rule: Use libnftnl user data TLV infrastructure

Now it is possible to store multiple variable length user data into rule.
Modify the parser in order to fill the nftnl_udata with the comment, and
the print function for extract these commentary and print it to user.

Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/rule.h b/include/rule.h
index cfe33a734454ed5f1682c2c694063ceb77b0ddc8..6dbde1304460086af4d7a824e39c4bcc389af718 100644 (file)
--- a/include/rule.h
+++ b/include/rule.h
@@ -418,4 +418,10 @@ extern int do_command(struct netlink_ctx *ctx, struct cmd *cmd);
 extern int cache_update(enum cmd_ops cmd, struct list_head *msgs);
 extern void cache_release(void);
 
+enum udata_type {
+       UDATA_TYPE_COMMENT,
+       __UDATA_TYPE_MAX,
+};
+#define UDATA_TYPE_MAX (__UDATA_TYPE_MAX - 1)
+
 #endif /* NFTABLES_RULE_H */

diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index 848acd6668929c1c439732b5ab8975832ed7e77c..ca1c6e603873b8c406d96c687cf9ac69623529c8 100644 (file)
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -25,6 +25,7 @@
 #include <utils.h>
 #include <erec.h>
 #include <sys/socket.h>
+#include <libnftnl/udata.h>
 
 struct netlink_parse_ctx {
        struct list_head        *msgs;
@@ -1746,6 +1747,38 @@ static void rule_parse_postprocess(struct netlink_parse_ctx *ctx, struct rule *r
        }
 }
 
+static int parse_udata_cb(const struct nftnl_udata *attr, void *data)
+{
+       unsigned char *value = nftnl_udata_get(attr);
+       uint8_t type = nftnl_udata_type(attr);
+       uint8_t len = nftnl_udata_len(attr);
+       const struct nftnl_udata **tb = data;
+
+       switch (type) {
+       case UDATA_TYPE_COMMENT:
+               if (value[len - 1] != '\0')
+                       return -1;
+               break;
+       default:
+               return 0;
+       }
+       tb[type] = attr;
+       return 0;
+}
+
+static char *udata_get_comment(const void *data, uint32_t data_len)
+{
+       const struct nftnl_udata *tb[UDATA_TYPE_MAX + 1] = {};
+
+       if (nftnl_udata_parse(data, data_len, parse_udata_cb, tb) < 0)
+               return NULL;
+
+       if (!tb[UDATA_TYPE_COMMENT])
+               return NULL;
+
+       return xstrdup(nftnl_udata_get(tb[UDATA_TYPE_COMMENT]));
+}
+
 struct rule *netlink_delinearize_rule(struct netlink_ctx *ctx,
                                      const struct nftnl_rule *nlr)
 {
@@ -1773,8 +1806,7 @@ struct rule *netlink_delinearize_rule(struct netlink_ctx *ctx,
                uint32_t len;
 
                data = nftnl_rule_get_data(nlr, NFTNL_RULE_USERDATA, &len);
-               pctx->rule->comment = xmalloc(len);
-               memcpy((char *)pctx->rule->comment, data, len);
+               pctx->rule->comment = udata_get_comment(data, len);
        }
 
        nftnl_expr_foreach((struct nftnl_rule *)nlr, netlink_parse_expr, pctx);

diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c
index bb51de73771b7d6e5fa763dd4c89d0bf9836f796..326304368da0eeb30e7ad151db160dc823045d7c 100644 (file)
--- a/src/netlink_linearize.c
+++ b/src/netlink_linearize.c
@@ -21,6 +21,7 @@
 #include <netinet/in.h>
 
 #include <linux/netfilter.h>
+#include <libnftnl/udata.h>
 
 
 struct netlink_linearize_ctx {
@@ -1171,9 +1172,27 @@ void netlink_linearize_rule(struct netlink_ctx *ctx, struct nftnl_rule *nlr,
        list_for_each_entry(stmt, &rule->stmts, list)
                netlink_gen_stmt(&lctx, stmt);
 
-       if (rule->comment)
-               nftnl_rule_set_data(nlr, NFTNL_RULE_USERDATA,
-                                   rule->comment, strlen(rule->comment) + 1);
+       if (rule->comment) {
+               struct nftnl_udata_buf *udata;
+               uint32_t udlen;
+               void *ud;
+
+               udata = nftnl_udata_buf_alloc(NFT_USERDATA_MAXLEN);
+               if (!udata)
+                       memory_allocation_error();
+
+               if (!nftnl_udata_put_strz(udata, UDATA_TYPE_COMMENT,
+                                         rule->comment))
+                       memory_allocation_error();
+
+               udlen = nftnl_udata_buf_len(udata);
+               ud = xmalloc(udlen);
+               memcpy(ud, nftnl_udata_buf_data(udata), udlen);
+
+               nftnl_rule_set_data(nlr, NFTNL_RULE_USERDATA, ud, udlen);
+
+               nftnl_udata_buf_free(udata);
+       }
 
        netlink_dump_rule(nlr);
 }