chain: add userdata and comment support

Adds NFTNL_CHAIN_USERDATA, in order to support userdata for chains.

Adds NFTNL_UDATA_CHAIN_COMMENT chain userdata type to support storing a
comment.

Relies on NFTA_CHAIN_USERDATA.

Signed-off-by: Jose M. Guisado Gomez <guigom@riseup.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/libnftnl/chain.h b/include/libnftnl/chain.h
index 0e57a5a0ef2f94fada65c9121f5a3fad0134c7cb..f56e5815c925f35044c29770489c5716093e50ad 100644 (file)
--- a/include/libnftnl/chain.h
+++ b/include/libnftnl/chain.h
@@ -34,6 +34,7 @@ enum nftnl_chain_attr {
        NFTNL_CHAIN_DEVICES,
        NFTNL_CHAIN_FLAGS,
        NFTNL_CHAIN_ID,
+       NFTNL_CHAIN_USERDATA,
        __NFTNL_CHAIN_MAX
 };
 #define NFTNL_CHAIN_MAX (__NFTNL_CHAIN_MAX - 1)

diff --git a/include/libnftnl/udata.h b/include/libnftnl/udata.h
index 2e38fccb134dd963b019ef8e041043a0fec39387..dbf3a60ff06e9356f7fd38de90dad82e2b9a4c11 100644 (file)
--- a/include/libnftnl/udata.h
+++ b/include/libnftnl/udata.h
@@ -15,6 +15,12 @@ enum nftnl_udata_table_types {
 };
 #define NFTNL_UDATA_TABLE_MAX (__NFTNL_UDATA_TABLE_MAX - 1)
 
+enum nftnl_udata_chain_types {
+       NFTNL_UDATA_CHAIN_COMMENT,
+       __NFTNL_UDATA_CHAIN_MAX
+};
+#define NFTNL_UDATA_CHAIN_MAX (__NFTNL_UDATA_CHAIN_MAX - 1)
+
 enum nftnl_udata_rule_types {
        NFTNL_UDATA_RULE_COMMENT,
        NFTNL_UDATA_RULE_EBTABLES_POLICY,

diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
index 809977752977a6bb5b384ec71c709da8bf314aee..77d178a514b25ba7428f0c1d92a9baa5556f48db 100644 (file)
--- a/include/linux/netfilter/nf_tables.h
+++ b/include/linux/netfilter/nf_tables.h
@@ -197,6 +197,7 @@ enum nft_table_attributes {
  * @NFTA_CHAIN_TYPE: type name of the string (NLA_NUL_STRING)
  * @NFTA_CHAIN_COUNTERS: counter specification of the chain (NLA_NESTED: nft_counter_attributes)
  * @NFTA_CHAIN_FLAGS: chain flags
+ * @NFTA_CHAIN_USERDATA: user data (NLA_BINARY)
  */
 enum nft_chain_attributes {
        NFTA_CHAIN_UNSPEC,
@@ -211,6 +212,7 @@ enum nft_chain_attributes {
        NFTA_CHAIN_PAD,
        NFTA_CHAIN_FLAGS,
        NFTA_CHAIN_ID,
+       NFTA_CHAIN_USERDATA,
        __NFTA_CHAIN_MAX
 };
 #define NFTA_CHAIN_MAX         (__NFTA_CHAIN_MAX - 1)

diff --git a/src/chain.c b/src/chain.c
index 94efa9088c97498d1cd448c521a597e5fb316f68..aac9da6319556dfb9922b0ccc76392c4e12b16b0 100644 (file)
--- a/src/chain.c
+++ b/src/chain.c
@@ -51,6 +51,11 @@ struct nftnl_chain {
        uint32_t        flags;
        uint32_t        chain_id;
 
+       struct {
+               void            *data;
+               uint32_t        len;
+       } user;
+
        struct list_head rule_list;
 };
 
@@ -125,6 +130,8 @@ void nftnl_chain_free(const struct nftnl_chain *c)
                xfree(c->type);
        if (c->flags & (1 << NFTNL_CHAIN_DEV))
                xfree(c->dev);
+       if (c->flags & (1 << NFTNL_CHAIN_USERDATA))
+               xfree(c->user.data);
        if (c->flags & (1 << NFTNL_CHAIN_DEVICES)) {
                for (i = 0; i < c->dev_array_len; i++)
                        xfree(c->dev_array[i]);
@@ -290,6 +297,16 @@ int nftnl_chain_set_data(struct nftnl_chain *c, uint16_t attr,
        case NFTNL_CHAIN_ID:
                memcpy(&c->chain_id, data, sizeof(c->chain_id));
                break;
+       case NFTNL_CHAIN_USERDATA:
+               if (c->flags & (1 << NFTNL_CHAIN_USERDATA))
+                       xfree(c->user.data);
+
+               c->user.data = malloc(data_len);
+               if (!c->user.data)
+                       return -1;
+               memcpy(c->user.data, data, data_len);
+               c->user.len = data_len;
+               break;
        }
        c->flags |= (1 << attr);
        return 0;
@@ -391,6 +408,9 @@ const void *nftnl_chain_get_data(const struct nftnl_chain *c, uint16_t attr,
        case NFTNL_CHAIN_ID:
                *data_len = sizeof(uint32_t);
                return &c->chain_id;
+       case NFTNL_CHAIN_USERDATA:
+               *data_len = c->user.len;
+               return c->user.data;
        }
        return NULL;
 }
@@ -513,6 +533,8 @@ void nftnl_chain_nlmsg_build_payload(struct nlmsghdr *nlh, const struct nftnl_ch
                mnl_attr_put_u32(nlh, NFTA_CHAIN_FLAGS, htonl(c->chain_flags));
        if (c->flags & (1 << NFTNL_CHAIN_ID))
                mnl_attr_put_u32(nlh, NFTA_CHAIN_ID, htonl(c->chain_id));
+       if (c->flags & (1 << NFTNL_CHAIN_USERDATA))
+               mnl_attr_put(nlh, NFTA_CHAIN_USERDATA, c->user.len, c->user.data);
 }
 
 EXPORT_SYMBOL(nftnl_chain_rule_add);
@@ -576,6 +598,10 @@ static int nftnl_chain_parse_attr_cb(const struct nlattr *attr, void *data)
                if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
                        abi_breakage();
                break;
+       case NFTA_CHAIN_USERDATA:
+               if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0)
+                       abi_breakage();
+               break;
        }
 
        tb[type] = attr;
@@ -777,6 +803,11 @@ int nftnl_chain_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_chain *c)
                c->chain_id = ntohl(mnl_attr_get_u32(tb[NFTA_CHAIN_ID]));
                c->flags |= (1 << NFTNL_CHAIN_ID);
        }
+       if (tb[NFTA_CHAIN_USERDATA]) {
+               nftnl_chain_set_data(c, NFTNL_CHAIN_USERDATA,
+                                    mnl_attr_get_payload(tb[NFTA_CHAIN_USERDATA]),
+                                    mnl_attr_get_payload_len(tb[NFTA_CHAIN_USERDATA]));
+       }
 
        c->family = nfg->nfgen_family;
        c->flags |= (1 << NFTNL_CHAIN_FAMILY);