#include "time-util.h"
#define NFT_SYSTEMD_DNAT_MAP_NAME "map_port_ipport"
-#define NFT_SYSTEMD_TABLE_NAME "io.systemd.nat"
+#define NFT_SYSTEMD_TABLE_NAME "io.systemd.nat"
#define NFT_SYSTEMD_MASQ_SET_NAME "masq_saddr"
#define NFNL_DEFAULT_TIMEOUT_USECS (1ULL * USEC_PER_SEC)
#define UDP_DPORT_OFFSET 2
+static sd_netlink_message **netlink_message_unref_many(sd_netlink_message **m) {
+ if (!m)
+ return NULL;
+
+ /* This does not free array. The end of the array must be NULL. */
+
+ for (sd_netlink_message **p = m; *p; p++)
+ *p = sd_netlink_message_unref(*p);
+
+ return m;
+}
+
+DEFINE_TRIVIAL_CLEANUP_FUNC(sd_netlink_message**, netlink_message_unref_many);
+
static int nfnl_netlink_sendv(
sd_netlink *nfnl,
sd_netlink_message *messages[static 1],
static int nfnl_add_open_expr_container(sd_netlink_message *m, const char *name) {
int r;
+ assert(m);
+ assert(name);
+
r = sd_netlink_message_open_array(m, NFTA_LIST_ELEM);
if (r < 0)
return r;
return sd_netlink_message_open_container_union(m, NFTA_EXPR_DATA, name);
}
-static int nfnl_add_expr_fib(sd_netlink_message *m, uint32_t nft_fib_flags,
- enum nft_fib_result result,
- enum nft_registers dreg) {
+static int nfnl_add_expr_fib(
+ sd_netlink_message *m,
+ uint32_t nft_fib_flags,
+ enum nft_fib_result result,
+ enum nft_registers dreg) {
+
int r;
+ assert(m);
+
r = nfnl_add_open_expr_container(m, "fib");
if (r < 0)
return r;
r = sd_netlink_message_append_u32(m, NFTA_FIB_FLAGS, htobe32(nft_fib_flags));
if (r < 0)
return r;
+
r = sd_netlink_message_append_u32(m, NFTA_FIB_RESULT, htobe32(result));
if (r < 0)
return r;
+
r = sd_netlink_message_append_u32(m, NFTA_FIB_DREG, htobe32(dreg));
if (r < 0)
return r;
return sd_netlink_message_close_container(m); /* NFTA_LIST_ELEM */
}
-static int nfnl_add_expr_meta(sd_netlink_message *m, enum nft_meta_keys key,
- enum nft_registers dreg) {
+static int nfnl_add_expr_meta(
+ sd_netlink_message *m,
+ enum nft_meta_keys key,
+ enum nft_registers dreg) {
+
int r;
+ assert(m);
+
r = nfnl_add_open_expr_container(m, "meta");
if (r < 0)
return r;
return sd_netlink_message_close_container(m); /* NFTA_LIST_ELEM */
}
-static int nfnl_add_expr_payload(sd_netlink_message *m, enum nft_payload_bases pb,
- uint32_t offset, uint32_t len, enum nft_registers dreg) {
+static int nfnl_add_expr_payload(
+ sd_netlink_message *m,
+ enum nft_payload_bases pb,
+ uint32_t offset,
+ uint32_t len,
+ enum nft_registers dreg) {
+
int r;
+ assert(m);
+
r = nfnl_add_open_expr_container(m, "payload");
if (r < 0)
return r;
r = sd_netlink_message_append_u32(m, NFTA_PAYLOAD_DREG, htobe32(dreg));
if (r < 0)
return r;
+
r = sd_netlink_message_append_u32(m, NFTA_PAYLOAD_BASE, htobe32(pb));
if (r < 0)
return r;
+
r = sd_netlink_message_append_u32(m, NFTA_PAYLOAD_OFFSET, htobe32(offset));
if (r < 0)
return r;
+
r = sd_netlink_message_append_u32(m, NFTA_PAYLOAD_LEN, htobe32(len));
if (r < 0)
return r;
r = sd_netlink_message_close_container(m); /* NFTA_EXPR_DATA */
if (r < 0)
return r;
+
return sd_netlink_message_close_container(m); /* NFTA_LIST_ELEM */
}
-static int nfnl_add_expr_lookup_set_data(sd_netlink_message *m, const char *set_name,
- enum nft_registers sreg) {
+static int nfnl_add_expr_lookup_set_data(
+ sd_netlink_message *m,
+ const char *set_name,
+ enum nft_registers sreg) {
+
int r;
+ assert(m);
+ assert(set_name);
+
r = nfnl_add_open_expr_container(m, "lookup");
if (r < 0)
return r;
return sd_netlink_message_append_u32(m, NFTA_LOOKUP_SREG, htobe32(sreg));
}
-static int nfnl_add_expr_lookup_set(sd_netlink_message *m, const char *set_name,
- enum nft_registers sreg) {
+static int nfnl_add_expr_lookup_set(
+ sd_netlink_message *m,
+ const char *set_name,
+ enum nft_registers sreg) {
+
int r;
+ assert(m);
+ assert(set_name);
+
r = nfnl_add_expr_lookup_set_data(m, set_name, sreg);
if (r < 0)
return r;
r = sd_netlink_message_close_container(m); /* NFTA_EXPR_DATA */
if (r < 0)
return r;
+
return sd_netlink_message_close_container(m); /* NFTA_LIST_ELEM */
}
-static int nfnl_add_expr_lookup_map(sd_netlink_message *m, const char *set_name,
- enum nft_registers sreg, enum nft_registers dreg) {
+static int nfnl_add_expr_lookup_map(
+ sd_netlink_message *m,
+ const char *set_name,
+ enum nft_registers sreg,
+ enum nft_registers dreg) {
+
int r;
+ assert(m);
+ assert(set_name);
+
r = nfnl_add_expr_lookup_set_data(m, set_name, sreg);
if (r < 0)
return r;
return sd_netlink_message_close_container(m); /* NFTA_LIST_ELEM */
}
-static int nfnl_add_expr_data(sd_netlink_message *m, int attr, const void *data, uint32_t dlen) {
+static int nfnl_add_expr_data(
+ sd_netlink_message *m,
+ int attr,
+ const void *data,
+ uint32_t dlen) {
+
int r;
+ assert(m);
+ assert(data);
+
r = sd_netlink_message_open_container(m, attr);
if (r < 0)
return r;
+
r = sd_netlink_message_append_data(m, NFTA_DATA_VALUE, data, dlen);
if (r < 0)
return r;
return sd_netlink_message_close_container(m); /* attr */
}
-static int nfnl_add_expr_cmp_data(sd_netlink_message *m, const void *data, uint32_t dlen) {
- return nfnl_add_expr_data(m, NFTA_CMP_DATA, data, dlen);
-}
+static int nfnl_add_expr_cmp(
+ sd_netlink_message *m,
+ enum nft_cmp_ops cmp_op,
+ enum nft_registers sreg,
+ const void *data,
+ uint32_t dlen) {
-static int nfnl_add_expr_cmp(sd_netlink_message *m, enum nft_cmp_ops cmp_op,
- enum nft_registers sreg, const void *data, uint32_t dlen) {
int r;
+ assert(m);
+ assert(data);
+
r = nfnl_add_open_expr_container(m, "cmp");
if (r < 0)
return r;
r = sd_netlink_message_append_u32(m, NFTA_CMP_OP, htobe32(cmp_op));
if (r < 0)
return r;
+
r = sd_netlink_message_append_u32(m, NFTA_CMP_SREG, htobe32(sreg));
if (r < 0)
return r;
- r = nfnl_add_expr_cmp_data(m, data, dlen);
+ r = nfnl_add_expr_data(m, NFTA_CMP_DATA, data, dlen);
if (r < 0)
return r;
r = sd_netlink_message_close_container(m); /* NFTA_EXPR_DATA */
if (r < 0)
return r;
+
return sd_netlink_message_close_container(m); /* NFTA_LIST_ELEM */
}
-static int nfnl_add_expr_bitwise(sd_netlink_message *m,
- enum nft_registers sreg,
- enum nft_registers dreg,
- const void *and,
- const void *xor, uint32_t len) {
+static int nfnl_add_expr_bitwise(
+ sd_netlink_message *m,
+ enum nft_registers sreg,
+ enum nft_registers dreg,
+ const void *and,
+ const void *xor,
+ uint32_t len) {
+
int r;
+ assert(m);
+ assert(and);
+ assert(xor);
+
r = nfnl_add_open_expr_container(m, "bitwise");
if (r < 0)
return r;
r = sd_netlink_message_append_u32(m, NFTA_BITWISE_SREG, htobe32(sreg));
if (r < 0)
return r;
+
r = sd_netlink_message_append_u32(m, NFTA_BITWISE_DREG, htobe32(dreg));
if (r < 0)
return r;
+
r = sd_netlink_message_append_u32(m, NFTA_BITWISE_LEN, htobe32(len));
if (r < 0)
return r;
r = sd_netlink_message_close_container(m); /* NFTA_EXPR_DATA */
if (r < 0)
return r;
+
return sd_netlink_message_close_container(m); /* NFTA_LIST_ELEM */
}
-static int nfnl_add_expr_dnat(sd_netlink_message *m,
- int family,
- enum nft_registers areg,
- enum nft_registers preg) {
+static int nfnl_add_expr_dnat(
+ sd_netlink_message *m,
+ int family,
+ enum nft_registers areg,
+ enum nft_registers preg) {
+
int r;
+ assert(m);
+
r = nfnl_add_open_expr_container(m, "nat");
if (r < 0)
return r;
r = sd_netlink_message_append_u32(m, NFTA_NAT_REG_ADDR_MIN, htobe32(areg));
if (r < 0)
return r;
+
r = sd_netlink_message_append_u32(m, NFTA_NAT_REG_PROTO_MIN, htobe32(preg));
if (r < 0)
return r;
+
r = sd_netlink_message_close_container(m);
if (r < 0)
return r;
return sd_netlink_message_close_container(m); /* NFTA_LIST_ELEM */
}
-static int sd_nfnl_message_new_masq_rule(sd_netlink *nfnl, sd_netlink_message **ret, int family,
- const char *chain) {
+static int sd_nfnl_message_new_masq_rule(
+ sd_netlink *nfnl,
+ sd_netlink_message **ret,
+ int family,
+ const char *chain) {
+
_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
int r;
/* -t nat -A POSTROUTING -p protocol -s source/pflen -o out_interface -d destination/pflen -j MASQUERADE */
+ assert(nfnl);
+ assert(ret);
+ assert(IN_SET(family, AF_INET, AF_INET6));
+ assert(chain);
+
r = sd_nfnl_nft_message_new_rule(nfnl, &m, family, NFT_SYSTEMD_TABLE_NAME, chain);
if (r < 0)
return r;
r = sd_netlink_message_close_container(m); /* NFTA_RULE_EXPRESSIONS */
if (r < 0)
return r;
+
*ret = TAKE_PTR(m);
return 0;
}
-static int sd_nfnl_message_new_dnat_rule_pre(sd_netlink *nfnl, sd_netlink_message **ret, int family,
- const char *chain) {
+static int sd_nfnl_message_new_dnat_rule_pre(
+ sd_netlink *nfnl,
+ sd_netlink_message **ret,
+ int family,
+ const char *chain) {
+
_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
enum nft_registers proto_reg;
uint32_t local = RTN_LOCAL;
/* -t nat -A PREROUTING -p protocol --dport local_port -i in_interface -s source/pflen
* -d destination/pflen -j DNAT --to-destination remote_addr:remote_port */
+ assert(nfnl);
+ assert(ret);
+ assert(IN_SET(family, AF_INET, AF_INET6));
+ assert(chain);
+
r = sd_nfnl_nft_message_new_rule(nfnl, &m, family, NFT_SYSTEMD_TABLE_NAME, chain);
if (r < 0)
return r;
return r;
/* 3rd statement: lookup 'l4proto . dport', e.g. 'tcp . 22' as key and
- * store address and port for the dnat mapping in REG1/REG2.
- */
+ * store address and port for the dnat mapping in REG1/REG2. */
r = nfnl_add_expr_lookup_map(m, NFT_SYSTEMD_DNAT_MAP_NAME, NFT_REG32_01, NFT_REG32_01);
if (r < 0)
return r;
r = sd_netlink_message_close_container(m); /* NFTA_RULE_EXPRESSIONS */
if (r < 0)
return r;
+
*ret = TAKE_PTR(m);
return 0;
}
-static int sd_nfnl_message_new_dnat_rule_out(sd_netlink *nfnl, sd_netlink_message **ret,
- int family, const char *chain) {
- static const uint32_t zero = 0, one = 1;
+static int sd_nfnl_message_new_dnat_rule_out(
+ sd_netlink *nfnl,
+ sd_netlink_message **ret,
+ int family,
+ const char *chain) {
+ static const uint32_t zero = 0, one = 1;
_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
enum nft_registers proto_reg;
int r;
+ assert(nfnl);
+ assert(ret);
+ assert(IN_SET(family, AF_INET, AF_INET6));
+ assert(chain);
+
r = sd_nfnl_nft_message_new_rule(nfnl, &m, family, NFT_SYSTEMD_TABLE_NAME, chain);
if (r < 0)
return r;
* the new destination ip and port number.
*
* reg1 and reg2 are clobbered and will then contain the new
- * address/port number.
- */
+ * address/port number. */
r = nfnl_add_expr_lookup_map(m, NFT_SYSTEMD_DNAT_MAP_NAME, NFT_REG32_01, NFT_REG32_01);
if (r < 0)
return r;
r = sd_netlink_message_close_container(m); /* NFTA_RULE_EXPRESSIONS */
if (r < 0)
return r;
+
*ret = TAKE_PTR(m);
return 0;
}
-static int nft_new_set(struct sd_netlink *nfnl,
- sd_netlink_message **ret,
- int family, const char *set_name,
- uint32_t set_id,
- uint32_t flags, uint32_t type, uint32_t klen) {
+static int nft_new_set(
+ struct sd_netlink *nfnl,
+ sd_netlink_message **ret,
+ int family,
+ const char *set_name,
+ uint32_t set_id,
+ uint32_t flags,
+ uint32_t type,
+ uint32_t klen) {
+
_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
int r;
+ assert(nfnl);
+ assert(ret);
+ assert(IN_SET(family, AF_INET, AF_INET6));
+ assert(set_name);
+
r = sd_nfnl_nft_message_new_set(nfnl, &m, family, NFT_SYSTEMD_TABLE_NAME, set_name, set_id, klen);
if (r < 0)
return r;
return r;
}
-static int nft_new_map(struct sd_netlink *nfnl,
- sd_netlink_message **ret,
- int family, const char *set_name, uint32_t set_id,
- uint32_t flags, uint32_t type, uint32_t klen, uint32_t dtype, uint32_t dlen) {
+static int nft_new_map(
+ struct sd_netlink *nfnl,
+ sd_netlink_message **ret,
+ int family,
+ const char *set_name,
+ uint32_t set_id,
+ uint32_t flags,
+ uint32_t type,
+ uint32_t klen,
+ uint32_t dtype,
+ uint32_t dlen) {
+
_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
int r;
+ assert(nfnl);
+ assert(ret);
+ assert(IN_SET(family, AF_INET, AF_INET6));
+ assert(set_name);
+
r = nft_new_set(nfnl, &m, family, set_name, set_id, flags | NFT_SET_MAP, type, klen);
if (r < 0)
return r;
r = sd_netlink_message_append_u32(m, NFTA_SET_DATA_LEN, htobe32(dlen));
if (r < 0)
return r;
+
*ret = TAKE_PTR(m);
return 0;
}
-static int nft_add_element(sd_netlink *nfnl, sd_netlink_message **ret,
- int family, const char *set_name,
- const void *key, uint32_t klen,
- const void *data, uint32_t dlen) {
+static int nft_add_element(
+ sd_netlink *nfnl,
+ sd_netlink_message **ret,
+ int family,
+ const char *set_name,
+ const void *key,
+ uint32_t klen,
+ const void *data,
+ uint32_t dlen) {
+
_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
int r;
+ assert(nfnl);
+ assert(ret);
+ assert(IN_SET(family, AF_INET, AF_INET6));
+ assert(set_name);
+ assert(key);
+ assert(data);
+
/*
* Ideally there would be an API that provides:
*
r = sd_nfnl_nft_message_add_setelem_end(m);
if (r < 0)
return r;
+
*ret = TAKE_PTR(m);
return 0;
}
-static int nft_del_element(sd_netlink *nfnl,
- sd_netlink_message **ret, int family, const char *set_name,
- const void *key, uint32_t klen,
- const void *data, uint32_t dlen) {
+static int nft_del_element(
+ sd_netlink *nfnl,
+ sd_netlink_message **ret,
+ int family,
+ const char *set_name,
+ const void *key,
+ uint32_t klen,
+ const void *data,
+ uint32_t dlen) {
+
_cleanup_(sd_netlink_message_unrefp) sd_netlink_message *m = NULL;
int r;
+ assert(nfnl);
+ assert(ret);
+ assert(IN_SET(family, AF_INET, AF_INET6));
+ assert(set_name);
+ assert(key);
+ assert(data);
+
r = sd_nfnl_nft_message_del_setelems_begin(nfnl, &m, family, NFT_SYSTEMD_TABLE_NAME, set_name);
if (r < 0)
return r;
r = sd_nfnl_nft_message_add_setelem_end(m);
if (r < 0)
return r;
+
*ret = TAKE_PTR(m);
return 0;
}
/* This is needed so 'nft' userspace tool can properly format the contents
* of the set/map when someone uses 'nft' to inspect their content.
*
- * The values cannot be changed, they are part of the nft tool type identifier ABI.
- */
+ * The values cannot be changed, they are part of the nft tool type identifier ABI. */
#define TYPE_BITS 6
enum nft_key_types {
- TYPE_IPADDR = 7,
- TYPE_IP6ADDR = 8,
+ TYPE_IPADDR = 7,
+ TYPE_IP6ADDR = 8,
TYPE_INET_PROTOCOL = 12,
- TYPE_INET_SERVICE = 13,
+ TYPE_INET_SERVICE = 13,
};
static uint32_t concat_types2(enum nft_key_types a, enum nft_key_types b) {
return type;
}
-/* enough space to hold netlink messages for table skeleton */
-#define NFT_INIT_MSGS 16
static int fw_nftables_init_family(sd_netlink *nfnl, int family) {
- sd_netlink_message *batch[NFT_INIT_MSGS] = {};
- size_t msgcnt = 0, i, ip_type_size;
+ sd_netlink_message *messages[12] = {};
+ _unused_ _cleanup_(netlink_message_unref_manyp) sd_netlink_message **unref = messages;
+ size_t msgcnt = 0, ip_type_size;
uint32_t set_id = 0;
int ip_type, r;
+ assert(nfnl);
assert(IN_SET(family, AF_INET, AF_INET6));
- r = sd_nfnl_message_batch_begin(nfnl, &batch[msgcnt]);
+ r = sd_nfnl_message_batch_begin(nfnl, &messages[msgcnt++]);
if (r < 0)
- goto out_unref;
+ return r;
- msgcnt++;
- assert(msgcnt < NFT_INIT_MSGS);
/* Set F_EXCL so table add fails if the table already exists. */
- r = sd_nfnl_nft_message_new_table(nfnl, &batch[msgcnt], family, NFT_SYSTEMD_TABLE_NAME);
+ r = sd_nfnl_nft_message_new_table(nfnl, &messages[msgcnt++], family, NFT_SYSTEMD_TABLE_NAME);
if (r < 0)
- goto out_unref;
-
- msgcnt++;
- assert(msgcnt < NFT_INIT_MSGS);
+ return r;
- r = sd_nfnl_nft_message_new_basechain(nfnl, &batch[msgcnt], family, NFT_SYSTEMD_TABLE_NAME,
+ r = sd_nfnl_nft_message_new_basechain(nfnl, &messages[msgcnt++], family, NFT_SYSTEMD_TABLE_NAME,
"prerouting", "nat",
NF_INET_PRE_ROUTING, NF_IP_PRI_NAT_DST + 1);
if (r < 0)
- goto out_unref;
+ return r;
- msgcnt++;
- assert(msgcnt < NFT_INIT_MSGS);
- r = sd_nfnl_nft_message_new_basechain(nfnl, &batch[msgcnt], family, NFT_SYSTEMD_TABLE_NAME,
+ r = sd_nfnl_nft_message_new_basechain(nfnl, &messages[msgcnt++], family, NFT_SYSTEMD_TABLE_NAME,
"output", "nat",
NF_INET_LOCAL_OUT, NF_IP_PRI_NAT_DST + 1);
if (r < 0)
- goto out_unref;
+ return r;
- msgcnt++;
- assert(msgcnt < NFT_INIT_MSGS);
- r = sd_nfnl_nft_message_new_basechain(nfnl, &batch[msgcnt], family, NFT_SYSTEMD_TABLE_NAME,
+ r = sd_nfnl_nft_message_new_basechain(nfnl, &messages[msgcnt++], family, NFT_SYSTEMD_TABLE_NAME,
"postrouting", "nat",
NF_INET_POST_ROUTING, NF_IP_PRI_NAT_SRC + 1);
if (r < 0)
- goto out_unref;
+ return r;
if (family == AF_INET) {
ip_type_size = sizeof(uint32_t);
ip_type_size = sizeof(struct in6_addr);
ip_type = TYPE_IP6ADDR;
}
- msgcnt++;
- assert(msgcnt < NFT_INIT_MSGS);
/* set to store ip address ranges we should masquerade for */
- r = nft_new_set(nfnl, &batch[msgcnt], family, NFT_SYSTEMD_MASQ_SET_NAME, ++set_id, NFT_SET_INTERVAL, ip_type, ip_type_size);
+ r = nft_new_set(nfnl, &messages[msgcnt++], family, NFT_SYSTEMD_MASQ_SET_NAME, ++set_id, NFT_SET_INTERVAL, ip_type, ip_type_size);
if (r < 0)
- goto out_unref;
+ return r;
/*
* map to store ip address:port pair to dnat to. elements in concatenation
* Example: ip protocol . tcp daddr is sizeof(uint32_t) + sizeof(uint32_t), not
* sizeof(uint8_t) + sizeof(uint16_t).
*/
- msgcnt++;
- assert(msgcnt < NFT_INIT_MSGS);
- r = nft_new_map(nfnl, &batch[msgcnt], family, NFT_SYSTEMD_DNAT_MAP_NAME, ++set_id, 0,
+ r = nft_new_map(nfnl, &messages[msgcnt++], family, NFT_SYSTEMD_DNAT_MAP_NAME, ++set_id, 0,
concat_types2(TYPE_INET_PROTOCOL, TYPE_INET_SERVICE), sizeof(uint32_t) * 2,
concat_types2(ip_type, TYPE_INET_SERVICE), ip_type_size + sizeof(uint32_t));
if (r < 0)
- goto out_unref;
+ return r;
- msgcnt++;
- assert(msgcnt < NFT_INIT_MSGS);
- r = sd_nfnl_message_new_dnat_rule_pre(nfnl, &batch[msgcnt], family, "prerouting");
+ r = sd_nfnl_message_new_dnat_rule_pre(nfnl, &messages[msgcnt++], family, "prerouting");
if (r < 0)
- goto out_unref;
+ return r;
- msgcnt++;
- assert(msgcnt < NFT_INIT_MSGS);
- r = sd_nfnl_message_new_dnat_rule_out(nfnl, &batch[msgcnt], family, "output");
+ r = sd_nfnl_message_new_dnat_rule_out(nfnl, &messages[msgcnt++], family, "output");
if (r < 0)
- goto out_unref;
+ return r;
- msgcnt++;
- r = sd_nfnl_message_new_masq_rule(nfnl, &batch[msgcnt], family, "postrouting");
+ r = sd_nfnl_message_new_masq_rule(nfnl, &messages[msgcnt++], family, "postrouting");
if (r < 0)
- goto out_unref;
+ return r;
- msgcnt++;
- assert(msgcnt < NFT_INIT_MSGS);
- r = sd_nfnl_message_batch_end(nfnl, &batch[msgcnt]);
+ r = sd_nfnl_message_batch_end(nfnl, &messages[msgcnt++]);
if (r < 0)
- goto out_unref;
-
- msgcnt++;
- assert(msgcnt <= NFT_INIT_MSGS);
- r = nfnl_netlink_sendv(nfnl, batch, msgcnt);
- if (r == -EEXIST)
- r = 0;
+ return r;
-out_unref:
- for (i = 0; i < msgcnt; i++)
- sd_netlink_message_unref(batch[i]);
+ assert(msgcnt < ELEMENTSOF(messages));
+ r = nfnl_netlink_sendv(nfnl, messages, msgcnt);
+ if (r < 0 && r != -EEXIST)
+ return r;
- return r;
+ return 0;
}
int fw_nftables_init(FirewallContext *ctx) {
_cleanup_(sd_netlink_unrefp) sd_netlink *nfnl = NULL;
int r;
+ assert(ctx);
+ assert(!ctx->nfnl);
+
r = sd_nfnl_socket_open(&nfnl);
if (r < 0)
return r;
}
void fw_nftables_exit(FirewallContext *ctx) {
+ assert(ctx);
+
ctx->nfnl = sd_netlink_unref(ctx->nfnl);
}
-static int nft_message_add_setelem_iprange(sd_netlink_message *m,
- const union in_addr_union *source,
- unsigned int prefixlen) {
+static int nft_message_add_setelem_iprange(
+ sd_netlink_message *m,
+ const union in_addr_union *source,
+ unsigned int prefixlen) {
+
uint32_t mask, start, end;
unsigned int nplen;
int r;
+ assert(m);
+ assert(source);
assert(prefixlen <= 32);
+
nplen = 32 - prefixlen;
mask = (1U << nplen) - 1U;
if (r < 0)
return r;
- r = sd_nfnl_nft_message_add_setelem_end(m);
- if (r < 0)
- return r;
-
- return 0;
+ return sd_nfnl_nft_message_add_setelem_end(m);
}
static int nft_message_add_setelem_ip6range(
union in_addr_union start, end;
int r;
+ assert(m);
+ assert(source);
+
r = in_addr_prefix_range(AF_INET6, source, prefixlen, &start, &end);
if (r < 0)
return r;
return sd_nfnl_nft_message_add_setelem_end(m);
}
-#define NFT_MASQ_MSGS 3
-
static int fw_nftables_add_masquerade_internal(
- FirewallContext *ctx,
+ sd_netlink *nfnl,
bool add,
int af,
const union in_addr_union *source,
unsigned int source_prefixlen) {
- sd_netlink_message *transaction[NFT_MASQ_MSGS] = {};
- size_t tsize;
+ sd_netlink_message *messages[4] = {};
+ _unused_ _cleanup_(netlink_message_unref_manyp) sd_netlink_message **unref = messages;
+ size_t msgcnt = 0;
int r;
+ assert(nfnl);
+ assert(IN_SET(af, AF_INET, AF_INET6));
+
if (!source || source_prefixlen == 0)
return -EINVAL;
if (af == AF_INET6 && source_prefixlen < 8)
return -EINVAL;
- r = sd_nfnl_message_batch_begin(ctx->nfnl, &transaction[0]);
+ r = sd_nfnl_message_batch_begin(nfnl, &messages[msgcnt++]);
if (r < 0)
return r;
- tsize = 1;
+
if (add)
- r = sd_nfnl_nft_message_new_setelems_begin(ctx->nfnl, &transaction[tsize], af, NFT_SYSTEMD_TABLE_NAME, NFT_SYSTEMD_MASQ_SET_NAME);
+ r = sd_nfnl_nft_message_new_setelems_begin(nfnl, &messages[msgcnt++], af, NFT_SYSTEMD_TABLE_NAME, NFT_SYSTEMD_MASQ_SET_NAME);
else
- r = sd_nfnl_nft_message_del_setelems_begin(ctx->nfnl, &transaction[tsize], af, NFT_SYSTEMD_TABLE_NAME, NFT_SYSTEMD_MASQ_SET_NAME);
+ r = sd_nfnl_nft_message_del_setelems_begin(nfnl, &messages[msgcnt++], af, NFT_SYSTEMD_TABLE_NAME, NFT_SYSTEMD_MASQ_SET_NAME);
if (r < 0)
- goto out_unref;
+ return r;
if (af == AF_INET)
- r = nft_message_add_setelem_iprange(transaction[tsize], source, source_prefixlen);
+ r = nft_message_add_setelem_iprange(messages[msgcnt-1], source, source_prefixlen);
else
- r = nft_message_add_setelem_ip6range(transaction[tsize], source, source_prefixlen);
+ r = nft_message_add_setelem_ip6range(messages[msgcnt-1], source, source_prefixlen);
if (r < 0)
- goto out_unref;
+ return r;
- ++tsize;
- assert(tsize < NFT_MASQ_MSGS);
- r = sd_nfnl_message_batch_end(ctx->nfnl, &transaction[tsize]);
+ r = sd_nfnl_message_batch_end(nfnl, &messages[msgcnt++]);
if (r < 0)
return r;
- ++tsize;
- r = nfnl_netlink_sendv(ctx->nfnl, transaction, tsize);
+ assert(msgcnt < ELEMENTSOF(messages));
+ r = nfnl_netlink_sendv(nfnl, messages, msgcnt);
+ if (r < 0)
+ return r;
-out_unref:
- while (tsize > 0)
- sd_netlink_message_unref(transaction[--tsize]);
- return r < 0 ? r : 0;
+ return 0;
}
int fw_nftables_add_masquerade(
int r;
+ assert(ctx);
+ assert(ctx->nfnl);
+ assert(IN_SET(af, AF_INET, AF_INET6));
+
if (!socket_ipv6_is_supported() && af == AF_INET6)
return -EOPNOTSUPP;
- r = fw_nftables_add_masquerade_internal(ctx, add, af, source, source_prefixlen);
+ r = fw_nftables_add_masquerade_internal(ctx->nfnl, add, af, source, source_prefixlen);
if (r != -ENOENT)
return r;
if (r < 0)
return r;
- return fw_nftables_add_masquerade_internal(ctx, add, af, source, source_prefixlen);
+ return fw_nftables_add_masquerade_internal(ctx->nfnl, add, af, source, source_prefixlen);
}
-#define NFT_DNAT_MSGS 4
-
static int fw_nftables_add_local_dnat_internal(
- FirewallContext *ctx,
+ sd_netlink *nfnl,
bool add,
int af,
int protocol,
uint16_t remote_port,
const union in_addr_union *previous_remote) {
- sd_netlink_message *transaction[NFT_DNAT_MSGS] = {};
+ sd_netlink_message *messages[5] = {};
+ _unused_ _cleanup_(netlink_message_unref_manyp) sd_netlink_message **unref = messages;
static bool ipv6_supported = true;
uint32_t data[5], key[2], dlen;
- size_t tsize;
+ size_t msgcnt = 0;
int r;
+ assert(nfnl);
assert(add || !previous_remote);
+ assert(IN_SET(af, AF_INET, AF_INET6));
if (!ipv6_supported && af == AF_INET6)
return -EOPNOTSUPP;
data[4] = htobe16(remote_port);
}
- r = sd_nfnl_message_batch_begin(ctx->nfnl, &transaction[0]);
+ r = sd_nfnl_message_batch_begin(nfnl, &messages[msgcnt++]);
if (r < 0)
return r;
- tsize = 1;
/* If a previous remote is set, remove its entry */
if (add && previous_remote && !in_addr_equal(af, previous_remote, remote)) {
if (af == AF_INET)
else
memcpy(data, &previous_remote->in6, sizeof(previous_remote->in6));
- r = nft_del_element(ctx->nfnl, &transaction[tsize], af, NFT_SYSTEMD_DNAT_MAP_NAME, key, sizeof(key), data, dlen);
+ r = nft_del_element(nfnl, &messages[msgcnt++], af, NFT_SYSTEMD_DNAT_MAP_NAME, key, sizeof(key), data, dlen);
if (r < 0)
- goto out_unref;
-
- tsize++;
+ return r;
}
if (af == AF_INET)
else
memcpy(data, &remote->in6, sizeof(remote->in6));
- assert(tsize < NFT_DNAT_MSGS);
if (add)
- r = nft_add_element(ctx->nfnl, &transaction[tsize], af, NFT_SYSTEMD_DNAT_MAP_NAME, key, sizeof(key), data, dlen);
+ r = nft_add_element(nfnl, &messages[msgcnt++], af, NFT_SYSTEMD_DNAT_MAP_NAME, key, sizeof(key), data, dlen);
else
- r = nft_del_element(ctx->nfnl, &transaction[tsize], af, NFT_SYSTEMD_DNAT_MAP_NAME, key, sizeof(key), data, dlen);
+ r = nft_del_element(nfnl, &messages[msgcnt++], af, NFT_SYSTEMD_DNAT_MAP_NAME, key, sizeof(key), data, dlen);
if (r < 0)
- goto out_unref;
-
- tsize++;
- assert(tsize < NFT_DNAT_MSGS);
+ return r;
- r = sd_nfnl_message_batch_end(ctx->nfnl, &transaction[tsize]);
+ r = sd_nfnl_message_batch_end(nfnl, &messages[msgcnt++]);
if (r < 0)
- goto out_unref;
-
- tsize++;
- assert(tsize <= NFT_DNAT_MSGS);
+ return r;
- r = nfnl_netlink_sendv(ctx->nfnl, transaction, tsize);
+ assert(msgcnt < ELEMENTSOF(messages));
+ r = nfnl_netlink_sendv(nfnl, messages, msgcnt);
if (r == -EOVERFLOW && af == AF_INET6) {
/* The current implementation of DNAT in systemd requires kernel's
* fdb9c405e35bdc6e305b9b4e20ebc141ed14fc81 (v5.8), and the older kernel returns
* -EOVERFLOW. Let's treat the error as -EOPNOTSUPP. */
log_debug_errno(r, "The current implementation of IPv6 DNAT in systemd requires kernel 5.8 or newer, ignoring: %m");
ipv6_supported = false;
- r = -EOPNOTSUPP;
+ return -EOPNOTSUPP;
}
+ if (r < 0)
+ return r;
-out_unref:
- while (tsize > 0)
- sd_netlink_message_unref(transaction[--tsize]);
-
- return r < 0 ? r : 0;
+ return 0;
}
int fw_nftables_add_local_dnat(
int r;
+ assert(ctx);
+ assert(ctx->nfnl);
+ assert(IN_SET(af, AF_INET, AF_INET6));
+
if (!socket_ipv6_is_supported() && af == AF_INET6)
return -EOPNOTSUPP;
- r = fw_nftables_add_local_dnat_internal(ctx, add, af, protocol, local_port, remote, remote_port, previous_remote);
+ r = fw_nftables_add_local_dnat_internal(ctx->nfnl, add, af, protocol, local_port, remote, remote_port, previous_remote);
if (r != -ENOENT)
return r;
return r;
/* table created anew; previous address already gone */
- return fw_nftables_add_local_dnat_internal(ctx, add, af, protocol, local_port, remote, remote_port, NULL);
+ return fw_nftables_add_local_dnat_internal(ctx->nfnl, add, af, protocol, local_port, remote, remote_port, NULL);
}
projects / thirdparty / systemd.git / commitdiff
