#include <linux/netfilter/nf_tables.h>
#include <jansson.h>
+#include <mnl.h>
+#include <libnftnl/rule.h>
+#include <linux/netfilter/nfnetlink.h>
+
#define CTX_F_RHS (1 << 0)
#define CTX_F_STMT (1 << 1)
#define CTX_F_PRIMARY (1 << 2)
if (h.table.name)
h.table.name = xstrdup(h.table.name);
+ if (op == CMD_ADD)
+ json_object_del(root, "handle");
+
return cmd_alloc(op, obj, &h, int_loc, NULL);
}
}
}
+ if (op == CMD_ADD)
+ json_object_del(root, "handle");
+
handle_merge(&chain->handle, &h);
return cmd_alloc(op, obj, &h, int_loc, chain);
}
list_add_tail(&stmt->list, &rule->stmts);
}
+ if (op == CMD_ADD)
+ json_object_del(root, "handle");
+
return cmd_alloc(op, obj, &h, int_loc, rule);
}
json_unpack(root, "{s:i}", "size", &set->desc.size);
handle_merge(&set->handle, &h);
+
+ if (op == CMD_ADD)
+ json_object_del(root, "handle");
+
return cmd_alloc(op, obj, &h, int_loc, set);
}
BUG("Invalid CMD '%d'", cmd_obj);
}
+ if (op == CMD_ADD)
+ json_object_del(root, "handle");
+
return cmd_alloc(op, cmd_obj, &h, int_loc, obj);
}
list_add_tail(&stmt->list, &rule->stmts);
}
+ if (op == CMD_REPLACE)
+ json_object_del(root, "handle");
+
return cmd_alloc(op, CMD_OBJ_RULE, &h, int_loc, rule);
}
return 0;
}
-static int __json_parse(struct json_ctx *ctx, json_t *root)
+static int __json_parse(struct json_ctx *ctx)
{
struct eval_ctx ectx = {
.nft = ctx->nft,
json_t *tmp, *value;
size_t index;
- if (json_unpack_err(ctx, root, "{s:o}", "nftables", &tmp))
+ if (json_unpack_err(ctx, ctx->nft->json_root,
+ "{s:o}", "nftables", &tmp))
return -1;
if (!json_is_array(tmp)) {
return 0;
}
-
int nft_parse_json_buffer(struct nft_ctx *nft, const char *buf,
struct list_head *msgs, struct list_head *cmds)
{
.msgs = msgs,
.cmds = cmds,
};
- json_t *root;
int ret;
- root = json_loads(buf, 0, NULL);
- if (!root)
+ nft->json_root = json_loads(buf, 0, NULL);
+ if (!nft->json_root)
return -EINVAL;
- ret = __json_parse(&ctx, root);
+ ret = __json_parse(&ctx);
- json_decref(root);
+ if (!nft->output.echo) {
+ json_decref(nft->json_root);
+ nft->json_root = NULL;
+ }
return ret;
}
.cmds = cmds,
};
json_error_t err;
- json_t *root;
int ret;
- root = json_load_file(filename, 0, &err);
- if (!root)
+ nft->json_root = json_load_file(filename, 0, &err);
+ if (!nft->json_root)
return -EINVAL;
- ret = __json_parse(&ctx, root);
+ ret = __json_parse(&ctx);
- json_decref(root);
+ if (!nft->output.echo) {
+ json_decref(nft->json_root);
+ nft->json_root = NULL;
+ }
return ret;
}
+
+static int json_echo_error(struct netlink_mon_handler *monh,
+ const char *fmt, ...)
+{
+ struct error_record *erec;
+ va_list ap;
+
+ va_start(ap, fmt);
+ erec = erec_vcreate(EREC_ERROR, int_loc, fmt, ap);
+ va_end(ap);
+ erec_queue(erec, monh->ctx->msgs);
+
+ return MNL_CB_ERROR;
+}
+
+static int obj_prop_check(json_t *obj, const char *key, const char *value)
+{
+ const char *cmp;
+
+ if (!value)
+ return 0;
+
+ if (json_unpack(obj, "{s:s}", key, &cmp) || strcmp(value, cmp))
+ return 1;
+
+ return 0;
+}
+
+static bool obj_info_matches(json_t *obj, const char *family, const char *table,
+ const char *chain, const char *name)
+{
+ if (obj_prop_check(obj, "family", family) ||
+ obj_prop_check(obj, "table", table) ||
+ obj_prop_check(obj, "chain", chain) ||
+ obj_prop_check(obj, "name", name))
+ return false;
+
+ return true;
+}
+
+static int json_update_table(struct netlink_mon_handler *monh,
+ json_t *array, const struct nlmsghdr *nlh)
+{
+ const char *family, *name;
+ struct nftnl_table *nlt;
+ uint64_t handle;
+ json_t *value;
+ size_t index;
+
+ nlt = netlink_table_alloc(nlh);
+ family = family2str(nftnl_table_get_u32(nlt, NFTNL_TABLE_FAMILY));
+ name = nftnl_table_get_str(nlt, NFTNL_TABLE_NAME);
+ handle = nftnl_table_get_u64(nlt, NFTNL_TABLE_HANDLE);
+
+ json_array_foreach(array, index, value) {
+ if (json_unpack(value, "{s:{s:o}}", "add", "table", &value) ||
+ !obj_info_matches(value, family, NULL, NULL, name))
+ continue;
+
+ json_object_set_new(value, "handle", json_integer(handle));
+ return MNL_CB_OK;
+ }
+
+ return json_echo_error(monh, "JSON table object '%s %s' not found.\n",
+ family, name);
+}
+
+static int json_update_chain(struct netlink_mon_handler *monh,
+ json_t *array, const struct nlmsghdr *nlh)
+{
+ const char *family, *table, *name;
+ struct nftnl_chain *nlc;
+ uint64_t handle;
+ json_t *value;
+ size_t index;
+
+ nlc = netlink_chain_alloc(nlh);
+ family = family2str(nftnl_chain_get_u32(nlc, NFTNL_CHAIN_FAMILY));
+ table = nftnl_chain_get_str(nlc, NFTNL_CHAIN_TABLE);
+ name = nftnl_chain_get_str(nlc, NFTNL_CHAIN_NAME);
+ handle = nftnl_chain_get_u64(nlc, NFTNL_CHAIN_HANDLE);
+
+ json_array_foreach(array, index, value) {
+ if (json_unpack(value, "{s:{s:o}}", "add", "chain", &value) ||
+ !obj_info_matches(value, family, table, NULL, name))
+ continue;
+
+ json_object_set_new(value, "handle", json_integer(handle));
+ return MNL_CB_OK;
+ }
+ return json_echo_error(monh,
+ "JSON chain object '%s %s %s' not found.\n",
+ family, table, name);
+}
+
+static int json_update_rule(struct netlink_mon_handler *monh,
+ json_t *array, const struct nlmsghdr *nlh)
+{
+ const char *family, *table, *chain;
+ struct nftnl_rule *nlr;
+ uint64_t handle;
+ json_t *value;
+ size_t index;
+
+ nlr = netlink_rule_alloc(nlh);
+ family = family2str(nftnl_rule_get_u32(nlr, NFTNL_RULE_FAMILY));
+ table = nftnl_rule_get_str(nlr, NFTNL_RULE_TABLE);
+ chain = nftnl_rule_get_str(nlr, NFTNL_RULE_CHAIN);
+ handle = nftnl_rule_get_u64(nlr, NFTNL_RULE_HANDLE);
+
+ json_array_foreach(array, index, value) {
+ if (json_unpack(value, "{s:{s:o}}", "add", "rule", &value) ||
+ !obj_info_matches(value, family, table, chain, NULL))
+ continue;
+
+ /* this is a hack - assume rules are added in order and caller
+ * sets the handle for each we previously returned */
+ if (json_object_get(value, "handle"))
+ continue;
+
+ json_object_set_new(value, "handle", json_integer(handle));
+ return MNL_CB_OK;
+ }
+ return json_echo_error(monh,
+ "JSON rule object in '%s %s %s' without handle not found\n",
+ family, table, chain);
+}
+
+static int json_update_set(struct netlink_mon_handler *monh,
+ json_t *array, const struct nlmsghdr *nlh)
+{
+ const char *family, *table, *name;
+ struct nftnl_set *nls;
+ uint64_t handle;
+ uint32_t flags;
+ json_t *value;
+ size_t index;
+
+ nls = netlink_set_alloc(nlh);
+ flags = nftnl_set_get_u32(nls, NFTNL_SET_FLAGS);
+ if (flags & NFT_SET_ANONYMOUS)
+ return MNL_CB_OK;
+
+ family = family2str(nftnl_set_get_u32(nls, NFTNL_SET_FAMILY));
+ table = nftnl_set_get_str(nls, NFTNL_SET_TABLE);
+ name = nftnl_set_get_str(nls, NFTNL_SET_NAME);
+ handle = nftnl_set_get_u64(nls, NFTNL_SET_HANDLE);
+
+ json_array_foreach(array, index, value) {
+ if (json_unpack(value, "{s:{s:o}}", "add", "set", &value) ||
+ !obj_info_matches(value, family, table, NULL, name))
+ continue;
+
+ json_object_set_new(value, "handle", json_integer(handle));
+ return MNL_CB_OK;
+ }
+ return json_echo_error(monh, "JSON set object '%s %s %s' not found.\n",
+ family, table, name);
+}
+
+static int json_update_obj(struct netlink_mon_handler *monh,
+ json_t *array, const struct nlmsghdr *nlh)
+{
+ const char *family, *table, *name, *type;
+ struct nftnl_obj *nlo;
+ uint64_t handle;
+ json_t *value;
+ size_t index;
+
+ nlo = netlink_obj_alloc(nlh);
+ family = family2str(nftnl_obj_get_u32(nlo, NFTNL_OBJ_FAMILY));
+ table = nftnl_obj_get_str(nlo, NFTNL_OBJ_TABLE);
+ name = nftnl_obj_get_str(nlo, NFTNL_OBJ_NAME);
+ type = obj_type_name(nftnl_obj_get_u32(nlo, NFTNL_OBJ_TYPE));
+ handle = nftnl_obj_get_u64(nlo, NFTNL_OBJ_HANDLE);
+
+ json_array_foreach(array, index, value) {
+ if (json_unpack(value, "{s:{s:o}}", "add", type, &value) ||
+ !obj_info_matches(value, family, table, NULL, name))
+ continue;
+
+ json_object_set_new(value, "handle", json_integer(handle));
+ return MNL_CB_OK;
+ }
+ return json_echo_error(monh, "JSON %s object '%s %s %s' not found.\n",
+ type, family, table, name);
+}
+
+int json_events_cb(const struct nlmsghdr *nlh, struct netlink_mon_handler *monh)
+{
+ json_t *root = monh->ctx->nft->json_root;
+ json_t *array;
+
+ if (!root)
+ return MNL_CB_OK;
+
+ if (json_unpack(root, "{s:o}", "nftables", &array)) {
+ erec_queue(error(int_loc, "Invalid JSON root element\n"),
+ monh->ctx->msgs);
+ return MNL_CB_STOP;
+ }
+
+ switch (NFNL_MSG_TYPE(nlh->nlmsg_type)) {
+ case NFT_MSG_NEWTABLE:
+ return json_update_table(monh, array, nlh);
+ case NFT_MSG_NEWCHAIN:
+ return json_update_chain(monh, array, nlh);
+ case NFT_MSG_NEWRULE:
+ return json_update_rule(monh, array, nlh);
+ case NFT_MSG_NEWSET:
+ return json_update_set(monh, array, nlh);
+ case NFT_MSG_NEWOBJ:
+ return json_update_obj(monh, array, nlh);
+ }
+
+ return MNL_CB_OK;
+}
+
+void json_print_echo(struct nft_ctx *ctx)
+{
+ if (!ctx->json_root)
+ return;
+
+ json_dumpf(ctx->json_root, ctx->output.output_fp, JSON_PRESERVE_ORDER);
+ json_decref(ctx->json_root);
+ ctx->json_root = NULL;
+}
--- /dev/null
+#!/usr/bin/python2
+
+import sys
+import os
+import json
+
+TESTS_PATH = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, os.path.join(TESTS_PATH, '../../py/'))
+
+from nftables import Nftables
+
+# Change working directory to repository root
+os.chdir(TESTS_PATH + "/../..")
+
+if not os.path.exists('src/.libs/libnftables.so'):
+ print "The nftables library does not exist. " \
+ "You need to build the project."
+ sys.exit(1)
+
+nftables = Nftables(sofile = 'src/.libs/libnftables.so')
+nftables.set_echo_output(True)
+
+# various commands to work with
+
+flush_ruleset = { "flush": { "ruleset": None } }
+
+add_table = { "add": {
+ "table": {
+ "family": "inet",
+ "name": "t",
+ }
+}}
+
+add_chain = { "add": {
+ "chain": {
+ "family": "inet",
+ "table": "t",
+ "name": "c"
+ }
+}}
+
+add_set = { "add": {
+ "set": {
+ "family": "inet",
+ "table": "t",
+ "name": "s",
+ "type": "inet_service"
+ }
+}}
+
+add_rule = { "add": {
+ "rule": {
+ "family": "inet",
+ "table": "t",
+ "chain": "c",
+ "expr": [ { "accept": None } ]
+ }
+}}
+
+add_counter = { "add": {
+ "counter": {
+ "family": "inet",
+ "table": "t",
+ "name": "c"
+ }
+}}
+
+add_quota = { "add": {
+ "quota": {
+ "family": "inet",
+ "table": "t",
+ "name": "q",
+ "bytes": 65536
+ }
+}}
+
+# helper functions
+
+def exit_err(msg):
+ print "Error: %s" % msg
+ sys.exit(1)
+
+def exit_dump(e, obj):
+ print "FAIL: %s" % e
+ print "Output was:"
+ json.dumps(out, sort_keys = True, indent = 4, separators = (',', ': '))
+ sys.exit(1)
+
+def do_flush():
+ rc, out, err = nftables.json_cmd({ "nftables": [flush_ruleset] })
+ if not rc is 0:
+ exit_err("flush ruleset failed: %s" % err)
+
+def do_command(cmd):
+ if not type(cmd) is list:
+ cmd = [cmd]
+ rc, out, err = nftables.json_cmd({ "nftables": cmd })
+ if not rc is 0:
+ exit_err("command failed: %s" % err)
+ return out
+
+# single commands first
+
+do_flush()
+
+print "Adding table t"
+out = do_command(add_table)
+try:
+ table_out = out["nftables"][0]
+ table_handle = out["nftables"][0]["add"]["table"]["handle"]
+except Exception as e:
+ exit_dump(e, out)
+
+print "Adding chain c"
+out = do_command(add_chain)
+try:
+ chain_out = out["nftables"][0]
+ chain_handle = out["nftables"][0]["add"]["chain"]["handle"]
+except Exception as e:
+ exit_dump(e, out)
+
+print "Adding set s"
+out = do_command(add_set)
+try:
+ set_out = out["nftables"][0]
+ set_handle = out["nftables"][0]["add"]["set"]["handle"]
+except Exception as e:
+ exit_dump(e, out)
+
+print "Adding rule"
+out = do_command(add_rule)
+try:
+ rule_out = out["nftables"][0]
+ rule_handle = out["nftables"][0]["add"]["rule"]["handle"]
+except Exception as e:
+ exit_dump(e, out)
+
+print "Adding counter"
+out = do_command(add_counter)
+try:
+ counter_out = out["nftables"][0]
+ counter_handle = out["nftables"][0]["add"]["counter"]["handle"]
+except Exception as e:
+ exit_dump(e, out)
+
+print "Adding quota"
+out = do_command(add_quota)
+try:
+ quota_out = out["nftables"][0]
+ quota_handle = out["nftables"][0]["add"]["quota"]["handle"]
+except Exception as e:
+ exit_dump(e, out)
+
+# adjust names and add items again
+# Note: Add second chain to same table, otherwise it's handle will be the same
+# as before. Same for the set and the rule. Bug?
+
+table_out["add"]["table"]["name"] = "t2"
+#chain_out["add"]["chain"]["table"] = "t2"
+chain_out["add"]["chain"]["name"] = "c2"
+#set_out["add"]["set"]["table"] = "t2"
+set_out["add"]["set"]["name"] = "s2"
+#rule_out["add"]["rule"]["table"] = "t2"
+#rule_out["add"]["rule"]["chain"] = "c2"
+counter_out["add"]["counter"]["name"] = "c2"
+quota_out["add"]["quota"]["name"] = "q2"
+
+print "Adding table t2"
+out = do_command(table_out)
+if out["nftables"][0]["add"]["table"]["handle"] == table_handle:
+ exit_err("handle not changed in re-added table!")
+
+print "Adding chain c2"
+out = do_command(chain_out)
+if out["nftables"][0]["add"]["chain"]["handle"] == chain_handle:
+ exit_err("handle not changed in re-added chain!")
+
+print "Adding set s2"
+out = do_command(set_out)
+if out["nftables"][0]["add"]["set"]["handle"] == set_handle:
+ exit_err("handle not changed in re-added set!")
+
+print "Adding rule again"
+out = do_command(rule_out)
+if out["nftables"][0]["add"]["rule"]["handle"] == rule_handle:
+ exit_err("handle not changed in re-added rule!")
+
+print "Adding counter c2"
+out = do_command(counter_out)
+if out["nftables"][0]["add"]["counter"]["handle"] == counter_handle:
+ exit_err("handle not changed in re-added counter!")
+
+print "Adding quota q2"
+out = do_command(quota_out)
+if out["nftables"][0]["add"]["quota"]["handle"] == quota_handle:
+ exit_err("handle not changed in re-added quota!")
+
+# now multiple commands
+
+do_flush()
+
+print "doing multi add"
+add_multi = [ add_table, add_chain, add_set, add_rule ]
+out = do_command(add_multi)
+out = out["nftables"]
+
+if not "handle" in out[0]["add"]["table"] or \
+ not "handle" in out[1]["add"]["chain"] or \
+ not "handle" in out[2]["add"]["set"] or \
+ not "handle" in out[3]["add"]["rule"]:
+ exit_err("handle(s) missing in multi cmd output!")
projects / thirdparty / nftables.git / commitdiff
