int main(int argc, char *argv[]) { struct nftnl_rule *a, *b; struct nftnl_expr *ex; struct nlmsghdr *nlh; char buf[4096]; struct nftnl_expr_iter *iter_a, *iter_b; struct nftnl_expr *rule_a, *rule_b; uint32_t chain_t = 0x12345678; uint32_t data_t = 0x12345678; a = nftnl_rule_alloc(); b = nftnl_rule_alloc(); if (a == NULL || b == NULL) print_err("OOM"); ex = nftnl_expr_alloc("immediate"); if (ex == NULL) print_err("OOM"); nftnl_expr_set_u32(ex, NFTNL_EXPR_IMM_DREG, 0x1234568); nftnl_expr_set(ex, NFTNL_EXPR_IMM_DATA, &chain_t, sizeof(chain_t)); nftnl_expr_set_u32(ex, NFTNL_EXPR_IMM_VERDICT, 0x12345678); nftnl_expr_set(ex, NFTNL_EXPR_IMM_CHAIN, &data_t, sizeof(data_t)); nftnl_rule_add_expr(a, ex); nlh = nftnl_rule_nlmsg_build_hdr(buf, NFT_MSG_NEWRULE, AF_INET, 0, 1234); nftnl_rule_nlmsg_build_payload(nlh, a); if (nftnl_rule_nlmsg_parse(nlh, b) < 0) print_err("parsing problems"); iter_a = nftnl_expr_iter_create(a); iter_b = nftnl_expr_iter_create(b); if (iter_a == NULL || iter_b == NULL) print_err("OOM"); rule_a = nftnl_expr_iter_next(iter_a); rule_b = nftnl_expr_iter_next(iter_b); if (rule_a == NULL || rule_b == NULL) print_err("OOM"); cmp_nftnl_expr(rule_a, rule_b); if (nftnl_expr_iter_next(iter_a) != NULL || nftnl_expr_iter_next(iter_b) != NULL) print_err("More 1 expr."); nftnl_expr_iter_destroy(iter_a); nftnl_expr_iter_destroy(iter_b); nftnl_rule_free(a); nftnl_rule_free(b); if (!test_ok) exit(EXIT_FAILURE); printf("%s: \033[32mOK\e[0m\n", argv[0]); return EXIT_SUCCESS; }
int main(int argc, char *argv[]) { struct nftnl_rule *a, *b; struct nftnl_expr *ex; struct nlmsghdr *nlh; char buf[4096]; struct nftnl_expr_iter *iter_a, *iter_b; struct nftnl_expr *rule_a, *rule_b; a = nftnl_rule_alloc(); b = nftnl_rule_alloc(); if (a == NULL || b == NULL) print_err("OOM"); ex = nftnl_expr_alloc("byteorder"); if (ex == NULL) print_err("OOM"); nftnl_expr_set_u32(ex, NFTNL_EXPR_BYTEORDER_SREG, 0x12345678); nftnl_expr_set_u32(ex, NFTNL_EXPR_BYTEORDER_DREG, 0x12345678); nftnl_expr_set_u32(ex, NFTNL_EXPR_BYTEORDER_OP, 0x12345678); nftnl_expr_set_u32(ex, NFTNL_EXPR_BYTEORDER_LEN, 0x12345678); nftnl_expr_set_u32(ex, NFTNL_EXPR_BYTEORDER_SIZE, 0x12345678); nftnl_rule_add_expr(a, ex); nlh = nftnl_rule_nlmsg_build_hdr(buf, NFT_MSG_NEWRULE, AF_INET, 0, 1234); nftnl_rule_nlmsg_build_payload(nlh, a); if (nftnl_rule_nlmsg_parse(nlh, b) < 0) print_err("parsing problems"); iter_a = nftnl_expr_iter_create(a); iter_b = nftnl_expr_iter_create(b); if (iter_a == NULL || iter_b == NULL) print_err("OOM"); rule_a = nftnl_expr_iter_next(iter_a); rule_b = nftnl_expr_iter_next(iter_b); if (rule_a == NULL || rule_b == NULL) print_err("OOM"); cmp_nftnl_expr(rule_a,rule_b); if (nftnl_expr_iter_next(iter_a) != NULL || nftnl_expr_iter_next(iter_b) != NULL) print_err("More 1 expr."); nftnl_expr_iter_destroy(iter_a); nftnl_expr_iter_destroy(iter_b); nftnl_rule_free(a); nftnl_rule_free(b); if (!test_ok) exit(EXIT_FAILURE); printf("%s: \033[32mOK\e[0m\n", argv[0]); return EXIT_SUCCESS; }
static int build_rule_snat(int index, const char *address, struct nftnl_rule **res) { struct nftnl_rule *rule; struct nftnl_expr *expr; uint32_t snat; int err; /* * # nft --debug netlink add rule connman nat-postrouting \ * oif eth0 snat 1.2.3.4 * ip connman nat-postrouting * [ meta load oif => reg 1 ] * [ cmp eq reg 1 0x0000000b ] * [ immediate reg 1 0x04030201 ] * [ nat snat ip addr_min reg 1 addr_max reg 0 ] */ rule = nftnl_rule_alloc(); if (!rule) return -ENOMEM; nftnl_rule_set(rule, NFTNL_RULE_TABLE, CONNMAN_TABLE); nftnl_rule_set(rule, NFTNL_RULE_CHAIN, CONNMAN_CHAIN_NAT_POST); /* OIF */ expr = nftnl_expr_alloc("meta"); if (!expr) goto err; nftnl_expr_set_u32(expr, NFTNL_EXPR_META_KEY, NFT_META_OIF); nftnl_expr_set_u32(expr, NFTNL_EXPR_META_DREG, NFT_REG_1); nftnl_rule_add_expr(rule, expr); err = add_cmp(rule, NFT_REG_1, NFT_CMP_EQ, &index, sizeof(index)); if (err < 0) goto err; /* snat */ expr = nftnl_expr_alloc("immediate"); if (!expr) goto err; snat = inet_addr(address); nftnl_expr_set_u32(expr, NFTNL_EXPR_IMM_DREG, NFT_REG_1); nftnl_expr_set(expr, NFTNL_EXPR_IMM_DATA, &snat, sizeof(snat)); nftnl_rule_add_expr(rule, expr); expr = nftnl_expr_alloc("nat"); if (!expr) goto err; nftnl_expr_set_u32(expr, NFTNL_EXPR_NAT_TYPE, NFT_NAT_SNAT); nftnl_expr_set_u32(expr, NFTNL_EXPR_NAT_FAMILY, NFPROTO_IPV4); nftnl_expr_set_u32(expr, NFTNL_EXPR_NAT_REG_ADDR_MIN, NFT_REG_1); nftnl_rule_add_expr(rule, expr); *res = rule; return 0; err: nftnl_rule_free(rule); return -ENOMEM; }
static int rule_delete(struct firewall_handle *handle) { struct nftnl_rule *rule; struct mnl_socket *nl; int err; DBG(""); rule = nftnl_rule_alloc(); if (!rule) return -ENOMEM; nftnl_rule_set(rule, NFTNL_RULE_TABLE, CONNMAN_TABLE); nftnl_rule_set(rule, NFTNL_RULE_CHAIN, handle->chain); nftnl_rule_set_u64(rule, NFTNL_RULE_HANDLE, handle->handle); err = socket_open_and_bind(&nl); if (err < 0) { nftnl_rule_free(rule); return err; } err = rule_cmd(nl, rule, NFT_MSG_DELRULE, NFPROTO_IPV4, NLM_F_ACK, 0, NULL); nftnl_rule_free(rule); mnl_socket_close(nl); return err; }
static int rule_cb(const struct nlmsghdr *nlh, int event, struct callback_data *cb) { struct nftnl_rule *rule; rule = nftnl_rule_alloc(); if (!rule) return MNL_CB_OK; if (nftnl_rule_nlmsg_parse(nlh, rule) < 0) goto out; switch (cb->type) { case CALLBACK_RETURN_HANDLE: cb->value = nftnl_rule_get_u64(rule, NFTNL_RULE_HANDLE); cb->success = true; break; case CALLBACK_RETURN_BYTE_COUNTER: nftnl_expr_foreach(rule, rule_expr_cb, cb); break; default: DBG("unhandled callback type %d\n", cb->type); break; } out: nftnl_rule_free(rule); return MNL_CB_STOP; }
static int build_rule_src_ip(const char *src_ip, uint32_t mark, struct nftnl_rule **res) { struct nftnl_rule *rule; struct nftnl_expr *expr; int err; in_addr_t s_addr; /* * # nft --debug netlink add rule connman route-output \ * ip saddr 192.168.10.31 mark set 1234 * * ip connman route-output * [ payload load 4b @ network header + 12 => reg 1 ] * [ cmp eq reg 1 0x1f0aa8c0 ] * [ immediate reg 1 0x000004d2 ] * [ meta set mark with reg 1 ] */ rule = nftnl_rule_alloc(); if (!rule) return -ENOMEM; nftnl_rule_set(rule, NFTNL_RULE_TABLE, CONNMAN_TABLE); nftnl_rule_set(rule, NFTNL_RULE_CHAIN, CONNMAN_CHAIN_ROUTE_OUTPUT); /* family ipv4 */ nftnl_rule_set_u32(rule, NFTNL_RULE_FAMILY, NFPROTO_IPV4); /* source IP */ err = add_payload(rule, NFT_PAYLOAD_NETWORK_HEADER, NFT_REG_1, offsetof(struct iphdr, saddr), sizeof(struct in_addr)); if (err < 0) goto err; s_addr = inet_addr(src_ip); err = add_cmp(rule, NFT_REG_1, NFT_CMP_EQ, &s_addr, sizeof(s_addr)); if (err < 0) goto err; expr = nftnl_expr_alloc("immediate"); if (!expr) goto err; nftnl_expr_set_u32(expr, NFTNL_EXPR_IMM_DREG, NFT_REG_1); nftnl_expr_set(expr, NFTNL_EXPR_IMM_DATA, &mark, sizeof(mark)); nftnl_rule_add_expr(rule, expr); expr = nftnl_expr_alloc("meta"); if (!expr) goto err; nftnl_expr_set_u32(expr, NFTNL_EXPR_META_KEY, NFT_META_MARK); nftnl_expr_set_u32(expr, NFTNL_EXPR_META_SREG, NFT_REG_1); nftnl_rule_add_expr(rule, expr); *res = rule; return 0; err: return -ENOMEM; }
static int build_rule_marking(uid_t uid, uint32_t mark, struct nftnl_rule **res) { struct nftnl_rule *rule; struct nftnl_expr *expr; int err; /* * http://wiki.nftables.org/wiki-nftables/index.php/Setting_packet_metainformation * http://wiki.nftables.org/wiki-nftables/index.php/Matching_packet_metainformation * * # nft --debug netlink add rule connman route-output \ * meta skuid wagi mark set 1234 * * ip connman route-output * [ meta load skuid => reg 1 ] * [ cmp eq reg 1 0x000003e8 ] * [ immediate reg 1 0x000004d2 ] * [ meta set mark with reg 1 ] */ rule = nftnl_rule_alloc(); if (!rule) return -ENOMEM; nftnl_rule_set(rule, NFTNL_RULE_TABLE, CONNMAN_TABLE); nftnl_rule_set(rule, NFTNL_RULE_CHAIN, CONNMAN_CHAIN_ROUTE_OUTPUT); expr = nftnl_expr_alloc("meta"); if (!expr) goto err; nftnl_expr_set_u32(expr, NFTNL_EXPR_META_KEY, NFT_META_SKUID); nftnl_expr_set_u32(expr, NFTNL_EXPR_META_DREG, NFT_REG_1); nftnl_rule_add_expr(rule, expr); err = add_cmp(rule, NFT_REG_1, NFT_CMP_EQ, &uid, sizeof(uid)); if (err < 0) goto err; expr = nftnl_expr_alloc("immediate"); if (!expr) goto err; nftnl_expr_set_u32(expr, NFTNL_EXPR_IMM_DREG, NFT_REG_1); nftnl_expr_set(expr, NFTNL_EXPR_IMM_DATA, &mark, sizeof(mark)); nftnl_rule_add_expr(rule, expr); expr = nftnl_expr_alloc("meta"); if (!expr) goto err; nftnl_expr_set_u32(expr, NFTNL_EXPR_META_KEY, NFT_META_MARK); nftnl_expr_set_u32(expr, NFTNL_EXPR_META_SREG, NFT_REG_1); nftnl_rule_add_expr(rule, expr); *res = rule; return 0; err: return -ENOMEM; }
static struct nftnl_rule *setup_rule(uint8_t family, const char *table, const char *chain, const char *handle) { struct nftnl_rule *r = NULL; uint8_t proto; uint16_t dport; uint64_t handle_num; r = nftnl_rule_alloc(); if (r == NULL) { perror("OOM"); exit(EXIT_FAILURE); } nftnl_rule_set(r, NFTNL_RULE_TABLE, table); nftnl_rule_set(r, NFTNL_RULE_CHAIN, chain); nftnl_rule_set_u32(r, NFTNL_RULE_FAMILY, family); if (handle != NULL) { handle_num = atoll(handle); nftnl_rule_set_u64(r, NFTNL_RULE_POSITION, handle_num); } proto = IPPROTO_TCP; add_payload(r, NFT_PAYLOAD_NETWORK_HEADER, NFT_REG_1, offsetof(struct iphdr, protocol), sizeof(uint8_t)); add_cmp(r, NFT_REG_1, NFT_CMP_EQ, &proto, sizeof(uint8_t)); dport = htons(22); add_payload(r, NFT_PAYLOAD_TRANSPORT_HEADER, NFT_REG_1, offsetof(struct tcphdr, dest), sizeof(uint16_t)); add_cmp(r, NFT_REG_1, NFT_CMP_EQ, &dport, sizeof(uint16_t)); add_counter(r); return r; }
static int build_rule_nat(const char *address, unsigned char prefixlen, const char *interface, struct nftnl_rule **res) { struct nftnl_rule *rule; struct in_addr ipv4_addr, ipv4_mask; struct nftnl_expr *expr; int err; /* * # nft --debug netlink add rule connman nat-postrouting \ * oifname eth0 ip saddr 10.10.0.0/24 masquerade * * ip connman nat-postrouting * [ meta load oifname => reg 1 ] * [ cmp eq reg 1 0x30687465 0x00000000 0x00000000 0x00000000 ] * [ payload load 4b @ network header + 12 => reg 1 ] * [ bitwise reg 1 = (reg=1 & 0x00ffffff ) ^ 0x00000000 ] * [ cmp eq reg 1 0x00000a0a ] * [ masq ] */ rule = nftnl_rule_alloc(); if (!rule) return -ENOMEM; nftnl_rule_set(rule, NFTNL_RULE_TABLE, CONNMAN_TABLE); nftnl_rule_set(rule, NFTNL_RULE_CHAIN, CONNMAN_CHAIN_NAT_POST); /* family ipv4 */ nftnl_rule_set_u32(rule, NFTNL_RULE_FAMILY, NFPROTO_IPV4); /* oifname */ expr = nftnl_expr_alloc("meta"); if (!expr) goto err; nftnl_expr_set_u32(expr, NFTNL_EXPR_META_KEY, NFT_META_OIFNAME); nftnl_expr_set_u32(expr, NFTNL_EXPR_META_DREG, NFT_REG_1); nftnl_rule_add_expr(rule, expr); err = add_cmp(rule, NFT_REG_1, NFT_CMP_EQ, interface, strlen(interface) + 1); if (err < 0) goto err; /* source */ ipv4_mask.s_addr = htonl((0xffffffff << (32 - prefixlen)) & 0xffffffff); ipv4_addr.s_addr = inet_addr(address); ipv4_addr.s_addr &= ipv4_mask.s_addr; err = add_payload(rule, NFT_PAYLOAD_NETWORK_HEADER, NFT_REG_1, offsetof(struct iphdr, saddr), sizeof(struct in_addr)); if (err < 0) goto err; err = add_bitwise(rule, NFT_REG_1, &ipv4_mask.s_addr, sizeof(struct in_addr)); if (err < 0) goto err; err = add_cmp(rule, NFT_REG_1, NFT_CMP_EQ, &ipv4_addr.s_addr, sizeof(struct in_addr)); if (err < 0) goto err; /* masquerade */ expr = nftnl_expr_alloc("masq"); if (!expr) goto err; nftnl_rule_add_expr(rule, expr); *res = rule; return 0; err: nftnl_rule_free(rule); return -ENOMEM; }