obj: Introduce struct obj_ops::attr_policy

Just like with struct expr_ops::attr_policy, enable object types to
inform about restrictions on attribute use. This way generic object code
may perform sanity checks before dispatching to object ops.

Signed-off-by: Phil Sutter <phil@nwl.cc>

diff --git a/include/obj.h b/include/obj.h
index 6d2af8d5527d3795998672becd6ec6ac84ae0784..d2177377860d6d06b65274e3b0886757009f7902 100644 (file)
--- a/include/obj.h
+++ b/include/obj.h
@@ -105,6 +105,7 @@ struct obj_ops {
        uint32_t type;
        size_t  alloc_len;
        int     nftnl_max_attr;
+       struct attr_policy *attr_policy;
        int     (*set)(struct nftnl_obj *e, uint16_t type, const void *data, uint32_t data_len);
        const void *(*get)(const struct nftnl_obj *e, uint16_t type, uint32_t *data_len);
        int     (*parse)(struct nftnl_obj *e, struct nlattr *attr);

diff --git a/src/obj/counter.c b/src/obj/counter.c
index 982da2c6678e56cf02e7af084eb4642d8a42190f..44524d71b1698dd3b7b3abe431a86381ef9d86e5 100644 (file)
--- a/src/obj/counter.c
+++ b/src/obj/counter.c
@@ -116,11 +116,17 @@ static int nftnl_obj_counter_snprintf(char *buf, size_t len, uint32_t flags,
                        ctr->pkts, ctr->bytes);
 }
 
+static struct attr_policy obj_ctr_attr_policy[__NFTNL_OBJ_CTR_MAX] = {
+       [NFTNL_OBJ_CTR_BYTES]   = { .maxlen = sizeof(uint64_t) },
+       [NFTNL_OBJ_CTR_PKTS]    = { .maxlen = sizeof(uint64_t) },
+};
+
 struct obj_ops obj_ops_counter = {
        .name           = "counter",
        .type           = NFT_OBJECT_COUNTER,
        .alloc_len      = sizeof(struct nftnl_obj_counter),
        .nftnl_max_attr = __NFTNL_OBJ_CTR_MAX - 1,
+       .attr_policy    = obj_ctr_attr_policy,
        .set            = nftnl_obj_counter_set,
        .get            = nftnl_obj_counter_get,
        .parse          = nftnl_obj_counter_parse,

diff --git a/src/obj/ct_expect.c b/src/obj/ct_expect.c
index 60014dc9848b58276fc1b6211b45b50057cc0113..978af152c5a8e5fc33d1316128c53f74fda27b5e 100644 (file)
--- a/src/obj/ct_expect.c
+++ b/src/obj/ct_expect.c
@@ -185,11 +185,21 @@ static int nftnl_obj_ct_expect_snprintf(char *buf, size_t remain,
        return offset;
 }
 
+static struct attr_policy
+obj_ct_expect_attr_policy[__NFTNL_OBJ_CT_EXPECT_MAX] = {
+       [NFTNL_OBJ_CT_EXPECT_L3PROTO]   = { .maxlen = sizeof(uint16_t) },
+       [NFTNL_OBJ_CT_EXPECT_L4PROTO]   = { .maxlen = sizeof(uint8_t) },
+       [NFTNL_OBJ_CT_EXPECT_DPORT]     = { .maxlen = sizeof(uint16_t) },
+       [NFTNL_OBJ_CT_EXPECT_TIMEOUT]   = { .maxlen = sizeof(uint32_t) },
+       [NFTNL_OBJ_CT_EXPECT_SIZE]      = { .maxlen = sizeof(uint8_t) },
+};
+
 struct obj_ops obj_ops_ct_expect = {
        .name           = "ct_expect",
        .type           = NFT_OBJECT_CT_EXPECT,
        .alloc_len      = sizeof(struct nftnl_obj_ct_expect),
        .nftnl_max_attr = __NFTNL_OBJ_CT_EXPECT_MAX - 1,
+       .attr_policy    = obj_ct_expect_attr_policy,
        .set            = nftnl_obj_ct_expect_set,
        .get            = nftnl_obj_ct_expect_get,
        .parse          = nftnl_obj_ct_expect_parse,

diff --git a/src/obj/ct_helper.c b/src/obj/ct_helper.c
index b8b05fd9eee8c073cc428150af90748473dda26f..aa8e9262ec5aaf2250bb5a4d97481a3c5c06e26a 100644 (file)
--- a/src/obj/ct_helper.c
+++ b/src/obj/ct_helper.c
@@ -139,11 +139,22 @@ static int nftnl_obj_ct_helper_snprintf(char *buf, size_t len,
                        helper->name, helper->l3proto, helper->l4proto);
 }
 
+/* from kernel's include/net/netfilter/nf_conntrack_helper.h */
+#define NF_CT_HELPER_NAME_LEN  16
+
+static struct attr_policy
+obj_ct_helper_attr_policy[__NFTNL_OBJ_CT_HELPER_MAX] = {
+       [NFTNL_OBJ_CT_HELPER_NAME]      = { .maxlen = NF_CT_HELPER_NAME_LEN },
+       [NFTNL_OBJ_CT_HELPER_L3PROTO]   = { .maxlen = sizeof(uint16_t) },
+       [NFTNL_OBJ_CT_HELPER_L4PROTO]   = { .maxlen = sizeof(uint8_t) },
+};
+
 struct obj_ops obj_ops_ct_helper = {
        .name           = "ct_helper",
        .type           = NFT_OBJECT_CT_HELPER,
        .alloc_len      = sizeof(struct nftnl_obj_ct_helper),
        .nftnl_max_attr = __NFTNL_OBJ_CT_HELPER_MAX - 1,
+       .attr_policy    = obj_ct_helper_attr_policy,
        .set            = nftnl_obj_ct_helper_set,
        .get            = nftnl_obj_ct_helper_get,
        .parse          = nftnl_obj_ct_helper_parse,

diff --git a/src/obj/ct_timeout.c b/src/obj/ct_timeout.c
index 011d92867a077bd28a35392326cc34e102e2e189..88522d8c89bce7d89eb8f5c800fd540915ef5b2d 100644 (file)
--- a/src/obj/ct_timeout.c
+++ b/src/obj/ct_timeout.c
@@ -308,11 +308,18 @@ static int nftnl_obj_ct_timeout_snprintf(char *buf, size_t remain,
        return offset;
 }
 
+static struct attr_policy
+obj_ct_timeout_attr_policy[__NFTNL_OBJ_CT_TIMEOUT_MAX] = {
+       [NFTNL_OBJ_CT_TIMEOUT_L3PROTO]  = { .maxlen = sizeof(uint16_t) },
+       [NFTNL_OBJ_CT_TIMEOUT_L4PROTO]  = { .maxlen = sizeof(uint8_t) },
+};
+
 struct obj_ops obj_ops_ct_timeout = {
        .name           = "ct_timeout",
        .type           = NFT_OBJECT_CT_TIMEOUT,
        .alloc_len      = sizeof(struct nftnl_obj_ct_timeout),
        .nftnl_max_attr = __NFTNL_OBJ_CT_TIMEOUT_MAX - 1,
+       .attr_policy    = obj_ct_timeout_attr_policy,
        .set            = nftnl_obj_ct_timeout_set,
        .get            = nftnl_obj_ct_timeout_get,
        .parse          = nftnl_obj_ct_timeout_parse,

diff --git a/src/obj/limit.c b/src/obj/limit.c
index 83cb1935fc8e9064e648db24a4c484c62cfa7ac4..0c7362e55e682e14362b735c1c0667eb0240a5a3 100644 (file)
--- a/src/obj/limit.c
+++ b/src/obj/limit.c
@@ -157,11 +157,20 @@ static int nftnl_obj_limit_snprintf(char *buf, size_t len,
                        limit->burst, limit->type, limit->flags);
 }
 
+static struct attr_policy obj_limit_attr_policy[__NFTNL_OBJ_LIMIT_MAX] = {
+       [NFTNL_OBJ_LIMIT_RATE]  = { .maxlen = sizeof(uint64_t) },
+       [NFTNL_OBJ_LIMIT_UNIT]  = { .maxlen = sizeof(uint64_t) },
+       [NFTNL_OBJ_LIMIT_BURST] = { .maxlen = sizeof(uint32_t) },
+       [NFTNL_OBJ_LIMIT_TYPE]  = { .maxlen = sizeof(uint32_t) },
+       [NFTNL_OBJ_LIMIT_FLAGS] = { .maxlen = sizeof(uint32_t) },
+};
+
 struct obj_ops obj_ops_limit = {
        .name           = "limit",
        .type           = NFT_OBJECT_LIMIT,
        .alloc_len      = sizeof(struct nftnl_obj_limit),
        .nftnl_max_attr = __NFTNL_OBJ_LIMIT_MAX - 1,
+       .attr_policy    = obj_limit_attr_policy,
        .set            = nftnl_obj_limit_set,
        .get            = nftnl_obj_limit_get,
        .parse          = nftnl_obj_limit_parse,

diff --git a/src/obj/quota.c b/src/obj/quota.c
index 665d7caf4a5d55679311101f3cb3762106d7f6d4..b48ba91a4df110a60d6c1927dc9f9c1d4f33ab35 100644 (file)
--- a/src/obj/quota.c
+++ b/src/obj/quota.c
@@ -133,11 +133,18 @@ static int nftnl_obj_quota_snprintf(char *buf, size_t len,
                        quota->bytes, quota->flags);
 }
 
+static struct attr_policy obj_quota_attr_policy[__NFTNL_OBJ_QUOTA_MAX] = {
+       [NFTNL_OBJ_QUOTA_BYTES]         = { .maxlen = sizeof(uint64_t) },
+       [NFTNL_OBJ_QUOTA_CONSUMED]      = { .maxlen = sizeof(uint64_t) },
+       [NFTNL_OBJ_QUOTA_FLAGS]         = { .maxlen = sizeof(uint32_t) },
+};
+
 struct obj_ops obj_ops_quota = {
        .name           = "quota",
        .type           = NFT_OBJECT_QUOTA,
        .alloc_len      = sizeof(struct nftnl_obj_quota),
        .nftnl_max_attr = __NFTNL_OBJ_QUOTA_MAX - 1,
+       .attr_policy    = obj_quota_attr_policy,
        .set            = nftnl_obj_quota_set,
        .get            = nftnl_obj_quota_get,
        .parse          = nftnl_obj_quota_parse,

diff --git a/src/obj/secmark.c b/src/obj/secmark.c
index 83cd1dc2264ede751a49e6a50ec4fc20ef8991f6..eea96647cff72252fe20f8051d9470aec346e3ab 100644 (file)
--- a/src/obj/secmark.c
+++ b/src/obj/secmark.c
@@ -105,11 +105,16 @@ static int nftnl_obj_secmark_snprintf(char *buf, size_t len,
        return snprintf(buf, len, "context %s ", secmark->ctx);
 }
 
+static struct attr_policy obj_secmark_attr_policy[__NFTNL_OBJ_SECMARK_MAX] = {
+       [NFTNL_OBJ_SECMARK_CTX] = { .maxlen = NFT_SECMARK_CTX_MAXLEN },
+};
+
 struct obj_ops obj_ops_secmark = {
        .name           = "secmark",
        .type           = NFT_OBJECT_SECMARK,
        .alloc_len      = sizeof(struct nftnl_obj_secmark),
        .nftnl_max_attr = __NFTNL_OBJ_SECMARK_MAX - 1,
+       .attr_policy    = obj_secmark_attr_policy,
        .set            = nftnl_obj_secmark_set,
        .get            = nftnl_obj_secmark_get,
        .parse          = nftnl_obj_secmark_parse,

diff --git a/src/obj/synproxy.c b/src/obj/synproxy.c
index f7c77627b56e9585d1ca832e6457834fdf813f1b..65fbcf76629ad49425327c6107a8474d2cbdc176 100644 (file)
--- a/src/obj/synproxy.c
+++ b/src/obj/synproxy.c
@@ -132,11 +132,18 @@ static int nftnl_obj_synproxy_snprintf(char *buf, size_t len,
         return offset;
 }
 
+static struct attr_policy obj_synproxy_attr_policy[__NFTNL_OBJ_SYNPROXY_MAX] = {
+       [NFTNL_OBJ_SYNPROXY_MSS]        = { .maxlen = sizeof(uint16_t) },
+       [NFTNL_OBJ_SYNPROXY_WSCALE]     = { .maxlen = sizeof(uint8_t) },
+       [NFTNL_OBJ_SYNPROXY_FLAGS]      = { .maxlen = sizeof(uint32_t) },
+};
+
 struct obj_ops obj_ops_synproxy = {
        .name           = "synproxy",
        .type           = NFT_OBJECT_SYNPROXY,
        .alloc_len      = sizeof(struct nftnl_obj_synproxy),
        .nftnl_max_attr = __NFTNL_OBJ_SYNPROXY_MAX - 1,
+       .attr_policy    = obj_synproxy_attr_policy,
        .set            = nftnl_obj_synproxy_set,
        .get            = nftnl_obj_synproxy_get,
        .parse          = nftnl_obj_synproxy_parse,

diff --git a/src/obj/tunnel.c b/src/obj/tunnel.c
index 72985eeb761cd6b9967f2632a79629f5fc675703..07b3b2ac0cb8625add7f022d7fa9992cbcc142d0 100644 (file)
--- a/src/obj/tunnel.c
+++ b/src/obj/tunnel.c
@@ -536,11 +536,31 @@ static int nftnl_obj_tunnel_snprintf(char *buf, size_t len,
        return snprintf(buf, len, "id %u ", tun->id);
 }
 
+static struct attr_policy obj_tunnel_attr_policy[__NFTNL_OBJ_TUNNEL_MAX] = {
+       [NFTNL_OBJ_TUNNEL_ID]           = { .maxlen = sizeof(uint32_t) },
+       [NFTNL_OBJ_TUNNEL_IPV4_SRC]     = { .maxlen = sizeof(uint32_t) },
+       [NFTNL_OBJ_TUNNEL_IPV4_DST]     = { .maxlen = sizeof(uint32_t) },
+       [NFTNL_OBJ_TUNNEL_IPV6_SRC]     = { .maxlen = sizeof(struct in6_addr) },
+       [NFTNL_OBJ_TUNNEL_IPV6_DST]     = { .maxlen = sizeof(struct in6_addr) },
+       [NFTNL_OBJ_TUNNEL_IPV6_FLOWLABEL] = { .maxlen = sizeof(uint32_t) },
+       [NFTNL_OBJ_TUNNEL_SPORT]        = { .maxlen = sizeof(uint16_t) },
+       [NFTNL_OBJ_TUNNEL_DPORT]        = { .maxlen = sizeof(uint16_t) },
+       [NFTNL_OBJ_TUNNEL_FLAGS]        = { .maxlen = sizeof(uint32_t) },
+       [NFTNL_OBJ_TUNNEL_TOS]          = { .maxlen = sizeof(uint8_t) },
+       [NFTNL_OBJ_TUNNEL_TTL]          = { .maxlen = sizeof(uint8_t) },
+       [NFTNL_OBJ_TUNNEL_VXLAN_GBP]    = { .maxlen = sizeof(uint32_t) },
+       [NFTNL_OBJ_TUNNEL_ERSPAN_VERSION] = { .maxlen = sizeof(uint32_t) },
+       [NFTNL_OBJ_TUNNEL_ERSPAN_V1_INDEX] = { .maxlen = sizeof(uint32_t) },
+       [NFTNL_OBJ_TUNNEL_ERSPAN_V2_HWID] = { .maxlen = sizeof(uint8_t) },
+       [NFTNL_OBJ_TUNNEL_ERSPAN_V2_DIR] = { .maxlen = sizeof(uint8_t) },
+};
+
 struct obj_ops obj_ops_tunnel = {
        .name           = "tunnel",
        .type           = NFT_OBJECT_TUNNEL,
        .alloc_len      = sizeof(struct nftnl_obj_tunnel),
        .nftnl_max_attr = __NFTNL_OBJ_TUNNEL_MAX - 1,
+       .attr_policy    = obj_tunnel_attr_policy,
        .set            = nftnl_obj_tunnel_set,
        .get            = nftnl_obj_tunnel_get,
        .parse          = nftnl_obj_tunnel_parse,