/*

 * Copyright (c) 2013-2017 Pablo Neira Ayuso <pablo@netfilter.org>

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 as

 * published by the Free Software Foundation.

 *

 * Development of this code funded by Astaro AG (http://www.astaro.com/)

 */

#include <libmnl/libmnl.h>

#include <libnftnl/common.h>

#include <libnftnl/ruleset.h>

#include <libnftnl/table.h>

#include <libnftnl/chain.h>

#include <libnftnl/rule.h>

#include <libnftnl/expr.h>

#include <libnftnl/set.h>

#include <libnftnl/object.h>

#include <libnftnl/flowtable.h>

#include <libnftnl/batch.h>

#include <libnftnl/udata.h>

#include <linux/netfilter/nfnetlink.h>

#include <linux/netfilter/nf_tables.h>

#include <mnl.h>

#include <string.h>

#include <sys/socket.h>

#include <arpa/inet.h>

#include <fcntl.h>

#include <errno.h>

#include <stdlib.h>

#include <utils.h>

#include <nftables.h>

struct mnl_socket *nft_mnl_socket_open(void)

{

	struct mnl_socket *nf_sock;

	nf_sock = mnl_socket_open(NETLINK_NETFILTER);

	if (!nf_sock)

		netlink_init_error();

	if (fcntl(mnl_socket_get_fd(nf_sock), F_SETFL, O_NONBLOCK))

		netlink_init_error();

	return nf_sock;

}

struct mnl_socket *nft_mnl_socket_reopen(struct mnl_socket *nf_sock)

{

	mnl_socket_close(nf_sock);

	return nft_mnl_socket_open();

}

uint32_t mnl_seqnum_alloc(unsigned int *seqnum)

{

	return (*seqnum)++;

}

/* The largest nf_tables netlink message is the set element message, which

 * contains the NFTA_SET_ELEM_LIST_ELEMENTS attribute. This attribute is

 * a nest that describes the set elements. Given that the netlink attribute

 * length (nla_len) is 16 bits, the largest message is a bit larger than

 * 64 KBytes.

 */

#define NFT_NLMSG_MAXSIZE (UINT16_MAX + getpagesize())

static int

nft_mnl_recv(struct netlink_ctx *ctx, uint32_t portid,

	     int (*cb)(const struct nlmsghdr *nlh, void *data), void *cb_data)

{

	char buf[NFT_NLMSG_MAXSIZE];

	int ret;

	ret = mnl_socket_recvfrom(ctx->nft->nf_sock, buf, sizeof(buf));

	while (ret > 0) {

		ret = mnl_cb_run(buf, ret, ctx->seqnum, portid, cb, cb_data);

		if (ret <= 0)

			goto out;

		ret = mnl_socket_recvfrom(ctx->nft->nf_sock, buf, sizeof(buf));

	}

out:

	if (ret < 0 && errno == EAGAIN)

		return 0;

	return ret;

}

int

nft_mnl_talk(struct netlink_ctx *ctx, const void *data, unsigned int len,

	     int (*cb)(const struct nlmsghdr *nlh, void *data), void *cb_data)

{

	uint32_t portid = mnl_socket_get_portid(ctx->nft->nf_sock);

	if (ctx->nft->debug_mask & NFT_DEBUG_MNL)

		mnl_nlmsg_fprintf(ctx->nft->output.output_fp, data, len,

				  sizeof(struct nfgenmsg));

	if (mnl_socket_sendto(ctx->nft->nf_sock, data, len) < 0)

		return -1;

	return nft_mnl_recv(ctx, portid, cb, cb_data);

}

/*

 * Rule-set consistency check across several netlink dumps

 */

static uint32_t nft_genid;

static int genid_cb(const struct nlmsghdr *nlh, void *data)

{

	struct nfgenmsg *nfh = mnl_nlmsg_get_payload(nlh);

	nft_genid = ntohs(nfh->res_id);

	return MNL_CB_OK;

}

uint32_t mnl_genid_get(struct netlink_ctx *ctx)

{

	char buf[MNL_SOCKET_BUFFER_SIZE];

	struct nlmsghdr *nlh;

	nlh = nftnl_nlmsg_build_hdr(buf, NFT_MSG_GETGEN, AF_UNSPEC, 0, ctx->seqnum);

	/* Skip error checking, old kernels sets res_id field to zero. */

	nft_mnl_talk(ctx, nlh, nlh->nlmsg_len, genid_cb, NULL);

	return nft_genid;

}

static uint16_t nft_genid_u16(uint32_t genid)

{

	return genid & 0xffff;

}

static int check_genid(const struct nlmsghdr *nlh)

{

	struct nfgenmsg *nfh = mnl_nlmsg_get_payload(nlh);

	if (nft_genid_u16(nft_genid) != ntohs(nfh->res_id)) {

		errno = EINTR;

		return -1;

	}

	return 0;

}

/*

 * Batching

 */

/* selected batch page is 256 Kbytes long to load ruleset of

 * half a million rules without hitting -EMSGSIZE due to large

 * iovec.

 */

#define BATCH_PAGE_SIZE getpagesize() * 32

struct nftnl_batch *mnl_batch_init(void)

{

	struct nftnl_batch *batch;

	batch = nftnl_batch_alloc(BATCH_PAGE_SIZE, NFT_NLMSG_MAXSIZE);

	if (batch == NULL)

		memory_allocation_error();

	return batch;

}

static void mnl_nft_batch_continue(struct nftnl_batch *batch)

{

	if (nftnl_batch_update(batch) < 0)

		memory_allocation_error();

}

uint32_t mnl_batch_begin(struct nftnl_batch *batch, uint32_t seqnum)

{

	nftnl_batch_begin(nftnl_batch_buffer(batch), seqnum);

	mnl_nft_batch_continue(batch);

	return seqnum;

}

void mnl_batch_end(struct nftnl_batch *batch, uint32_t seqnum)

{

	nftnl_batch_end(nftnl_batch_buffer(batch), seqnum);

	mnl_nft_batch_continue(batch);

}

bool mnl_batch_ready(struct nftnl_batch *batch)

{

	/* Check if the batch only contains the initial and trailing batch

	 * messages. In that case, the batch is empty.

	 */

	return nftnl_batch_buffer_len(batch) !=

	       (NLMSG_HDRLEN + sizeof(struct nfgenmsg)) * 2;

}

void mnl_batch_reset(struct nftnl_batch *batch)

{

	nftnl_batch_free(batch);

}

static void mnl_err_list_node_add(struct list_head *err_list, int error,

				  int seqnum)

{

	struct mnl_err *err = xmalloc(sizeof(struct mnl_err));

	err->seqnum = seqnum;

	err->err = error;

	list_add_tail(&err->head, err_list);

}

void mnl_err_list_free(struct mnl_err *err)

{

	list_del(&err->head);

	xfree(err);

}

static void mnl_set_sndbuffer(const struct mnl_socket *nl,

			      struct nftnl_batch *batch)

{

	socklen_t len = sizeof(int);

	int sndnlbuffsiz = 0;

	int newbuffsiz;

	getsockopt(mnl_socket_get_fd(nl), SOL_SOCKET, SO_SNDBUF,

		   &sndnlbuffsiz, &len;;

	newbuffsiz = nftnl_batch_iovec_len(batch) * BATCH_PAGE_SIZE;

	if (newbuffsiz <= sndnlbuffsiz)

		return;

	/* Rise sender buffer length to avoid hitting -EMSGSIZE */

	if (setsockopt(mnl_socket_get_fd(nl), SOL_SOCKET, SO_SNDBUFFORCE,

		       &newbuffsiz, sizeof(socklen_t)) < 0)

		return;

}

static unsigned int nlsndbufsiz;

static int mnl_set_rcvbuffer(const struct mnl_socket *nl, socklen_t bufsiz)

{

	socklen_t len = sizeof(nlsndbufsiz);

	int ret;

	if (!nlsndbufsiz) {

		getsockopt(mnl_socket_get_fd(nl), SOL_SOCKET, SO_RCVBUF,

			   &nlsndbufsiz, &len;;

	}

	if (nlsndbufsiz >= bufsiz)

		return 0;

	ret = setsockopt(mnl_socket_get_fd(nl), SOL_SOCKET, SO_RCVBUFFORCE,

			 &bufsiz, sizeof(socklen_t));

	if (ret < 0) {

		/* If this doesn't work, try to reach the system wide maximum

		 * (or whatever the user requested).

		 */

		ret = setsockopt(mnl_socket_get_fd(nl), SOL_SOCKET, SO_RCVBUF,

				 &bufsiz, sizeof(socklen_t));

	}

	return ret;

}

static size_t mnl_nft_batch_to_msg(struct netlink_ctx *ctx, struct msghdr *msg,

				   const struct sockaddr_nl *snl,

				   struct iovec *iov, unsigned int iov_len)

{

	unsigned int i;

	size_t len = 0;

	msg->msg_name		= (struct sockaddr_nl *)snl;

	msg->msg_namelen	= sizeof(*snl);

	msg->msg_iov		= iov;

	msg->msg_iovlen		= iov_len;

	nftnl_batch_iovec(ctx->batch, iov, iov_len);

	for (i = 0; i < iov_len; i++)

		len += msg->msg_iov[i].iov_len;

	return len;

}

static ssize_t mnl_nft_socket_sendmsg(struct netlink_ctx *ctx,

				      const struct msghdr *msg)

{

	uint32_t iov_len = msg->msg_iovlen;

	struct iovec *iov = msg->msg_iov;

	unsigned int i;

	if (ctx->nft->debug_mask & NFT_DEBUG_MNL) {

		for (i = 0; i < iov_len; i++) {

			mnl_nlmsg_fprintf(ctx->nft->output.output_fp,

					  iov[i].iov_base, iov[i].iov_len,

					  sizeof(struct nfgenmsg));

		}

	}

	return sendmsg(mnl_socket_get_fd(ctx->nft->nf_sock), msg, 0);

}

#define NFT_MNL_ECHO_RCVBUFF_DEFAULT	(MNL_SOCKET_BUFFER_SIZE * 1024)

int mnl_batch_talk(struct netlink_ctx *ctx, struct list_head *err_list,

		   uint32_t num_cmds)

{

	struct mnl_socket *nl = ctx->nft->nf_sock;

	int ret, fd = mnl_socket_get_fd(nl), portid = mnl_socket_get_portid(nl);

	uint32_t iov_len = nftnl_batch_iovec_len(ctx->batch);

	char rcv_buf[MNL_SOCKET_BUFFER_SIZE];

	const struct sockaddr_nl snl = {

		.nl_family = AF_NETLINK

	};

	struct timeval tv = {

		.tv_sec		= 0,

		.tv_usec	= 0

	};

	struct iovec iov[iov_len];

	struct msghdr msg = {};

	unsigned int rcvbufsiz;

	size_t batch_size;

	fd_set readfds;

	mnl_set_sndbuffer(ctx->nft->nf_sock, ctx->batch);

	batch_size = mnl_nft_batch_to_msg(ctx, &msg, &snl, iov, iov_len);

	if (nft_output_echo(&ctx->nft->output)) {

		rcvbufsiz = num_cmds * 1024;

		if (rcvbufsiz < NFT_MNL_ECHO_RCVBUFF_DEFAULT)

			rcvbufsiz = NFT_MNL_ECHO_RCVBUFF_DEFAULT;

	} else {

		rcvbufsiz = num_cmds * div_round_up(batch_size, num_cmds) * 4;

	}

	mnl_set_rcvbuffer(ctx->nft->nf_sock, rcvbufsiz);

	ret = mnl_nft_socket_sendmsg(ctx, &msg;;

	if (ret == -1)

		return -1;

	/* receive and digest all the acknowledgments from the kernel. */

	while (true) {

		FD_ZERO(&readfds);

		FD_SET(fd, &readfds);

		ret = select(fd + 1, &readfds, NULL, NULL, &tv;;

		if (ret == -1)

			return -1;

		if (!FD_ISSET(fd, &readfds))

			break;

		ret = mnl_socket_recvfrom(nl, rcv_buf, sizeof(rcv_buf));

		if (ret == -1)

			return -1;

		ret = mnl_cb_run(rcv_buf, ret, 0, portid, &netlink_echo_callback, ctx);

		/* Continue on error, make sure we get all acknowledgments */

		if (ret == -1) {

			struct nlmsghdr *nlh = (struct nlmsghdr *)rcv_buf;

			mnl_err_list_node_add(err_list, errno, nlh->nlmsg_seq);

		}

	}

	return 0;

}

int mnl_nft_rule_add(struct netlink_ctx *ctx, const struct cmd *cmd,

		     unsigned int flags)

{

	struct rule *rule = cmd->rule;

	struct handle *h = &rule->handle;

	struct nftnl_rule *nlr;

	struct nlmsghdr *nlh;

	nlr = nftnl_rule_alloc();

	if (!nlr)

		memory_allocation_error();

	nftnl_rule_set_u32(nlr, NFTNL_RULE_FAMILY, h->family);

	nftnl_rule_set_str(nlr, NFTNL_RULE_TABLE, h->table.name);

	nftnl_rule_set_str(nlr, NFTNL_RULE_CHAIN, h->chain.name);

	if (h->position.id)

		nftnl_rule_set_u64(nlr, NFTNL_RULE_POSITION, h->position.id);

	if (h->rule_id)

		nftnl_rule_set_u32(nlr, NFTNL_RULE_ID, h->rule_id);

	if (h->position_id)

		nftnl_rule_set_u32(nlr, NFTNL_RULE_POSITION_ID, h->position_id);

	netlink_linearize_rule(ctx, nlr, rule);

	nlh = nftnl_nlmsg_build_hdr(nftnl_batch_buffer(ctx->batch),

				    NFT_MSG_NEWRULE,

				    cmd->handle.family,

				    NLM_F_CREATE | flags, ctx->seqnum);

	nftnl_rule_nlmsg_build_payload(nlh, nlr);

	nftnl_rule_free(nlr);

	mnl_nft_batch_continue(ctx->batch);

	return 0;

}

int mnl_nft_rule_replace(struct netlink_ctx *ctx, const struct cmd *cmd)

{

	struct rule *rule = cmd->rule;

	struct handle *h = &rule->handle;

	unsigned int flags = 0;

	struct nftnl_rule *nlr;

	struct nlmsghdr *nlh;

	if (nft_output_echo(&ctx->nft->output))

		flags |= NLM_F_ECHO;

	nlr = nftnl_rule_alloc();

	if (!nlr)

		memory_allocation_error();

	nftnl_rule_set_u32(nlr, NFTNL_RULE_FAMILY, h->family);

	nftnl_rule_set_str(nlr, NFTNL_RULE_TABLE, h->table.name);

	nftnl_rule_set_str(nlr, NFTNL_RULE_CHAIN, h->chain.name);

	nftnl_rule_set_u64(nlr, NFTNL_RULE_HANDLE, h->handle.id);

	netlink_linearize_rule(ctx, nlr, rule);

	nlh = nftnl_nlmsg_build_hdr(nftnl_batch_buffer(ctx->batch),

				    NFT_MSG_NEWRULE,

				    cmd->handle.family,

				    NLM_F_REPLACE | flags, ctx->seqnum);

	nftnl_rule_nlmsg_build_payload(nlh, nlr);

	nftnl_rule_free(nlr);

	mnl_nft_batch_continue(ctx->batch);

	return 0;

}

int mnl_nft_rule_del(struct netlink_ctx *ctx, const struct cmd *cmd)

{

	const struct handle *h = &cmd->handle;

	struct nftnl_rule *nlr;

	struct nlmsghdr *nlh;

	nlr = nftnl_rule_alloc();

	if (!nlr)

		memory_allocation_error();

	nftnl_rule_set_u32(nlr, NFTNL_RULE_FAMILY, h->family);

	nftnl_rule_set_str(nlr, NFTNL_RULE_TABLE, h->table.name);

	if (h->chain.name)

		nftnl_rule_set_str(nlr, NFTNL_RULE_CHAIN, h->chain.name);

	if (h->handle.id)

		nftnl_rule_set_u64(nlr, NFTNL_RULE_HANDLE, h->handle.id);

	nlh = nftnl_nlmsg_build_hdr(nftnl_batch_buffer(ctx->batch),

				    NFT_MSG_DELRULE,

				    nftnl_rule_get_u32(nlr, NFTNL_RULE_FAMILY),

				    0, ctx->seqnum);

	nftnl_rule_nlmsg_build_payload(nlh, nlr);

	nftnl_rule_free(nlr);

	mnl_nft_batch_continue(ctx->batch);

	return 0;

}

/*

 * Rule

 */

static int rule_cb(const struct nlmsghdr *nlh, void *data)

{

	struct nftnl_rule_list *nlr_list = data;

	struct nftnl_rule *r;

	if (check_genid(nlh) < 0)

		return MNL_CB_ERROR;

	r = nftnl_rule_alloc();

	if (r == NULL)

		memory_allocation_error();

	if (nftnl_rule_nlmsg_parse(nlh, r) < 0)

		goto err_free;

	nftnl_rule_list_add_tail(r, nlr_list);

	return MNL_CB_OK;

err_free:

	nftnl_rule_free(r);

	return MNL_CB_OK;

}

struct nftnl_rule_list *mnl_nft_rule_dump(struct netlink_ctx *ctx,

					  int family)

{

	char buf[MNL_SOCKET_BUFFER_SIZE];

	struct nftnl_rule_list *nlr_list;

	struct nlmsghdr *nlh;

	int ret;

	nlr_list = nftnl_rule_list_alloc();

	if (nlr_list == NULL)

		memory_allocation_error();

	nlh = nftnl_nlmsg_build_hdr(buf, NFT_MSG_GETRULE, family,

				    NLM_F_DUMP, ctx->seqnum);

	ret = nft_mnl_talk(ctx, nlh, nlh->nlmsg_len, rule_cb, nlr_list);

	if (ret < 0)

		goto err;

	return nlr_list;

err:

	nftnl_rule_list_free(nlr_list);

	return NULL;

}

/*

 * Chain

 */

int mnl_nft_chain_add(struct netlink_ctx *ctx, const struct cmd *cmd,

		      unsigned int flags)

{

	int priority, policy, i = 0;

	struct nftnl_chain *nlc;

	const char **dev_array;

	struct nlmsghdr *nlh;

	struct expr *expr;

	int dev_array_len;

	nlc = nftnl_chain_alloc();

	if (nlc == NULL)

		memory_allocation_error();

	nftnl_chain_set_u32(nlc, NFTNL_CHAIN_FAMILY, cmd->handle.family);

	nftnl_chain_set_str(nlc, NFTNL_CHAIN_TABLE, cmd->handle.table.name);

	nftnl_chain_set_str(nlc, NFTNL_CHAIN_NAME, cmd->handle.chain.name);

	if (cmd->chain) {

		if (cmd->chain->flags & CHAIN_F_BASECHAIN) {

			nftnl_chain_set_u32(nlc, NFTNL_CHAIN_HOOKNUM,

					    cmd->chain->hooknum);

			mpz_export_data(&priority,

					cmd->chain->priority.expr->value,

					BYTEORDER_HOST_ENDIAN, sizeof(int));

			nftnl_chain_set_s32(nlc, NFTNL_CHAIN_PRIO, priority);

			nftnl_chain_set_str(nlc, NFTNL_CHAIN_TYPE,

					    cmd->chain->type);

		}

		if (cmd->chain->policy) {

			mpz_export_data(&policy, cmd->chain->policy->value,

					BYTEORDER_HOST_ENDIAN, sizeof(int));

			nftnl_chain_set_u32(nlc, NFTNL_CHAIN_POLICY, policy);

		}

		if (cmd->chain->dev_expr) {

			dev_array = xmalloc(sizeof(char *) * 8);

			dev_array_len = 8;

			list_for_each_entry(expr, &cmd->chain->dev_expr->expressions, list) {

				dev_array[i++] = expr->identifier;

				if (i == dev_array_len) {

					dev_array_len *= 2;

					dev_array = xrealloc(dev_array,

							     dev_array_len * sizeof(char *));

				}

			}

			dev_array[i] = NULL;

			if (i == 1)

				nftnl_chain_set_str(nlc, NFTNL_CHAIN_DEV, dev_array[0]);

			else if (i > 1)

				nftnl_chain_set_data(nlc, NFTNL_CHAIN_DEVICES, dev_array,

						     sizeof(char *) * dev_array_len);

			xfree(dev_array);

		}

	}

	netlink_dump_chain(nlc, ctx);

	nlh = nftnl_nlmsg_build_hdr(nftnl_batch_buffer(ctx->batch),

				    NFT_MSG_NEWCHAIN,

				    cmd->handle.family,

				    NLM_F_CREATE | flags, ctx->seqnum);

	nftnl_chain_nlmsg_build_payload(nlh, nlc);

	nftnl_chain_free(nlc);

	mnl_nft_batch_continue(ctx->batch);

	return 0;

}

int mnl_nft_chain_rename(struct netlink_ctx *ctx, const struct cmd *cmd,

			 const struct chain *chain)

{

	const char *name = cmd->arg;

	struct nftnl_chain *nlc;

	struct nlmsghdr *nlh;

	nlc = nftnl_chain_alloc();

	if (nlc == NULL)

		memory_allocation_error();

	nftnl_chain_set_u32(nlc, NFTNL_CHAIN_FAMILY, cmd->handle.family);

	nftnl_chain_set_str(nlc, NFTNL_CHAIN_TABLE, cmd->handle.table.name);

	nftnl_chain_set_u64(nlc, NFTNL_CHAIN_HANDLE, chain->handle.handle.id);

	nftnl_chain_set_str(nlc, NFTNL_CHAIN_NAME, name);

	netlink_dump_chain(nlc, ctx);

	nlh = nftnl_nlmsg_build_hdr(nftnl_batch_buffer(ctx->batch),

				    NFT_MSG_NEWCHAIN,

				    cmd->handle.family,

				    0, ctx->seqnum);

	nftnl_chain_nlmsg_build_payload(nlh, nlc);

	nftnl_chain_free(nlc);

	mnl_nft_batch_continue(ctx->batch);

	return 0;

}

int mnl_nft_chain_del(struct netlink_ctx *ctx, const struct cmd *cmd)

{

	struct nftnl_chain *nlc;

	struct nlmsghdr *nlh;

	nlc = nftnl_chain_alloc();

	if (nlc == NULL)

		memory_allocation_error();

	nftnl_chain_set_u32(nlc, NFTNL_CHAIN_FAMILY, cmd->handle.family);

	nftnl_chain_set_str(nlc, NFTNL_CHAIN_TABLE, cmd->handle.table.name);

	if (cmd->handle.chain.name)

		nftnl_chain_set_str(nlc, NFTNL_CHAIN_NAME,

				    cmd->handle.chain.name);

	else if (cmd->handle.handle.id)

		nftnl_chain_set_u64(nlc, NFTNL_CHAIN_HANDLE,

				    cmd->handle.handle.id);

	nlh = nftnl_nlmsg_build_hdr(nftnl_batch_buffer(ctx->batch),

				    NFT_MSG_DELCHAIN,

				    cmd->handle.family,

				    0, ctx->seqnum);

	nftnl_chain_nlmsg_build_payload(nlh, nlc);

	nftnl_chain_free(nlc);

	mnl_nft_batch_continue(ctx->batch);

	return 0;

}

static int chain_cb(const struct nlmsghdr *nlh, void *data)

{

	struct nftnl_chain_list *nlc_list = data;

	struct nftnl_chain *c;

	if (check_genid(nlh) < 0)

		return MNL_CB_ERROR;

	c = nftnl_chain_alloc();

	if (c == NULL)

		memory_allocation_error();

	if (nftnl_chain_nlmsg_parse(nlh, c) < 0)

		goto err_free;

	nftnl_chain_list_add_tail(c, nlc_list);

	return MNL_CB_OK;

err_free:

	nftnl_chain_free(c);

	return MNL_CB_OK;

}

struct nftnl_chain_list *mnl_nft_chain_dump(struct netlink_ctx *ctx,

					    int family)

{

	char buf[MNL_SOCKET_BUFFER_SIZE];

	struct nftnl_chain_list *nlc_list;

	struct nlmsghdr *nlh;

	int ret;

	nlc_list = nftnl_chain_list_alloc();

	if (nlc_list == NULL)

		memory_allocation_error();

	nlh = nftnl_nlmsg_build_hdr(buf, NFT_MSG_GETCHAIN, family,

				    NLM_F_DUMP, ctx->seqnum);

	ret = nft_mnl_talk(ctx, nlh, nlh->nlmsg_len, chain_cb, nlc_list);

	if (ret < 0)

		goto err;

	return nlc_list;

err:

	nftnl_chain_list_free(nlc_list);

	return NULL;

}

/*

 * Table

 */

int mnl_nft_table_add(struct netlink_ctx *ctx, const struct cmd *cmd,

		      unsigned int flags)

{

	struct nftnl_table *nlt;

	struct nlmsghdr *nlh;

	nlt = nftnl_table_alloc();

	if (nlt == NULL)

		memory_allocation_error();

	nftnl_table_set_u32(nlt, NFTNL_TABLE_FAMILY, cmd->handle.family);

	nftnl_table_set_str(nlt, NFTNL_TABLE_NAME, cmd->handle.table.name);

	if (cmd->table)

		nftnl_table_set_u32(nlt, NFTNL_TABLE_FLAGS, cmd->table->flags);

	else

		nftnl_table_set_u32(nlt, NFTNL_TABLE_FLAGS, 0);

	nlh = nftnl_nlmsg_build_hdr(nftnl_batch_buffer(ctx->batch),

				    NFT_MSG_NEWTABLE,

				    cmd->handle.family,

				    flags, ctx->seqnum);

	nftnl_table_nlmsg_build_payload(nlh, nlt);

	nftnl_table_free(nlt);

	mnl_nft_batch_continue(ctx->batch);

	return 0;

}

int mnl_nft_table_del(struct netlink_ctx *ctx, const struct cmd *cmd)

{

	struct nftnl_table *nlt;

	struct nlmsghdr *nlh;

	nlt = nftnl_table_alloc();

	if (nlt == NULL)

		memory_allocation_error();

	nftnl_table_set_u32(nlt, NFTNL_TABLE_FAMILY, cmd->handle.family);

	if (cmd->handle.table.name)

		nftnl_table_set_str(nlt, NFTNL_TABLE_NAME,

				    cmd->handle.table.name);

	else if (cmd->handle.handle.id)

		nftnl_table_set_u64(nlt, NFTNL_TABLE_HANDLE,

				    cmd->handle.handle.id);

	nlh = nftnl_nlmsg_build_hdr(nftnl_batch_buffer(ctx->batch),

				    NFT_MSG_DELTABLE,

				    cmd->handle.family,

				    0, ctx->seqnum);

	nftnl_table_nlmsg_build_payload(nlh, nlt);

	nftnl_table_free(nlt);

	mnl_nft_batch_continue(ctx->batch);

	return 0;

}

static int table_cb(const struct nlmsghdr *nlh, void *data)

{

	struct nftnl_table_list *nlt_list = data;

	struct nftnl_table *t;

	if (check_genid(nlh) < 0)

		return MNL_CB_ERROR;

	t = nftnl_table_alloc();

	if (t == NULL)

		memory_allocation_error();

	if (nftnl_table_nlmsg_parse(nlh, t) < 0)

		goto err_free;

	nftnl_table_list_add_tail(t, nlt_list);

	return MNL_CB_OK;

err_free:

	nftnl_table_free(t);

	return MNL_CB_OK;

}

struct nftnl_table_list *mnl_nft_table_dump(struct netlink_ctx *ctx,

					    int family)

{

	char buf[MNL_SOCKET_BUFFER_SIZE];

	struct nftnl_table_list *nlt_list;

	struct nlmsghdr *nlh;

	int ret;

	nlt_list = nftnl_table_list_alloc();

	if (nlt_list == NULL)

		return NULL;

	nlh = nftnl_nlmsg_build_hdr(buf, NFT_MSG_GETTABLE, family,

				    NLM_F_DUMP, ctx->seqnum);

	ret = nft_mnl_talk(ctx, nlh, nlh->nlmsg_len, table_cb, nlt_list);

	if (ret < 0)

		goto err;

	return nlt_list;

err:

	nftnl_table_list_free(nlt_list);

	return NULL;

}

/*

 * Set

 */

int mnl_nft_set_add(struct netlink_ctx *ctx, const struct cmd *cmd,

		    unsigned int flags)

{

	const struct handle *h = &cmd->handle;

	struct nftnl_udata_buf *udbuf;

	struct set *set = cmd->set;

	struct nftnl_set *nls;

	struct nlmsghdr *nlh;

	nls = nftnl_set_alloc();

	if (!nls)

		memory_allocation_error();

	nftnl_set_set_u32(nls, NFTNL_SET_FAMILY, h->family);

	nftnl_set_set_str(nls, NFTNL_SET_TABLE, h->table.name);

	nftnl_set_set_str(nls, NFTNL_SET_NAME, h->set.name);

	nftnl_set_set_u32(nls, NFTNL_SET_ID, h->set_id);

	nftnl_set_set_u32(nls, NFTNL_SET_FLAGS, set->flags);

	nftnl_set_set_u32(nls, NFTNL_SET_KEY_TYPE,

			  dtype_map_to_kernel(set->key->dtype));

	nftnl_set_set_u32(nls, NFTNL_SET_KEY_LEN,

			  div_round_up(set->key->len, BITS_PER_BYTE));

	if (set_is_datamap(set->flags)) {

		nftnl_set_set_u32(nls, NFTNL_SET_DATA_TYPE,

				  dtype_map_to_kernel(set->datatype));

		nftnl_set_set_u32(nls, NFTNL_SET_DATA_LEN,

				  set->datalen / BITS_PER_BYTE);

	}

	if (set_is_objmap(set->flags))

		nftnl_set_set_u32(nls, NFTNL_SET_OBJ_TYPE, set->objtype);

	if (set->timeout)

		nftnl_set_set_u64(nls, NFTNL_SET_TIMEOUT, set->timeout);

	if (set->gc_int)

		nftnl_set_set_u32(nls, NFTNL_SET_GC_INTERVAL, set->gc_int);

	nftnl_set_set_u32(nls, NFTNL_SET_ID, set->handle.set_id);

	if (!(set->flags & NFT_SET_CONSTANT)) {

		if (set->policy != NFT_SET_POL_PERFORMANCE)

			nftnl_set_set_u32(nls, NFTNL_SET_POLICY, set->policy);

		if (set->desc.size != 0)

			nftnl_set_set_u32(nls, NFTNL_SET_DESC_SIZE,

					  set->desc.size);

	} else if (set->init) {

		nftnl_set_set_u32(nls, NFTNL_SET_DESC_SIZE, set->init->size);

	}

	udbuf = nftnl_udata_buf_alloc(NFT_USERDATA_MAXLEN);

	if (!udbuf)

		memory_allocation_error();

	if (!nftnl_udata_put_u32(udbuf, NFTNL_UDATA_SET_KEYBYTEORDER,

				 set->key->byteorder))

		memory_allocation_error();

	if (set_is_datamap(set->flags) &&

	    !nftnl_udata_put_u32(udbuf, NFTNL_UDATA_SET_DATABYTEORDER,

				 set->datatype->byteorder))

		memory_allocation_error();

	if (set->automerge &&

	    !nftnl_udata_put_u32(udbuf, NFTNL_UDATA_SET_MERGE_ELEMENTS,