示例#1
0
static int build_rule_snat(int index, const char *address,
				struct nftnl_rule **res)
{
	struct nftnl_rule *rule;
	struct nftnl_expr *expr;
	uint32_t snat;
	int err;

	/*
	 * # nft --debug netlink add rule connman nat-postrouting \
	 *	oif eth0 snat 1.2.3.4
	 *	ip connman nat-postrouting
	 *	  [ meta load oif => reg 1 ]
	 *	  [ cmp eq reg 1 0x0000000b ]
	 *	  [ immediate reg 1 0x04030201 ]
	 *	  [ nat snat ip addr_min reg 1 addr_max reg 0 ]
	 */

	rule = nftnl_rule_alloc();
	if (!rule)
		return -ENOMEM;

	nftnl_rule_set(rule, NFTNL_RULE_TABLE, CONNMAN_TABLE);
	nftnl_rule_set(rule, NFTNL_RULE_CHAIN, CONNMAN_CHAIN_NAT_POST);

	/* OIF */
	expr = nftnl_expr_alloc("meta");
	if (!expr)
		goto err;
	nftnl_expr_set_u32(expr, NFTNL_EXPR_META_KEY, NFT_META_OIF);
	nftnl_expr_set_u32(expr, NFTNL_EXPR_META_DREG, NFT_REG_1);
	nftnl_rule_add_expr(rule, expr);
	err = add_cmp(rule, NFT_REG_1, NFT_CMP_EQ, &index, sizeof(index));
	if (err < 0)
		goto err;

	/* snat */
	expr = nftnl_expr_alloc("immediate");
	if (!expr)
		goto err;
	snat = inet_addr(address);
	nftnl_expr_set_u32(expr, NFTNL_EXPR_IMM_DREG, NFT_REG_1);
	nftnl_expr_set(expr, NFTNL_EXPR_IMM_DATA, &snat, sizeof(snat));
	nftnl_rule_add_expr(rule, expr);

	expr = nftnl_expr_alloc("nat");
        if (!expr)
		goto err;
	nftnl_expr_set_u32(expr, NFTNL_EXPR_NAT_TYPE, NFT_NAT_SNAT);
	nftnl_expr_set_u32(expr, NFTNL_EXPR_NAT_FAMILY, NFPROTO_IPV4);
	nftnl_expr_set_u32(expr, NFTNL_EXPR_NAT_REG_ADDR_MIN, NFT_REG_1);
        nftnl_rule_add_expr(rule, expr);

	*res = rule;
	return 0;

err:
	nftnl_rule_free(rule);
	return -ENOMEM;
}
示例#2
0
static int build_rule_src_ip(const char *src_ip, uint32_t mark, struct nftnl_rule **res)
{
	struct nftnl_rule *rule;
	struct nftnl_expr *expr;
	int err;
	in_addr_t s_addr;

	/*
	 * # nft --debug netlink add rule connman route-output \
	 *	ip saddr 192.168.10.31 mark set 1234
	 *
	 *	ip connman route-output
	 *	  [ payload load 4b @ network header + 12 => reg 1 ]
	 *	  [ cmp eq reg 1 0x1f0aa8c0 ]
	 *	  [ immediate reg 1 0x000004d2 ]
	 *	  [ meta set mark with reg 1 ]
	 */

	rule = nftnl_rule_alloc();
	if (!rule)
		return -ENOMEM;

	nftnl_rule_set(rule, NFTNL_RULE_TABLE, CONNMAN_TABLE);
	nftnl_rule_set(rule, NFTNL_RULE_CHAIN, CONNMAN_CHAIN_ROUTE_OUTPUT);

	/* family ipv4 */
	nftnl_rule_set_u32(rule, NFTNL_RULE_FAMILY, NFPROTO_IPV4);

	/* source IP */
	err = add_payload(rule, NFT_PAYLOAD_NETWORK_HEADER, NFT_REG_1,
			offsetof(struct iphdr, saddr), sizeof(struct in_addr));
	if (err < 0)
		goto err;

	s_addr = inet_addr(src_ip);
	err = add_cmp(rule, NFT_REG_1, NFT_CMP_EQ, &s_addr, sizeof(s_addr));
	if (err < 0)
		goto err;

	expr = nftnl_expr_alloc("immediate");
	if (!expr)
		goto err;
	nftnl_expr_set_u32(expr, NFTNL_EXPR_IMM_DREG, NFT_REG_1);
	nftnl_expr_set(expr, NFTNL_EXPR_IMM_DATA, &mark, sizeof(mark));
	nftnl_rule_add_expr(rule, expr);

	expr = nftnl_expr_alloc("meta");
	if (!expr)
		goto err;
	nftnl_expr_set_u32(expr, NFTNL_EXPR_META_KEY, NFT_META_MARK);
	nftnl_expr_set_u32(expr, NFTNL_EXPR_META_SREG, NFT_REG_1);
	nftnl_rule_add_expr(rule, expr);

	*res = rule;
	return 0;

err:
	return -ENOMEM;
}
示例#3
0
static int build_rule_marking(uid_t uid, uint32_t mark, struct nftnl_rule **res)
{
	struct nftnl_rule *rule;
	struct nftnl_expr *expr;
	int err;

	/*
	 * http://wiki.nftables.org/wiki-nftables/index.php/Setting_packet_metainformation
	 * http://wiki.nftables.org/wiki-nftables/index.php/Matching_packet_metainformation
	 *
	 * # nft --debug netlink add rule connman route-output	\
	 *	meta skuid wagi mark set 1234
	 *
	 *	ip connman route-output
	 *	  [ meta load skuid => reg 1 ]
	 *	  [ cmp eq reg 1 0x000003e8 ]
	 *	  [ immediate reg 1 0x000004d2 ]
	 *	  [ meta set mark with reg 1 ]
	 */

	rule = nftnl_rule_alloc();
	if (!rule)
		return -ENOMEM;

	nftnl_rule_set(rule, NFTNL_RULE_TABLE, CONNMAN_TABLE);
	nftnl_rule_set(rule, NFTNL_RULE_CHAIN, CONNMAN_CHAIN_ROUTE_OUTPUT);

	expr = nftnl_expr_alloc("meta");
	if (!expr)
		goto err;
	nftnl_expr_set_u32(expr, NFTNL_EXPR_META_KEY, NFT_META_SKUID);
	nftnl_expr_set_u32(expr, NFTNL_EXPR_META_DREG, NFT_REG_1);
	nftnl_rule_add_expr(rule, expr);
	err = add_cmp(rule, NFT_REG_1, NFT_CMP_EQ, &uid, sizeof(uid));
	if (err < 0)
		goto err;

	expr = nftnl_expr_alloc("immediate");
	if (!expr)
		goto err;
	nftnl_expr_set_u32(expr, NFTNL_EXPR_IMM_DREG, NFT_REG_1);
	nftnl_expr_set(expr, NFTNL_EXPR_IMM_DATA, &mark, sizeof(mark));
	nftnl_rule_add_expr(rule, expr);

	expr = nftnl_expr_alloc("meta");
	if (!expr)
		goto err;
	nftnl_expr_set_u32(expr, NFTNL_EXPR_META_KEY, NFT_META_MARK);
	nftnl_expr_set_u32(expr, NFTNL_EXPR_META_SREG, NFT_REG_1);
	nftnl_rule_add_expr(rule, expr);

	*res = rule;
	return 0;

err:
	return -ENOMEM;
}
int main(int argc, char *argv[])
{
	struct nftnl_rule *a, *b;
	struct nftnl_expr *ex;
	struct nlmsghdr *nlh;
	char buf[4096];
	struct nftnl_expr_iter *iter_a, *iter_b;
	struct nftnl_expr *rule_a, *rule_b;
	uint32_t chain_t = 0x12345678;
	uint32_t data_t = 0x12345678;

	a = nftnl_rule_alloc();
	b = nftnl_rule_alloc();
	if (a == NULL || b == NULL)
		print_err("OOM");
	ex = nftnl_expr_alloc("immediate");
	if (ex == NULL)
		print_err("OOM");

	nftnl_expr_set_u32(ex, NFTNL_EXPR_IMM_DREG, 0x1234568);
	nftnl_expr_set(ex, NFTNL_EXPR_IMM_DATA, &chain_t, sizeof(chain_t));
	nftnl_expr_set_u32(ex, NFTNL_EXPR_IMM_VERDICT, 0x12345678);
	nftnl_expr_set(ex, NFTNL_EXPR_IMM_CHAIN, &data_t, sizeof(data_t));

	nftnl_rule_add_expr(a, ex);

	nlh = nftnl_rule_nlmsg_build_hdr(buf, NFT_MSG_NEWRULE, AF_INET, 0, 1234);
	nftnl_rule_nlmsg_build_payload(nlh, a);

	if (nftnl_rule_nlmsg_parse(nlh, b) < 0)
		print_err("parsing problems");

	iter_a = nftnl_expr_iter_create(a);
	iter_b = nftnl_expr_iter_create(b);
	if (iter_a == NULL || iter_b == NULL)
		print_err("OOM");

	rule_a = nftnl_expr_iter_next(iter_a);
	rule_b = nftnl_expr_iter_next(iter_b);
	if (rule_a == NULL || rule_b == NULL)
		print_err("OOM");

	cmp_nftnl_expr(rule_a, rule_b);

	if (nftnl_expr_iter_next(iter_a) != NULL ||
	    nftnl_expr_iter_next(iter_b) != NULL)
		print_err("More 1 expr.");

	nftnl_expr_iter_destroy(iter_a);
	nftnl_expr_iter_destroy(iter_b);
	nftnl_rule_free(a);
	nftnl_rule_free(b);

	if (!test_ok)
		exit(EXIT_FAILURE);

	printf("%s: \033[32mOK\e[0m\n", argv[0]);
	return EXIT_SUCCESS;
}
int main(int argc, char *argv[])
{
	struct nftnl_rule *a, *b;
	struct nftnl_expr *ex;
	struct nlmsghdr *nlh;
	char buf[4096];
	struct nftnl_expr_iter *iter_a, *iter_b;
	struct nftnl_expr *rule_a, *rule_b;

	a = nftnl_rule_alloc();
	b = nftnl_rule_alloc();
	if (a == NULL || b == NULL)
		print_err("OOM");
	ex = nftnl_expr_alloc("byteorder");
	if (ex == NULL)
		print_err("OOM");

	nftnl_expr_set_u32(ex, NFTNL_EXPR_BYTEORDER_SREG, 0x12345678);
	nftnl_expr_set_u32(ex, NFTNL_EXPR_BYTEORDER_DREG, 0x12345678);
	nftnl_expr_set_u32(ex, NFTNL_EXPR_BYTEORDER_OP, 0x12345678);
	nftnl_expr_set_u32(ex, NFTNL_EXPR_BYTEORDER_LEN, 0x12345678);
	nftnl_expr_set_u32(ex, NFTNL_EXPR_BYTEORDER_SIZE, 0x12345678);

	nftnl_rule_add_expr(a, ex);

	nlh = nftnl_rule_nlmsg_build_hdr(buf, NFT_MSG_NEWRULE, AF_INET, 0, 1234);
	nftnl_rule_nlmsg_build_payload(nlh, a);

	if (nftnl_rule_nlmsg_parse(nlh, b) < 0)
		print_err("parsing problems");

	iter_a = nftnl_expr_iter_create(a);
	iter_b = nftnl_expr_iter_create(b);
	if (iter_a == NULL || iter_b == NULL)
		print_err("OOM");

	rule_a = nftnl_expr_iter_next(iter_a);
	rule_b = nftnl_expr_iter_next(iter_b);
	if (rule_a == NULL || rule_b == NULL)
		print_err("OOM");

	cmp_nftnl_expr(rule_a,rule_b);

	if (nftnl_expr_iter_next(iter_a) != NULL ||
	    nftnl_expr_iter_next(iter_b) != NULL)
		print_err("More 1 expr.");

	nftnl_expr_iter_destroy(iter_a);
	nftnl_expr_iter_destroy(iter_b);
	nftnl_rule_free(a);
	nftnl_rule_free(b);

	if (!test_ok)
		exit(EXIT_FAILURE);

	printf("%s: \033[32mOK\e[0m\n", argv[0]);
	return EXIT_SUCCESS;
}
示例#6
0
static void add_counter(struct nftnl_rule *r)
{
	struct nftnl_expr *e;

	e = nftnl_expr_alloc("counter");
	if (e == NULL) {
		perror("expr counter oom");
		exit(EXIT_FAILURE);
	}

	nftnl_rule_add_expr(r, e);
}
示例#7
0
void add_meta(struct nftnl_rule *r, uint32_t key)
{
	struct nftnl_expr *expr;

	expr = nftnl_expr_alloc("meta");
	if (expr == NULL)
		return;

	nftnl_expr_set_u32(expr, NFTNL_EXPR_META_KEY, key);
	nftnl_expr_set_u32(expr, NFTNL_EXPR_META_DREG, NFT_REG_1);

	nftnl_rule_add_expr(r, expr);
}
示例#8
0
void add_cmp_ptr(struct nftnl_rule *r, uint32_t op, void *data, size_t len)
{
	struct nftnl_expr *expr;

	expr = nftnl_expr_alloc("cmp");
	if (expr == NULL)
		return;

	nftnl_expr_set_u32(expr, NFTNL_EXPR_CMP_SREG, NFT_REG_1);
	nftnl_expr_set_u32(expr, NFTNL_EXPR_CMP_OP, op);
	nftnl_expr_set(expr, NFTNL_EXPR_CMP_DATA, data, len);

	nftnl_rule_add_expr(r, expr);
}
示例#9
0
void add_payload(struct nftnl_rule *r, int offset, int len, uint32_t base)
{
	struct nftnl_expr *expr;

	expr = nftnl_expr_alloc("payload");
	if (expr == NULL)
		return;

	nftnl_expr_set_u32(expr, NFTNL_EXPR_PAYLOAD_BASE, base);
	nftnl_expr_set_u32(expr, NFTNL_EXPR_PAYLOAD_DREG, NFT_REG_1);
	nftnl_expr_set_u32(expr, NFTNL_EXPR_PAYLOAD_OFFSET, offset);
	nftnl_expr_set_u32(expr, NFTNL_EXPR_PAYLOAD_LEN, len);

	nftnl_rule_add_expr(r, expr);
}
示例#10
0
文件: mxml.c 项目: pk2010/nft
struct nftnl_expr *nftnl_mxml_expr_parse(mxml_node_t *node,
        struct nftnl_parse_err *err,
        struct nftnl_set_list *set_list)
{
    mxml_node_t *tree;
    struct nftnl_expr *e;
    const char *expr_name;
    char *xml_text;
    uint32_t set_id;
    int ret;

    expr_name = mxmlElementGetAttr(node, "type");
    if (expr_name == NULL) {
        err->node_name = "type";
        err->error = NFTNL_PARSE_EMISSINGNODE;
        goto err;
    }

    e = nftnl_expr_alloc(expr_name);
    if (e == NULL)
        goto err;

    xml_text = mxmlSaveAllocString(node, MXML_NO_CALLBACK);
    if (xml_text == NULL)
        goto err_expr;

    tree = mxmlLoadString(NULL, xml_text, MXML_OPAQUE_CALLBACK);
    xfree(xml_text);

    if (tree == NULL)
        goto err_expr;

    ret = e->ops->xml_parse(e, tree, err);
    mxmlDelete(tree);

    if (set_list != NULL &&
            strcmp(expr_name, "lookup") == 0 &&
            nftnl_set_lookup_id(e, set_list, &set_id))
        nftnl_expr_set_u32(e, NFTNL_EXPR_LOOKUP_SET_ID, set_id);

    return ret < 0 ? NULL : e;
err_expr:
    nftnl_expr_free(e);
err:
    mxmlDelete(tree);
    errno = EINVAL;
    return NULL;
}
示例#11
0
/* bitwise operation is = sreg & mask ^ xor */
void add_bitwise_u16(struct nftnl_rule *r, int mask, int xor)
{
	struct nftnl_expr *expr;

	expr = nftnl_expr_alloc("bitwise");
	if (expr == NULL)
		return;

	nftnl_expr_set_u32(expr, NFTNL_EXPR_BITWISE_SREG, NFT_REG_1);
	nftnl_expr_set_u32(expr, NFTNL_EXPR_BITWISE_DREG, NFT_REG_1);
	nftnl_expr_set_u32(expr, NFTNL_EXPR_BITWISE_LEN, sizeof(uint16_t));
	nftnl_expr_set(expr, NFTNL_EXPR_BITWISE_MASK, &mask, sizeof(uint16_t));
	nftnl_expr_set(expr, NFTNL_EXPR_BITWISE_XOR, &xor, sizeof(uint16_t));

	nftnl_rule_add_expr(r, expr);
}
示例#12
0
static int add_cmp(struct nftnl_rule *rule, uint32_t sreg, uint32_t op,
			const void *data, uint32_t data_len)
{
        struct nftnl_expr *expr;

        expr = nftnl_expr_alloc("cmp");
        if (!expr)
                return -ENOMEM;

        nftnl_expr_set_u32(expr, NFTNL_EXPR_CMP_SREG, sreg);
        nftnl_expr_set_u32(expr, NFTNL_EXPR_CMP_OP, op);
        nftnl_expr_set(expr, NFTNL_EXPR_CMP_DATA, data, data_len);

        nftnl_rule_add_expr(rule, expr);

        return 0;
}
示例#13
0
static void add_cmp(struct nftnl_rule *r, uint32_t sreg, uint32_t op,
		    const void *data, uint32_t data_len)
{
	struct nftnl_expr *e;

	e = nftnl_expr_alloc("cmp");
	if (e == NULL) {
		perror("expr cmp oom");
		exit(EXIT_FAILURE);
	}

	nftnl_expr_set_u32(e, NFTNL_EXPR_CMP_SREG, sreg);
	nftnl_expr_set_u32(e, NFTNL_EXPR_CMP_OP, op);
	nftnl_expr_set(e, NFTNL_EXPR_CMP_DATA, data, data_len);

	nftnl_rule_add_expr(r, e);
}
示例#14
0
static void add_bitwise(struct nftnl_rule *r, uint8_t *mask, size_t len)
{
	struct nftnl_expr *expr;
	uint32_t xor[4] = { 0 };

	expr = nftnl_expr_alloc("bitwise");
	if (expr == NULL)
		return;

	nftnl_expr_set_u32(expr, NFTNL_EXPR_BITWISE_SREG, NFT_REG_1);
	nftnl_expr_set_u32(expr, NFTNL_EXPR_BITWISE_DREG, NFT_REG_1);
	nftnl_expr_set_u32(expr, NFTNL_EXPR_BITWISE_LEN, len);
	nftnl_expr_set(expr, NFTNL_EXPR_BITWISE_MASK, mask, len);
	nftnl_expr_set(expr, NFTNL_EXPR_BITWISE_XOR, &xor, len);

	nftnl_rule_add_expr(r, expr);
}
示例#15
0
static int add_payload(struct nftnl_rule *rule, uint32_t base,
			uint32_t dreg, uint32_t offset, uint32_t len)
{
        struct nftnl_expr *expr;

        expr = nftnl_expr_alloc("payload");
        if (!expr)
                return -ENOMEM;

        nftnl_expr_set_u32(expr, NFTNL_EXPR_PAYLOAD_BASE, base);
        nftnl_expr_set_u32(expr, NFTNL_EXPR_PAYLOAD_DREG, dreg);
        nftnl_expr_set_u32(expr, NFTNL_EXPR_PAYLOAD_OFFSET, offset);
        nftnl_expr_set_u32(expr, NFTNL_EXPR_PAYLOAD_LEN, len);

        nftnl_rule_add_expr(rule, expr);

        return 0;
}
示例#16
0
static void add_payload(struct nftnl_rule *r, uint32_t base, uint32_t dreg,
			uint32_t offset, uint32_t len)
{
	struct nftnl_expr *e;

	e = nftnl_expr_alloc("payload");
	if (e == NULL) {
		perror("expr payload oom");
		exit(EXIT_FAILURE);
	}

	nftnl_expr_set_u32(e, NFTNL_EXPR_PAYLOAD_BASE, base);
	nftnl_expr_set_u32(e, NFTNL_EXPR_PAYLOAD_DREG, dreg);
	nftnl_expr_set_u32(e, NFTNL_EXPR_PAYLOAD_OFFSET, offset);
	nftnl_expr_set_u32(e, NFTNL_EXPR_PAYLOAD_LEN, len);

	nftnl_rule_add_expr(r, e);
}
示例#17
0
static int add_bitwise(struct nftnl_rule *rule, int reg, const void *mask,
			size_t len)
{
        struct nftnl_expr *expr;
        uint8_t *xor;

        expr = nftnl_expr_alloc("bitwise");
        if (!expr)
                return -ENOMEM;

        xor = alloca(len);
	memset(xor, 0, len);

        nftnl_expr_set_u32(expr, NFTNL_EXPR_BITWISE_SREG, reg);
        nftnl_expr_set_u32(expr, NFTNL_EXPR_BITWISE_DREG, reg);
        nftnl_expr_set_u32(expr, NFTNL_EXPR_BITWISE_LEN, len);
        nftnl_expr_set(expr, NFTNL_EXPR_BITWISE_MASK, mask, len);
        nftnl_expr_set(expr, NFTNL_EXPR_BITWISE_XOR, xor, len);

        nftnl_rule_add_expr(rule, expr);

        return 0;
}
示例#18
0
static int build_rule_nat(const char *address, unsigned char prefixlen,
				const char *interface, struct nftnl_rule **res)
{
	struct nftnl_rule *rule;
	struct in_addr ipv4_addr, ipv4_mask;
	struct nftnl_expr *expr;
	int err;

	/*
	 * # nft --debug netlink add rule connman nat-postrouting	\
	 *	oifname eth0 ip saddr 10.10.0.0/24 masquerade
	 *
	 *	ip connman nat-postrouting
	 *	  [ meta load oifname => reg 1 ]
	 *	  [ cmp eq reg 1 0x30687465 0x00000000 0x00000000 0x00000000 ]
	 *	  [ payload load 4b @ network header + 12 => reg 1 ]
	 *	  [ bitwise reg 1 = (reg=1 & 0x00ffffff ) ^ 0x00000000 ]
	 *	  [ cmp eq reg 1 0x00000a0a ]
	 *	  [ masq ]
	 */

	rule = nftnl_rule_alloc();
	if (!rule)
		return -ENOMEM;

	nftnl_rule_set(rule, NFTNL_RULE_TABLE, CONNMAN_TABLE);
	nftnl_rule_set(rule, NFTNL_RULE_CHAIN, CONNMAN_CHAIN_NAT_POST);

	/* family ipv4 */
	nftnl_rule_set_u32(rule, NFTNL_RULE_FAMILY, NFPROTO_IPV4);

	/* oifname */
	expr = nftnl_expr_alloc("meta");
	if (!expr)
		goto err;
	nftnl_expr_set_u32(expr, NFTNL_EXPR_META_KEY, NFT_META_OIFNAME);
	nftnl_expr_set_u32(expr, NFTNL_EXPR_META_DREG, NFT_REG_1);
	nftnl_rule_add_expr(rule, expr);
	err = add_cmp(rule, NFT_REG_1, NFT_CMP_EQ, interface,
			strlen(interface) + 1);
	if (err < 0)
		goto err;

	/* source */
	ipv4_mask.s_addr = htonl((0xffffffff << (32 - prefixlen)) & 0xffffffff);
	ipv4_addr.s_addr = inet_addr(address);
	ipv4_addr.s_addr &= ipv4_mask.s_addr;

	err = add_payload(rule, NFT_PAYLOAD_NETWORK_HEADER, NFT_REG_1,
			offsetof(struct iphdr, saddr), sizeof(struct in_addr));
	if (err < 0)
		goto err;
	err = add_bitwise(rule, NFT_REG_1, &ipv4_mask.s_addr,
				sizeof(struct in_addr));
	if (err < 0)
		goto err;
	err = add_cmp(rule, NFT_REG_1, NFT_CMP_EQ, &ipv4_addr.s_addr,
			sizeof(struct in_addr));
	if (err < 0)
		goto err;

	/* masquerade */
        expr = nftnl_expr_alloc("masq");
        if (!expr)
		goto err;
        nftnl_rule_add_expr(rule, expr);

	*res = rule;
	return 0;

err:
	nftnl_rule_free(rule);
	return -ENOMEM;
}