316 lines
9.7 KiB
C
316 lines
9.7 KiB
C
/* SPDX-License-Identifier: LGPL-2.1+ */
|
|
|
|
#include <netinet/in.h>
|
|
#include <linux/if_addrlabel.h>
|
|
#include <linux/netfilter/nfnetlink.h>
|
|
#include <linux/netfilter/nf_tables.h>
|
|
#include <linux/nexthop.h>
|
|
#include <stdbool.h>
|
|
#include <unistd.h>
|
|
|
|
#include "sd-netlink.h"
|
|
|
|
#include "format-util.h"
|
|
#include "netlink-internal.h"
|
|
#include "netlink-types.h"
|
|
#include "netlink-util.h"
|
|
#include "socket-util.h"
|
|
#include "util.h"
|
|
|
|
static int nft_message_new(sd_netlink *nfnl, sd_netlink_message **ret, int family, uint16_t type, uint16_t flags) {
|
|
_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
|
|
struct nfgenmsg *nfh;
|
|
const NLType *nl_type;
|
|
size_t size;
|
|
int r;
|
|
|
|
assert_return(nfnl, -EINVAL);
|
|
|
|
r = type_system_root_get_type(nfnl, &nl_type, NFNL_SUBSYS_NFTABLES);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
if (type_get_type(nl_type) != NETLINK_TYPE_NESTED)
|
|
return -EINVAL;
|
|
|
|
r = message_new_empty(nfnl, &m);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
size = NLMSG_SPACE(type_get_size(nl_type));
|
|
|
|
assert(size >= sizeof(struct nlmsghdr));
|
|
m->hdr = malloc0(size);
|
|
if (!m->hdr)
|
|
return -ENOMEM;
|
|
|
|
m->hdr->nlmsg_flags = NLM_F_REQUEST | flags;
|
|
|
|
type_get_type_system(nl_type, &m->containers[0].type_system);
|
|
|
|
r = type_system_get_type_system(m->containers[0].type_system,
|
|
&m->containers[0].type_system,
|
|
type);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
m->hdr->nlmsg_len = size;
|
|
m->hdr->nlmsg_type = NFNL_SUBSYS_NFTABLES << 8 | type;
|
|
|
|
nfh = NLMSG_DATA(m->hdr);
|
|
nfh->nfgen_family = family;
|
|
nfh->version = NFNETLINK_V0;
|
|
nfh->res_id = nfnl->serial;
|
|
|
|
*ret = TAKE_PTR(m);
|
|
return 0;
|
|
}
|
|
|
|
static int sd_nfnl_message_batch(sd_netlink *nfnl, sd_netlink_message **ret, int v) {
|
|
_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
|
|
struct nfgenmsg *nfh;
|
|
int r;
|
|
|
|
r = message_new(nfnl, &m, v);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
nfh = NLMSG_DATA(m->hdr);
|
|
nfh->nfgen_family = AF_UNSPEC;
|
|
nfh->version = NFNETLINK_V0;
|
|
nfh->res_id = NFNL_SUBSYS_NFTABLES;
|
|
|
|
*ret = TAKE_PTR(m);
|
|
return r;
|
|
}
|
|
|
|
int sd_nfnl_message_batch_begin(sd_netlink *nfnl, sd_netlink_message **ret) {
|
|
return sd_nfnl_message_batch(nfnl, ret, NFNL_MSG_BATCH_BEGIN);
|
|
}
|
|
|
|
int sd_nfnl_message_batch_end(sd_netlink *nfnl, sd_netlink_message **ret) {
|
|
return sd_nfnl_message_batch(nfnl, ret, NFNL_MSG_BATCH_END);
|
|
}
|
|
|
|
int sd_nfnl_nft_message_new_basechain(sd_netlink *nfnl, sd_netlink_message **ret,
|
|
int family,
|
|
const char *table, const char *chain,
|
|
const char *type,
|
|
uint8_t hook, int prio) {
|
|
_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
|
|
int r;
|
|
|
|
r = nft_message_new(nfnl, &m, family, NFT_MSG_NEWCHAIN, NLM_F_CREATE | NLM_F_ACK);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
r = sd_netlink_message_append_string(m, NFTA_CHAIN_TABLE, table);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
r = sd_netlink_message_append_string(m, NFTA_CHAIN_NAME, chain);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
r = sd_netlink_message_append_string(m, NFTA_CHAIN_TYPE, type);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
r = sd_netlink_message_open_container(m, NFTA_CHAIN_HOOK);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
r = sd_netlink_message_append_u32(m, NFTA_HOOK_HOOKNUM, htobe32(hook));
|
|
if (r < 0)
|
|
return r;
|
|
|
|
r = sd_netlink_message_append_u32(m, NFTA_HOOK_PRIORITY, htobe32(prio));
|
|
if (r < 0)
|
|
return r;
|
|
|
|
r = sd_netlink_message_close_container(m);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
*ret = TAKE_PTR(m);
|
|
return 0;
|
|
}
|
|
|
|
int sd_nfnl_nft_message_del_table(sd_netlink *nfnl, sd_netlink_message **ret,
|
|
int family, const char *table) {
|
|
_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
|
|
int r;
|
|
|
|
r = nft_message_new(nfnl, &m, family, NFT_MSG_DELTABLE, NLM_F_CREATE | NLM_F_ACK);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
r = sd_netlink_message_append_string(m, NFTA_TABLE_NAME, table);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
*ret = TAKE_PTR(m);
|
|
return r;
|
|
}
|
|
|
|
int sd_nfnl_nft_message_new_table(sd_netlink *nfnl, sd_netlink_message **ret,
|
|
int family, const char *table, uint16_t flags) {
|
|
_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
|
|
int r;
|
|
|
|
r = nft_message_new(nfnl, &m, family, NFT_MSG_NEWTABLE, NLM_F_CREATE | flags);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
r = sd_netlink_message_append_string(m, NFTA_TABLE_NAME, table);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
*ret = TAKE_PTR(m);
|
|
return r;
|
|
}
|
|
|
|
int sd_nfnl_nft_message_new_rule(sd_netlink *nfnl, sd_netlink_message **ret,
|
|
int family, const char *table, const char *chain) {
|
|
_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
|
|
int r;
|
|
|
|
r = nft_message_new(nfnl, &m, family, NFT_MSG_NEWRULE, NLM_F_CREATE | NLM_F_ACK);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
r = sd_netlink_message_append_string(m, NFTA_RULE_TABLE, table);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
r = sd_netlink_message_append_string(m, NFTA_RULE_CHAIN, chain);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
*ret = TAKE_PTR(m);
|
|
return r;
|
|
}
|
|
|
|
int sd_nfnl_nft_message_new_set(sd_netlink *nfnl, sd_netlink_message **ret,
|
|
int family, const char *table, const char *set_name,
|
|
uint32_t set_id, uint32_t klen) {
|
|
_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
|
|
int r;
|
|
|
|
r = nft_message_new(nfnl, &m, family, NFT_MSG_NEWSET, NLM_F_CREATE | NLM_F_ACK);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
r = sd_netlink_message_append_string(m, NFTA_SET_TABLE, table);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
r = sd_netlink_message_append_string(m, NFTA_SET_NAME, set_name);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
r = sd_netlink_message_append_u32(m, NFTA_SET_ID, ++set_id);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
r = sd_netlink_message_append_u32(m, NFTA_SET_KEY_LEN, htobe32(klen));
|
|
if (r < 0)
|
|
return r;
|
|
*ret = TAKE_PTR(m);
|
|
return r;
|
|
}
|
|
|
|
int sd_nfnl_nft_message_new_setelems_begin(sd_netlink *nfnl, sd_netlink_message **ret,
|
|
int family, const char *table, const char *set_name) {
|
|
_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
|
|
int r;
|
|
|
|
r = nft_message_new(nfnl, &m, family, NFT_MSG_NEWSETELEM, NLM_F_CREATE | NLM_F_ACK);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
r = sd_netlink_message_append_string(m, NFTA_SET_ELEM_LIST_TABLE, table);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
r = sd_netlink_message_append_string(m, NFTA_SET_ELEM_LIST_SET, set_name);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
r = sd_netlink_message_open_container(m, NFTA_SET_ELEM_LIST_ELEMENTS);
|
|
if (r < 0)
|
|
return r;
|
|
*ret = TAKE_PTR(m);
|
|
return r;
|
|
}
|
|
|
|
int sd_nfnl_nft_message_del_setelems_begin(sd_netlink *nfnl, sd_netlink_message **ret,
|
|
int family, const char *table, const char *set_name) {
|
|
_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
|
|
int r;
|
|
|
|
r = nft_message_new(nfnl, &m, family, NFT_MSG_DELSETELEM, NLM_F_ACK);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
r = sd_netlink_message_append_string(m, NFTA_SET_ELEM_LIST_TABLE, table);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
r = sd_netlink_message_append_string(m, NFTA_SET_ELEM_LIST_SET, set_name);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
r = sd_netlink_message_open_container(m, NFTA_SET_ELEM_LIST_ELEMENTS);
|
|
if (r < 0)
|
|
return r;
|
|
*ret = TAKE_PTR(m);
|
|
return r;
|
|
}
|
|
|
|
static int sd_nfnl_add_data(sd_netlink_message *m, uint16_t attr, const void *data, uint32_t dlen) {
|
|
int r = sd_netlink_message_open_container(m, attr);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
r = sd_netlink_message_append_data(m, NFTA_DATA_VALUE, data, dlen);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
return sd_netlink_message_close_container(m); /* attr */
|
|
}
|
|
|
|
int sd_nfnl_nft_message_add_setelem(sd_netlink_message *m,
|
|
uint32_t num,
|
|
const void *key, uint32_t klen,
|
|
const void *data, uint32_t dlen) {
|
|
int r;
|
|
|
|
r = sd_netlink_message_open_array(m, num);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
r = sd_nfnl_add_data(m, NFTA_SET_ELEM_KEY, key, klen);
|
|
if (r < 0)
|
|
goto cancel;
|
|
|
|
if (data) {
|
|
r = sd_nfnl_add_data(m, NFTA_SET_ELEM_DATA, data, dlen);
|
|
if (r < 0)
|
|
goto cancel;
|
|
}
|
|
|
|
return r;
|
|
cancel:
|
|
sd_netlink_message_cancel_array(m);
|
|
return r;
|
|
}
|
|
|
|
int sd_nfnl_nft_message_add_setelem_end(sd_netlink_message *m) {
|
|
return sd_netlink_message_close_container(m); /* NFTA_SET_ELEM_LIST_ELEMENTS */
|
|
}
|
|
|
|
int sd_nfnl_socket_open(sd_netlink **ret) {
|
|
return netlink_open_family(ret, NETLINK_NETFILTER);
|
|
}
|