr *nlh, int received_len, char *desc)

{

	void *nlmsg_data = NLMSG_DATA(nlh);

	struct nfattr *nfa = NFM_NFA(NLMSG_DATA(nlh));

	int len = NFM_PAYLOAD(nlh);

	printf("%s called from %s\n", __FUNCTION__, desc);

	printf("  nlmsghdr = %p, received_len = %u\n", nlh, received_len);

	printf("  NLMSG_DATA(nlh) = %p (+%td bytes)\n", nlmsg_data,

	       (nlmsg_data - (void *)nlh));

	printf("  NFM_NFA(NLMSG_DATA(nlh)) = %p (+%td bytes)\n",

		nfa, ((void *)nfa - (void *)nlh));

	printf("  NFM_PAYLOAD(nlh) = %u\n", len);

	printf("  nlmsg_type = %u, nlmsg_len = %u, nlmsg_seq = %u "

		"nlmsg_flags = 0x%x\n", nlh->nlmsg_type, nlh->nlmsg_len,

		nlh->nlmsg_seq, nlh->nlmsg_flags);

	while (NFA_OK(nfa, len)) {

		printf("    nfa@%p: nfa_type=%u, nfa_len=%u\n",

			nfa, NFA_TYPE(nfa), nfa->nfa_len);

		nfa = NFA_NEXT(nfa,len);

	}

}

/**

 * nfnl_fd - returns the descriptor that identifies the socket

 * @nfnlh: nfnetlink handler

 *

 * Use this function if you need to interact with the socket. Common

 * scenarios are the use of poll()/select() to achieve multiplexation.

 */

int nfnl_fd(struct nfnl_handle *h)

{

	assert(h);

	return h->fd;

}

/**

 * nfnl_portid - returns the Netlink port ID of this socket

 * @h: nfnetlink handler

 */

unsigned int nfnl_portid(const struct nfnl_handle *h)

{

	assert(h);

	return h->local.nl_pid;

}

static int recalc_rebind_subscriptions(struct nfnl_handle *nfnlh)

{

	int i, err;

	u_int32_t new_subscriptions = nfnlh->subscriptions;

	for (i = 0; i < NFNL_MAX_SUBSYS; i++)

		new_subscriptions |= nfnlh->subsys[i].subscriptions;

	nfnlh->local.nl_groups = new_subscriptions;

	err = bind(nfnlh->fd, (struct sockaddr *)&nfnlh->local,

		   sizeof(nfnlh->local));

	if (err == -1)

		return -1;

	nfnlh->subscriptions = new_subscriptions;

	return 0;

}

/**

 * nfnl_open - open a nfnetlink handler

 *

 * This function creates a nfnetlink handler, this is required to establish

 * a communication between the userspace and the nfnetlink system.

 *

 * On success, a valid address that points to a nfnl_handle structure

 * is returned. On error, NULL is returned and errno is set approapiately.

 */

struct nfnl_handle *nfnl_open(void)

{

	struct nfnl_handle *nfnlh;

	unsigned int addr_len;

	nfnlh = malloc(sizeof(*nfnlh));

	if (!nfnlh)

		return NULL;

	memset(nfnlh, 0, sizeof(*nfnlh));

	nfnlh->fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER);

	if (nfnlh->fd == -1)

		goto err_free;

	nfnlh->local.nl_family = AF_NETLINK;

	nfnlh->peer.nl_family = AF_NETLINK;

	addr_len = sizeof(nfnlh->local);

	getsockname(nfnlh->fd, (struct sockaddr *)&nfnlh->local, &addr_len);

	if (addr_len != sizeof(nfnlh->local)) {

		errno = EINVAL;

		goto err_close;

	}

	if (nfnlh->local.nl_family != AF_NETLINK) {

		errno = EINVAL;

		goto err_close;

	}

	nfnlh->seq = time(NULL);

	nfnlh->rcv_buffer_size = NFNL_BUFFSIZE;

	/* don't set pid here, only first socket of process has real pid !!! 

	 * binding to pid '0' will default */

	/* let us do the initial bind */

	if (recalc_rebind_subscriptions(nfnlh) < 0)

		goto err_close;

	/* use getsockname to get the netlink pid that the kernel assigned us */

	addr_len = sizeof(nfnlh->local);

	getsockname(nfnlh->fd, (struct sockaddr *)&nfnlh->local, &addr_len);

	if (addr_len != sizeof(nfnlh->local)) {

		errno = EINVAL;

		goto err_close;

	}

	/* sequence tracking enabled by default */

	nfnlh->flags |= NFNL_F_SEQTRACK_ENABLED;

	return nfnlh;

err_close:

	close(nfnlh->fd);

err_free:

	free(nfnlh);

	return NULL;

}

/**

 * nfnl_set_sequence_tracking - set netlink sequence tracking

 * @h: nfnetlink handler

 */

void nfnl_set_sequence_tracking(struct nfnl_handle *h)

{

	h->flags |= NFNL_F_SEQTRACK_ENABLED;

}

/**

 * nfnl_unset_sequence_tracking - set netlink sequence tracking

 * @h: nfnetlink handler

 */

void nfnl_unset_sequence_tracking(struct nfnl_handle *h)

{

	h->flags &= ~NFNL_F_SEQTRACK_ENABLED;

}

/**

 * nfnl_set_rcv_buffer_size - set the size of the receive buffer

 * @h: libnfnetlink handler

 * @size: buffer size

 *

 * This function sets the size of the receive buffer size, i.e. the size

 * of the buffer used by nfnl_recv. Default value is 4096 bytes.

 */

void nfnl_set_rcv_buffer_size(struct nfnl_handle *h, unsigned int size)

{

	h->rcv_buffer_size = size;

}

/**

 * nfnl_subsys_open - open a netlink subsystem

 * @nfnlh: libnfnetlink handle

 * @subsys_id: which nfnetlink subsystem we are interested in

 * @cb_count: number of callbacks that are used maximum.

 * @subscriptions: netlink groups we want to be subscribed to

 *

 * This function creates a subsystem handler that contains the set of 

 * callbacks that handle certain types of messages coming from a netfilter

 * subsystem. Initially the callback set is empty, you can register callbacks

 * via nfnl_callback_register().

 *

 * On error, NULL is returned and errno is set appropiately. On success,

 * a valid address that points to a nfnl_subsys_handle structure is returned.

 */

struct nfnl_subsys_handle *

nfnl_subsys_open(struct nfnl_handle *nfnlh, u_int8_t subsys_id,

		 u_int8_t cb_count, u_int32_t subscriptions)

{

	struct nfnl_subsys_handle *ssh;

	assert(nfnlh);

	if (subsys_id > NFNL_MAX_SUBSYS) { 

		errno = ENOENT;

		return NULL;

	}

	ssh = &nfnlh->subsys[subsys_id];

	if (ssh->cb) {

		errno = EBUSY;

		return NULL;

	}

	ssh->cb = calloc(cb_count, sizeof(*(ssh->cb)));

	if (!ssh->cb)

		return NULL;

	ssh->nfnlh = nfnlh;

	ssh->cb_count = cb_count;

	ssh->subscriptions = subscriptions;

	ssh->subsys_id = subsys_id;

	/* although now we have nfnl_join to subscribe to certain

	 * groups, just keep this to ensure compatibility */

	if (recalc_rebind_subscriptions(nfnlh) < 0) {

		free(ssh->cb);

		ssh->cb = NULL;

		return NULL;

	}

	return ssh;

}

/**

 * nfnl_subsys_close - close a nfnetlink subsys handler 

 * @ssh: nfnetlink subsystem handler

 *

 * Release all the callbacks registered in a subsystem handler.

 */

void nfnl_subsys_close(struct nfnl_subsys_handle *ssh)

{

	assert(ssh);

	ssh->subscriptions = 0;

	ssh->cb_count = 0;

	if (ssh->cb) {

		free(ssh->cb);

		ssh->cb = NULL;

	}

}

/**

 * nfnl_close - close a nfnetlink handler

 * @nfnlh: nfnetlink handler

 *

 * This function closes the nfnetlink handler. On success, 0 is returned.

 * On error, -1 is returned and errno is set appropiately.

 */

int nfnl_close(struct nfnl_handle *nfnlh)

{

	int i, ret;

	assert(nfnlh);

	for (i = 0; i < NFNL_MAX_SUBSYS; i++)

		nfnl_subsys_close(&nfnlh->subsys[i]);

	ret = close(nfnlh->fd);

	if (ret < 0)

		return ret;

	free(nfnlh);

	return 0;

}

/**

 * nfnl_join - join a nfnetlink multicast group

 * @nfnlh: nfnetlink handler

 * @group: group we want to join

 *

 * This function is used to join a certain multicast group. It must be

 * called once the nfnetlink handler has been created. If any doubt, 

 * just use it if you have to listen to nfnetlink events.

 *

 * On success, 0 is returned. On error, -1 is returned and errno is set

 * approapiately.

 */

int nfnl_join(const struct nfnl_handle *nfnlh, unsigned int group)

{

	assert(nfnlh);

	return setsockopt(nfnlh->fd, SOL_NETLINK, NETLINK_ADD_MEMBERSHIP,

			  &group, sizeof(group));

}

/**

 * nfnl_send - send a nfnetlink message through netlink socket

 * @nfnlh: nfnetlink handler

 * @n: netlink message

 *

 * On success, the number of bytes is returned. On error, -1 is returned 

 * and errno is set appropiately.

 */

int nfnl_send(struct nfnl_handle *nfnlh, struct nlmsghdr *n)

{

	assert(nfnlh);

	assert(n);

	nfnl_debug_dump_packet(n, n->nlmsg_len+sizeof(*n), "nfnl_send");

	return sendto(nfnlh->fd, n, n->nlmsg_len, 0, 

		      (struct sockaddr *)&nfnlh->peer, sizeof(nfnlh->peer));

}

int nfnl_sendmsg(const struct nfnl_handle *nfnlh, const struct msghdr *msg,

		 unsigned int flags)

{

	assert(nfnlh);

	assert(msg);

	return sendmsg(nfnlh->fd, msg, flags);

}

int nfnl_sendiov(const struct nfnl_handle *nfnlh, const struct iovec *iov,

		 unsigned int num, unsigned int flags)

{

	struct msghdr msg;

	assert(nfnlh);

	msg.msg_name = (struct sockaddr *) &nfnlh->peer;

	msg.msg_namelen = sizeof(nfnlh->peer);

	msg.msg_iov = (struct iovec *) iov;

	msg.msg_iovlen = num;

	msg.msg_control = NULL;

	msg.msg_controllen = 0;

	msg.msg_flags = 0;

	return nfnl_sendmsg(nfnlh, &msg, flags);

}

/**

 * nfnl_fill_hdr - fill in netlink and nfnetlink header

 * @nfnlh: nfnetlink handle

 * @nlh: netlink message to be filled in

 * @len: length of _payload_ bytes (not including nfgenmsg)

 * @family: AF_INET / ...

 * @res_id: resource id

 * @msg_type: nfnetlink message type (without subsystem)

 * @msg_flags: netlink message flags

 *

 * This function sets up appropiately the nfnetlink header. See that the

 * pointer to the netlink message passed must point to a memory region of

 * at least the size of struct nlmsghdr + struct nfgenmsg.

 */

void nfnl_fill_hdr(struct nfnl_subsys_handle *ssh,

		    struct nlmsghdr *nlh, unsigned int len, 

		    u_int8_t family,

		    u_int16_t res_id,

		    u_int16_t msg_type,

		    u_int16_t msg_flags)

{

	assert(ssh);

	assert(nlh);

	struct nfgenmsg *nfg = (void *)nlh + sizeof(*nlh);

	nlh->nlmsg_len = NLMSG_LENGTH(len+sizeof(*nfg));

	nlh->nlmsg_type = (ssh->subsys_id<<8)|msg_type;

	nlh->nlmsg_flags = msg_flags;

	nlh->nlmsg_pid = 0;

	if (ssh->nfnlh->flags & NFNL_F_SEQTRACK_ENABLED) {

		nlh->nlmsg_seq = ++ssh->nfnlh->seq;

		/* kernel uses sequence number zero for events */

		if (!ssh->nfnlh->seq)

			nlh->nlmsg_seq = ssh->nfnlh->seq = time(NULL);

	} else {

		/* unset sequence number, ignore it */

		nlh->nlmsg_seq = 0;

	}

	nfg->nfgen_family = family;

	nfg->version = NFNETLINK_V0;

	nfg->res_id = htons(res_id);

}

struct nfattr *

nfnl_parse_hdr(const struct nfnl_handle *nfnlh,

		const struct nlmsghdr *nlh,

		struct nfgenmsg **genmsg)

{

	if (nlh->nlmsg_len < NLMSG_LENGTH(sizeof(struct nfgenmsg)))

		return NULL;

	if (nlh->nlmsg_len == NLMSG_LENGTH(sizeof(struct nfgenmsg))) {

		if (genmsg)

			*genmsg = (void *)nlh + sizeof(*nlh);

		return NULL;

	}

	if (genmsg)

		*genmsg = (void *)nlh + sizeof(*nlh);

	return (void *)nlh + NLMSG_LENGTH(sizeof(struct nfgenmsg));

}

/**

 * nfnl_recv - receive data from a nfnetlink subsystem

 * @h: nfnetlink handler

 * @buf: buffer where the data will be stored

 * @len: size of the buffer

 *

 * This function doesn't perform any sanity checking. So do no expect

 * that the data is well-formed. Such checkings are done by the parsing

 * functions.

 *

 * On success, 0 is returned. On error, -1 is returned and errno is set

 * appropiately.

 *

 * Note that ENOBUFS is returned in case that nfnetlink is exhausted. In

 * that case is possible that the information requested is incomplete.

 */

ssize_t 

nfnl_recv(const struct nfnl_handle *h, unsigned char *buf, size_t len)

{

	socklen_t addrlen;

	int status;

	struct sockaddr_nl peer;

	assert(h);

	assert(buf);

	assert(len > 0);

	if (len < sizeof(struct nlmsgerr)

	    || len < sizeof(struct nlmsghdr)) {

	    	errno = EBADMSG;

		return -1; 

	}

	addrlen = sizeof(h->peer);

	status = recvfrom(h->fd, buf, len, 0, (struct sockaddr *)&peer,	

			&addrlen);

	if (status <= 0)

		return status;

	if (addrlen != sizeof(peer)) {

		errno = EINVAL;

		return -1;

	}

	if (peer.nl_pid != 0) {

		errno = ENOMSG;

		return -1;

	}

	return status;

}

/**

 * nfnl_listen: listen for one or more netlink messages

 * @nfnhl: libnfnetlink handle

 * @handler: callback function to be called for every netlink message

 *          - the callback handler should normally return 0

 *          - but may return a negative error code which will cause

 *            nfnl_listen to return immediately with the same error code

 *          - or return a postivie error code which will cause 

 *            nfnl_listen to return after it has finished processing all

 *            the netlink messages in the current packet

 *          Thus a positive error code will terminate nfnl_listen "soon"

 *          without any loss of data, a negative error code will terminate

 *          nfnl_listen "very soon" and throw away data already read from

 *          the netlink socket.

 * @jarg: opaque argument passed on to callback

 *

 * This function is used to receive and process messages coming from an open

 * nfnetlink handler like events or information request via nfnl_send().

 *

 * On error, -1 is returned, unfortunately errno is not always set

 * appropiately. For that reason, the use of this function is DEPRECATED. 

 * Please, use nfnl_receive_process() instead.

 */

int nfnl_listen(struct nfnl_handle *nfnlh,

		int (*handler)(struct sockaddr_nl *, struct nlmsghdr *n,

			       void *), void *jarg)

{

	struct sockaddr_nl nladdr;

	char buf[NFNL_BUFFSIZE] __attribute__ ((aligned));

	struct iovec iov;

	int remain;

	struct nlmsghdr *h;

	struct nlmsgerr *msgerr;

	int quit=0;

	struct msghdr msg = {

		.msg_name    = &nladdr,

		.msg_namelen = sizeof(nladdr),

		.msg_iov     = &iov,

		.msg_iovlen  = 1,

	};

	memset(&nladdr, 0, sizeof(nladdr));

	nladdr.nl_family = AF_NETLINK;

	iov.iov_base = buf;

	iov.iov_len = sizeof(buf);

	while (! quit) {

		remain = recvmsg(nfnlh->fd, &msg, 0);

		if (remain < 0) {

			if (errno == EINTR)

				continue;

			/* Bad file descriptor */

			else if (errno == EBADF)

				break;

			else if (errno == EAGAIN)

				break;

			nfnl_error("recvmsg overrun: %s", strerror(errno));

			continue;

		}

		if (remain == 0) {

			nfnl_error("EOF on netlink");

			return -1;

		}

		if (msg.msg_namelen != sizeof(nladdr)) {

			nfnl_error("Bad sender address len (%d)",

				   msg.msg_namelen);

			return -1;

		}

		for (h = (struct nlmsghdr *)buf; remain >= sizeof(*h);) {

			int err;

			int len = h->nlmsg_len;

			int l = len - sizeof(*h);

			if (l < 0 || len > remain) {

				if (msg.msg_flags & MSG_TRUNC) {

					nfnl_error("MSG_TRUNC");

					return -1;

				}

				nfnl_error("Malformed msg (len=%d)", len);

				return -1;

			}

			/* end of messages reached, let's return */

			if (h->nlmsg_type == NLMSG_DONE)

				return 0;

			/* Break the loop if success is explicitely

			 * reported via NLM_F_ACK flag set */

			if (h->nlmsg_type == NLMSG_ERROR) {

				msgerr = NLMSG_DATA(h);

				return msgerr->error;

			}

			err = handler(&nladdr, h, jarg);

			if (err < 0)

				return err;

			quit |= err;

			/* FIXME: why not _NEXT macros, etc.? */

			//h = NLMSG_NEXT(h, remain);

			remain -= NLMSG_ALIGN(len);

			h = (struct nlmsghdr *)((char *)h + NLMSG_ALIGN(len));

		}

		if (msg.msg_flags & MSG_TRUNC) {

			nfnl_error("MSG_TRUNC");

			continue;

		}

		if (remain) {

			nfnl_error("remnant size %d", remain);

			return -1;

		}

	}

	return quit;

}

/**

 * nfnl_talk - send a request and then receive and process messages returned

 * @nfnlh: nfnetelink handler

 * @n: netlink message that contains the request

 * @peer: peer PID

 * @groups: netlink groups

 * @junk: callback called if out-of-sequence messages were received

 * @jarg: data for the junk callback

 *

 * This function is used to request an action that does not returns any

 * information. On error, a negative value is returned, errno could be

 * set appropiately. For that reason, the use of this function is DEPRECATED.

 * Please, use nfnl_query() instead.

 */

int nfnl_talk(struct nfnl_handle *nfnlh, struct nlmsghdr *n, pid_t peer,

	      unsigned groups, struct nlmsghdr *answer,

	      int (*junk)(struct sockaddr_nl *, struct nlmsghdr *n, void *),

	      void *jarg)

{

	char buf[NFNL_BUFFSIZE] __attribute__ ((aligned));

	struct sockaddr_nl nladdr;

	struct nlmsghdr *h;

	unsigned int seq;

	int status;

	struct iovec iov = {

		n, n->nlmsg_len

	};

	struct msghdr msg = {

		.msg_name    = &nladdr,

		.msg_namelen = sizeof(nladdr),

		.msg_iov     = &iov,

		.msg_iovlen  = 1,

	};

	memset(&nladdr, 0, sizeof(nladdr));

	nladdr.nl_family = AF_NETLINK;

	nladdr.nl_pid = peer;

	nladdr.nl_groups = groups;

	n->nlmsg_seq = seq = ++nfnlh->seq;

	/* FIXME: why ? */

	if (!answer)

		n->nlmsg_flags |= NLM_F_ACK;

	status = sendmsg(nfnlh->fd, &msg, 0);

	if (status < 0) {

		nfnl_error("sendmsg(netlink) %s", strerror(errno));

		return -1;

	}

	iov.iov_base = buf;

	iov.iov_len = sizeof(buf);

	while (1) {

		status = recvmsg(nfnlh->fd, &msg, 0);

		if (status < 0) {

			if (errno == EINTR)

				continue;

			nfnl_error("recvmsg over-run");

			continue;

		}

		if (status == 0) {

			nfnl_error("EOF on netlink");

			return -1;

		}

		if (msg.msg_namelen != sizeof(nladdr)) {

			nfnl_error("Bad sender address len %d",

				   msg.msg_namelen);

			return -1;

		}

		for (h = (struct nlmsghdr *)buf; status >= sizeof(*h); ) {

			int len = h->nlmsg_len;

			int l = len - sizeof(*h);

			int err;

			if (l < 0 || len > status) {

				if (msg.msg_flags & MSG_TRUNC) {

					nfnl_error("Truncated message\n");

					return -1;

				}

				nfnl_error("Malformed message: len=%d\n", len);

				return -1; /* FIXME: libnetlink exits here */

			}

			if (h->nlmsg_pid != nfnlh->local.nl_pid ||

			    h->nlmsg_seq != seq) {

				if (junk) {

					err = junk(&nladdr, h, jarg);

					if (err < 0)

						return err;

				}

				goto cont;

			}

			if (h->nlmsg_type == NLMSG_ERROR) {

				struct nlmsgerr *err = NLMSG_DATA(h);

				if (l < sizeof(struct nlmsgerr))

					nfnl_error("ERROR truncated\n");

				else {

					errno = -err->error;

					if (errno == 0) {

						if (answer)

							memcpy(answer, h, h->nlmsg_len);

						return 0;

					}

					perror("NFNETLINK answers");

				}

				return err->error;

			}

			if (answer) {

				memcpy(answer, h, h->nlmsg_len);

				return 0;

			}

			nfnl_error("Unexpected reply!\n");

cont:

			status -= NLMSG_ALIGN(len);

			h = (struct nlmsghdr *)((char *)h + NLMSG_ALIGN(len));

		}

		if (msg.msg_flags & MSG_TRUNC) {

			nfnl_error("Messages truncated\n");

			continue;

		}

		if (status)

			nfnl_error("Remnant of size %d\n", status);

	}

}

/**

 * nfnl_addattr_l - Add variable length attribute to nlmsghdr

 * @n: netlink message header to which attribute is to be added

 * @maxlen: maximum length of netlink message header

 * @type: type of new attribute

 * @data: content of new attribute

 * @len: attribute length

 */

int nfnl_addattr_l(struct nlmsghdr *n, int maxlen, int type, const void *data,

		   int alen)

{

	int len = NFA_LENGTH(alen);

	struct nfattr *nfa;

	assert(n);

	assert(maxlen > 0);

	assert(type >= 0);

	if ((NLMSG_ALIGN(n->nlmsg_len) + len) > maxlen) {

		errno = ENOSPC;

		return -1;

	}

	nfa = NLMSG_TAIL(n);

	nfa->nfa_type = type;

	nfa->nfa_len = len;

	memcpy(NFA_DATA(nfa), data, alen);

	n->nlmsg_len = (NLMSG_ALIGN(n->nlmsg_len) + NFA_ALIGN(len));

	return 0;

}

/**

 * nfnl_nfa_addattr_l - Add variable length attribute to struct nfattr 

 *

 * @nfa: struct nfattr

 * @maxlen: maximal length of nfattr buffer

 * @type: type for new attribute

 * @data: content of new attribute

 * @alen: length of new attribute

 *

 */

int nfnl_nfa_addattr_l(struct nfattr *nfa, int maxlen, int type, 

		       const void *data, int alen)

{

	struct nfattr *subnfa;

	int len = NFA_LENGTH(alen);

	assert(nfa);

	assert(maxlen > 0);

	assert(type >= 0);

	if (NFA_ALIGN(nfa->nfa_len) + len > maxlen) {

		errno = ENOSPC;

		return -1;

	}

	subnfa = (struct nfattr *)(((char *)nfa) + NFA_ALIGN(nfa->nfa_len));

	subnfa->nfa_type = type;

	subnfa->nfa_len = len;

	memcpy(NFA_DATA(subnfa), data, alen);

	nfa->nfa_len = NFA_ALIGN(nfa->nfa_len) + len;

	return 0;

}

/**

 * nfnl_addattr8 - Add u_int8_t attribute to nlmsghdr

 *

 * @n: netlink message header to which attribute is to be added

 * @maxlen: maximum length of netlink message header

 * @type: type of new attribute

 * @data: content of new attribute

 */

int nfnl_addattr8(struct nlmsghdr *n, int maxlen, int type, u_int8_t data)

{

	assert(n);

	assert(maxlen > 0);

	assert(type >= 0);

	return nfnl_addattr_l(n, maxlen, type, &data, sizeof(data));

}

/**

 * nfnl_nfa_addattr16 - Add u_int16_t attribute to struct nfattr 

 *

 * @nfa: struct nfattr

 * @maxlen: maximal length of nfattr buffer

 * @type: type for new attribute

 * @data: content of new attribute

 *

 */

int nfnl_nfa_addattr16(struct nfattr *nfa, int maxlen, int type, 

		       u_int16_t data)

{

	assert(nfa);

	assert(maxlen > 0);