Skip to contentSkip to conversation

Series to add JSON output support for rules

PATCH New Alvaro Neira 1 participant 3 messages Jun 13, 2013 netfilter

lore
Share & tools
lore

Alvaro Neira

author
#0 lore raw

cover Series to add JSON output support for rules

This is the implementation for exporting the rules to JSON Format and for testing the new functions

---

Álvaro Neira Ayuso (2):
Add function for exporting rule to JSON format
Add code for testing the new functions for exporting rules to JSON Format

 examples/nft-rule-get.c    |    5 ++++
 include/libnftables/rule.h |    1 +
 src/expr/bitwise.c         |   33 ++++++++++++++++++++++++++++++
 src/expr/byteorder.c       |   21 +++++++++++++++++++
 src/expr/cmp.c             |   21 +++++++++++++++++++
 src/expr/counter.c         |    4 ++++
 src/expr/ct.c              |    5 ++++
 src/expr/data_reg.c        |   49 ++++++++++++++++++++++++++++++++++++++++++++
 src/expr/exthdr.c          |    7 ++++++
 src/expr/immediate.c       |   36 ++++++++++++++++++++++++++++++++
 src/expr/limit.c           |    4 ++++
 src/expr/log.c             |    7 ++++++
 src/expr/lookup.c          |   16 ++++++++++++++
 src/expr/match.c           |   25 ++++++++++++++++++++++
 src/expr/meta.c            |    4 ++++
 src/expr/nat.c             |   44 ++++++++++++++++++++++++++++++++++++++++
 src/expr/payload.c         |    6 +++++
 src/expr/target.c          |   26 +++++++++++++++++++++++
 src/internal.h             |    1 +
 src/rule.c                 |   44 ++++++++++++++++++++++++++++++++++++++++
 20 files changed, 358 insertions(+), 1 deletion(-)
Signature · 5 lines
Álvaro Neira Ayuso
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
author
#1 lore raw

PATCH 1/2 Add function for exporting rule to JSON format

From: Álvaro Neira Ayuso <[email protected]>

Signed-off-by Alvaro Neira Ayuso <[email protected]>
---
 include/libnftables/rule.h |    1 +
 src/expr/bitwise.c         |   33 ++++++++++++++++++++++++++++++
 src/expr/byteorder.c       |   21 +++++++++++++++++++
 src/expr/cmp.c             |   21 +++++++++++++++++++
 src/expr/counter.c         |    4 ++++
 src/expr/ct.c              |    5 ++++
 src/expr/data_reg.c        |   49 ++++++++++++++++++++++++++++++++++++++++++++
 src/expr/exthdr.c          |    7 ++++++
 src/expr/immediate.c       |   36 ++++++++++++++++++++++++++++++++
 src/expr/limit.c           |    4 ++++
 src/expr/log.c             |    7 ++++++
 src/expr/lookup.c          |   16 ++++++++++++++
 src/expr/match.c           |   25 ++++++++++++++++++++++
 src/expr/meta.c            |    4 ++++
 src/expr/nat.c             |   44 ++++++++++++++++++++++++++++++++++++++++
 src/expr/payload.c         |    6 +++++
 src/expr/target.c          |   26 +++++++++++++++++++++++
 src/internal.h             |    1 +
 src/rule.c                 |   44 ++++++++++++++++++++++++++++++++++++++++
 19 files changed, 354 insertions(+)
include/libnftables/rule.h +1 -0
index 9989f19..3287c27 100644
@@ -42,6 +42,7 @@ void nft_rule_nlmsg_build_payload(struct nlmsghdr *nlh, struct nft_rule *t);
 enum {
 	NFT_RULE_O_DEFAULT	= 0,
 	NFT_RULE_O_XML,
+	NFT_RULE_O_JSON,
 };
 
 enum nft_rule_parse_type {
src/expr/bitwise.c +33 -0
index 9ebe3dc..eda452d 100644
@@ -306,6 +306,37 @@ nft_rule_expr_bitwise_xml_parse(struct nft_rule_expr *e, char *xml)
 }
 
 static int
+nft_rule_expr_bitwise_snprintf_json(char *buf, size_t size,
+				   struct nft_expr_bitwise *bitwise)
+{
+	int len = size, offset = 0, ret;
+
+	ret = snprintf(buf, len, "\"sreg\" : %u, "
+				"\"dreg\" : %u, ",
+		       bitwise->sreg, bitwise->dreg);
+	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+	ret = snprintf(buf+offset, len, "\"mask\" : ");
+	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+	ret = nft_data_reg_snprintf(buf+offset, len, &bitwise->mask,
+				    NFT_RULE_O_JSON, 0, DATA_VALUE);
+	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+	ret = snprintf(buf+offset, len, ", \"xor\" : ");
+	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+	ret = nft_data_reg_snprintf(buf+offset, len, &bitwise->xor,
+				    NFT_RULE_O_JSON, 0, DATA_VALUE);
+	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+	ret = snprintf(buf+offset, len, "\"");
+	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+	return offset;
+}
+
+static int
 nft_rule_expr_bitwise_snprintf_xml(char *buf, size_t size,
 				   struct nft_expr_bitwise *bitwise)
 {

@@ -370,6 +401,8 @@ nft_rule_expr_bitwise_snprintf(char *buf, size_t size, uint32_t type,
 	struct nft_expr_bitwise *bitwise = (struct nft_expr_bitwise *)e->data;
 
 	switch(type) {
+	case NFT_RULE_O_JSON:
+		return nft_rule_expr_bitwise_snprintf_json(buf, size, bitwise);
 	case NFT_RULE_O_XML:
 		return nft_rule_expr_bitwise_snprintf_xml(buf, size, bitwise);
 	case NFT_RULE_O_DEFAULT:
src/expr/byteorder.c +21 -0
index 9d75824..4e0d9d7 100644
@@ -285,6 +285,24 @@ err:
 }
 
 static int
+nft_rule_expr_byteorder_snprintf_json(char *buf, size_t size,
+				   struct nft_expr_byteorder *byteorder)
+{
+	int len = size, offset = 0, ret;
+
+	ret = snprintf(buf, len, "\"sreg\" : %u, "
+				 "\"dreg\" : %u, "
+				 "\"op\" : %u, "
+				 "\"len\" : %u, "
+				 "\"size\" : %u",
+		       byteorder->sreg, byteorder->dreg, byteorder->op,
+		       byteorder->len, byteorder->size);
+	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+	return offset;
+}
+
+static int
 nft_rule_expr_byteorder_snprintf_xml(char *buf, size_t size,
 				   struct nft_expr_byteorder *byteorder)
 {

@@ -329,6 +347,9 @@ nft_rule_expr_byteorder_snprintf(char *buf, size_t size, uint32_t type,
 	case NFT_RULE_O_XML:
 		return nft_rule_expr_byteorder_snprintf_xml(buf, size,
 							    byteorder);
+	case NFT_RULE_O_JSON:
+		return nft_rule_expr_byteorder_snprintf_json(buf, size,
+							    byteorder);
 	default:
 		break;
 	}
src/expr/cmp.c +21 -0
index 673f3e0..5d3ddeb 100644
@@ -259,6 +259,25 @@ static int nft_rule_expr_cmp_xml_parse(struct nft_rule_expr *e, char *xml)
 }
 
 static int
+nft_rule_expr_cmp_snprintf_json(char *buf, size_t size, struct nft_expr_cmp *cmp)
+{
+	int len = size, offset = 0, ret;
+
+	ret = snprintf(buf, len, "\"sreg\" : %u, \"op\" : \"%s\", \"cmpdata\" : {",
+		       cmp->sreg, expr_cmp_str[cmp->op]);
+	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+	ret = nft_data_reg_snprintf(buf+offset, len, &cmp->data,
+				    NFT_RULE_O_JSON, 0, DATA_VALUE);
+	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+	ret = snprintf(buf+offset, len, "}");
+	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+	return offset;
+}
+
+static int
 nft_rule_expr_cmp_snprintf_xml(char *buf, size_t size, struct nft_expr_cmp *cmp)
 {
 	int len = size, offset = 0, ret;

@@ -300,6 +319,8 @@ nft_rule_expr_cmp_snprintf(char *buf, size_t size, uint32_t type,
 {
 	struct nft_expr_cmp *cmp = (struct nft_expr_cmp *)e->data;
 	switch(type) {
+	case NFT_RULE_O_JSON:
+		return nft_rule_expr_cmp_snprintf_json(buf, size, cmp);
 	case NFT_RULE_O_XML:
 		return nft_rule_expr_cmp_snprintf_xml(buf, size, cmp);
 	case NFT_RULE_O_DEFAULT:
src/expr/counter.c +4 -0
index 129f32e..5e17bd9 100644
@@ -193,6 +193,10 @@ nft_rule_expr_counter_snprintf(char *buf, size_t len, uint32_t type,
 	struct nft_expr_counter *ctr = (struct nft_expr_counter *)e->data;
 
 	switch(type) {
+
+	case NFT_RULE_O_JSON:
+		return snprintf(buf, len, "\"pkts\" : %lu, \"bytes\" : %lu",
+				ctr->pkts, ctr->bytes);
 	case NFT_RULE_O_XML:
 		return snprintf(buf, len, "<pkts>%lu</pkts><bytes>%lu</bytes>",
 				ctr->pkts, ctr->bytes);
src/expr/ct.c +5 -0
index 4042926..d6cde67 100644
@@ -228,6 +228,11 @@ nft_rule_expr_ct_snprintf(char *buf, size_t len, uint32_t type,
 					  "<key>%u</key>"
 					  "<dir>%u</dir>",
 				ct->dreg, ct->key, ct->dir);
+	case NFT_RULE_O_JSON:
+		return snprintf(buf, len, "\"dreg\" : %u, "
+					  "\"key\" : %u, "
+					  "\"dir\" : %u",
+				ct->dreg, ct->key, ct->dir);
 	default:
 		break;
 	}
src/expr/data_reg.c +49 -0

73 lines not on this page · raw message

src/expr/exthdr.c +7 -0
index fb3f7ad..5d564ec 100644
@@ -262,6 +262,13 @@ nft_rule_expr_exthdr_snprintf(char *buf, size_t len, uint32_t type,
 	struct nft_expr_exthdr *exthdr = (struct nft_expr_exthdr *)e->data;
 
 	switch(type) {
+	case NFT_RULE_O_JSON:
+		return snprintf(buf, len, "\"dreg\" : %u, "
+					  "\"type\" : %u, \"offset\" : %u, "
+					  "\"len\" : %u",
+					exthdr->dreg, exthdr->type,
+					exthdr->offset, exthdr->len);
+
 	case NFT_RULE_O_XML:
 		return snprintf(buf, len, "<dreg>%u</dreg>"
 					  "<type>%u</type><offset>%u</offset>"
src/expr/immediate.c +36 -0
index 295054d..6a79476 100644
@@ -295,6 +295,40 @@ nft_rule_expr_immediate_xml_parse(struct nft_rule_expr *e, char *xml)
 }
 
 static int
+nft_rule_expr_immediate_snprintf_json(char *buf, size_t len,
+				     struct nft_rule_expr *e, uint32_t flags)
+{
+	int size = len, offset = 0, ret;
+	struct nft_expr_immediate *imm = (struct nft_expr_immediate *)e->data;
+
+	ret = snprintf(buf, len, "\"dreg\" : %u, "
+				"\"immediatedata\" : {", imm->dreg);
+	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+
+	if (e->flags & (1 << NFT_EXPR_IMM_DATA)) {
+		ret = nft_data_reg_snprintf(buf+offset, len, &imm->data,
+					    NFT_RULE_O_JSON, flags, DATA_VALUE);
+		SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+	} else if (e->flags & (1 << NFT_EXPR_IMM_VERDICT)) {
+		ret = nft_data_reg_snprintf(buf+offset, len, &imm->data,
+					  NFT_RULE_O_JSON, flags, DATA_VERDICT);
+		SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+	} else if (e->flags & (1 << NFT_EXPR_IMM_CHAIN)) {
+		ret = nft_data_reg_snprintf(buf+offset, len, &imm->data,
+					    NFT_RULE_O_JSON, flags, DATA_CHAIN);
+		SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+	}
+
+	ret = snprintf(buf+offset, len, "}");
+	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+	return offset;
+}
+
+static int
 nft_rule_expr_immediate_snprintf_xml(char *buf, size_t len,
 				     struct nft_rule_expr *e, uint32_t flags)
 {

@@ -362,6 +396,8 @@ nft_rule_expr_immediate_snprintf(char *buf, size_t len, uint32_t type,
 				 uint32_t flags, struct nft_rule_expr *e)
 {
 	switch(type) {
+	case NFT_RULE_O_JSON:
+		return nft_rule_expr_immediate_snprintf_json(buf, len, e, flags);
 	case NFT_RULE_O_XML:
 		return nft_rule_expr_immediate_snprintf_xml(buf, len, e, flags);
 	case NFT_RULE_O_DEFAULT:
src/expr/limit.c +4 -0
index 64a5b70..78798d6 100644
@@ -194,6 +194,10 @@ nft_rule_expr_limit_snprintf(char *buf, size_t len, uint32_t type,
 		return snprintf(buf, len, "<rate>%"PRIu64"</rate>"
 					  "<depth>%"PRIu64"</depth>",
 				limit->rate, limit->depth);
+	case NFT_RULE_O_JSON:
+		return snprintf(buf, len, "\"rate\" : %"PRIu64", "
+					  "\"depth\" : %"PRIu64" ",
+				limit->rate, limit->depth);
 	default:
 		break;
 	}
src/expr/log.c +7 -0
index 0e35a65..f7e7558 100644
@@ -262,6 +262,13 @@ nft_rule_expr_log_snprintf(char *buf, size_t len, uint32_t type,
 					  "<qthreshold>%u</qthreshold>",
 				log->prefix, log->group,
 				log->snaplen, log->qthreshold);
+	case NFT_RULE_O_JSON:
+		return snprintf(buf, len, "\"prefix\" : \"%s\", "
+					  "\"group\" : %u, "
+					  "\"snaplen\" : %u, "
+					  "\"qthreshold\" : %u ",
+				log->prefix, log->group,
+				log->snaplen, log->qthreshold);
 	default:
 		break;
 	}
src/expr/lookup.c +16 -0
index 6d2b9a2..ba56b78 100644
@@ -228,6 +228,20 @@ nft_rule_expr_lookup_xml_parse(struct nft_rule_expr *e, char *xml)
 }
 
 static int
+nft_rule_expr_lookup_snprintf_json(char *buf, size_t size,
+				  struct nft_expr_lookup *l)
+{
+	int len = size, offset = 0, ret;
+
+	ret = snprintf(buf, len, "\"set\" : \"%s\", \"sreg\" : %u, \"dreg\" : %u",
+			l->set_name, l->sreg, l->dreg);
+	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+	return offset;
+}
+
+
+static int
 nft_rule_expr_lookup_snprintf_xml(char *buf, size_t size,
 				  struct nft_expr_lookup *l)
 {

@@ -260,6 +274,8 @@ nft_rule_expr_lookup_snprintf(char *buf, size_t size, uint32_t type,
 	struct nft_expr_lookup *lookup = (struct nft_expr_lookup *)e->data;
 
 	switch(type) {
+	case NFT_RULE_O_JSON:
+		return nft_rule_expr_lookup_snprintf_json(buf, size, lookup);
 	case NFT_RULE_O_XML:
 		return nft_rule_expr_lookup_snprintf_xml(buf, size, lookup);
 	case NFT_RULE_O_DEFAULT:
src/expr/match.c +25 -0
index edb78ea..8b98386 100644
@@ -241,6 +241,29 @@ static int nft_rule_expr_match_xml_parse(struct nft_rule_expr *e, char *xml)
 #endif
 }
 
+static int nft_rule_expr_match_snprintf_json(char *buf, size_t len,
+					    struct nft_expr_match *mt)
+{
+	int ret, size=len;
+	int i;
+	int offset = 0;
+	uint8_t *data = (uint8_t *)mt->data;
+
+	ret = snprintf(buf, len, "\"name\" : \"%s\", \"rev\" : %u, \"info\" : 0x",
+				mt->name, mt->rev);
+	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+	for (i=0; i < mt->data_len; i++) {
+	        ret = snprintf(buf+offset, len, "%x", data[i] & 0xff);
+		SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+	}
+
+	ret = snprintf(buf+offset, len, "\"");
+	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+	return offset;
+}
+
 static int nft_rule_expr_match_snprintf_xml(char *buf, size_t len,
 					    struct nft_expr_match *mt)
 {

@@ -272,6 +295,8 @@ nft_rule_expr_match_snprintf(char *buf, size_t len, uint32_t type,
 	struct nft_expr_match *match = (struct nft_expr_match *)e->data;
 
 	switch(type) {
+	case NFT_RULE_O_JSON:
+		return nft_rule_expr_match_snprintf_json(buf, len, match);
 	case NFT_RULE_O_XML:
 		return nft_rule_expr_match_snprintf_xml(buf, len, match);
 	case NFT_RULE_O_DEFAULT:
src/expr/meta.c +4 -0
index 6316a49..df0c2ee 100644
@@ -196,6 +196,10 @@ nft_rule_expr_meta_snprintf(char *buf, size_t len, uint32_t type,
 	struct nft_expr_meta *meta = (struct nft_expr_meta *)e->data;
 
 	switch(type) {
+	case NFT_RULE_O_JSON:
+		return snprintf(buf, len, "\"dreg\" : %u, "
+					  "\"key\" : %u",
+				meta->dreg, meta->key);
 	case NFT_RULE_O_XML:
 		return snprintf(buf, len, "<dreg>%u</dreg>"
 					  "<key>%u</key>",
src/expr/nat.c +44 -0

56 lines not on this page · raw message

src/expr/payload.c +6 -0
index ecb1bce..4f114a6 100644
@@ -257,6 +257,12 @@ nft_rule_expr_payload_snprintf(char *buf, size_t len, uint32_t type,
 	struct nft_expr_payload *payload = (struct nft_expr_payload *)e->data;
 
 	switch(type) {
+	case NFT_RULE_O_JSON:
+		return snprintf(buf, len, "\"dreg\" : %u, "
+					  "\"base\" : %u, \"offset\" : %u, "
+					  "\"len\" : %u ",
+				payload->dreg, payload->base,
+					payload->offset, payload->len);
 	case NFT_RULE_O_XML:
 		return snprintf(buf, len, "<dreg>%u</dreg>"
 					  "<base>%u</base><offset>%u</offset>"
src/expr/target.c +26 -0
index 6652c47..f534cfe 100644
@@ -245,6 +245,30 @@ nft_rule_expr_target_xml_parse(struct nft_rule_expr *e, char *xml)
 }
 
 static
+int nft_rule_exp_target_snprintf_json(char *buf, size_t len,
+				struct nft_expr_target *tg)
+{
+	int ret, size=len;
+	int i;
+	int offset = 0;
+	uint8_t *data = (uint8_t *)tg->data;
+
+	ret = snprintf(buf, len, "\"name\" : \"%s\",\"rev\" : %u,\"info\" : \"0x",
+			tg->name, tg->rev);
+	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+	for (i=0; i < tg->data_len; i++) {
+		ret = snprintf(buf+offset, len, "%x", data[i] & 0xff);
+		SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+	}
+
+	ret = snprintf(buf+offset, len, "\"");
+	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+	return offset;
+}
+
+static
 int nft_rule_exp_target_snprintf_xml(char *buf, size_t len,
 				struct nft_expr_target *tg)
 {

@@ -275,6 +299,8 @@ nft_rule_expr_target_snprintf(char *buf, size_t len, uint32_t type,
 	struct nft_expr_target *target = (struct nft_expr_target *)e->data;
 
 	switch(type) {
+	case NFT_RULE_O_JSON:
+		return nft_rule_exp_target_snprintf_json(buf, len, target);
 	case NFT_RULE_O_XML:
 		return nft_rule_exp_target_snprintf_xml(buf, len, target);
 	case NFT_RULE_O_DEFAULT:
src/internal.h +1 -0
index 769926b..8e2e26d 100644
@@ -22,6 +22,7 @@
 #define NFT_RULE_XML_VERSION 0
 #define NFT_TABLE_JSON_VERSION 0
 #define NFT_CHAIN_JSON_VERSION 0
+#define NFT_RULE_JSON_VERSION 0
 
 struct expr_ops;
src/rule.c +44 -0

56 lines not on this page · raw message

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

author
#2 lore raw

PATCH 2/2 Add code for testing the new functions for exporting rules to JSON Format

In reply to Alvaro Neira

From: Álvaro Neira Ayuso <[email protected]>

Signed-off-by Alvaro Neira Ayuso <[email protected]>
---
 examples/nft-rule-get.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
examples/nft-rule-get.c +4 -1
index 5bf41f5..2404f27 100644
@@ -54,8 +54,11 @@ int main(int argc, char *argv[])
 	struct nft_rule *t = NULL;
 	int ret;
 
-	if (argc == 2 && strcmp(argv[1], "xml") == 0 )
+	if (argc == 2 && strcmp(argv[1], "xml") == 0 ){
 		type = NFT_RULE_O_XML;
+	}else if (argc == 2 && strcmp(argv[1], "json") == 0 ){
+		type = NFT_RULE_O_JSON;
+	}
 
 	/* XXX requires table, chain and handle attributes for selective get */

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html