nft changes for xtables-arptables
cover nft changes for xtables-arptables
The following series implements changes in nft code that permit to reuse some functions in other tool (like xtables-arptables).
I changed nft.h, now struct nft_handle gets a struct builtin_table pointer used in functions to works with a properly tables and not with tables declared in nft.c.
---
Giuseppe Longo (4):
nft: add builtin_table pointer
nft: search builtin tables via nft_handle tables pointer
nft: nft_xtables_config_load() called only in nft_init()
nft: make functions public
iptables/nft.c | 77 ++++++++++++++++++-------------------------------------- iptables/nft.h | 42 +++++++++++++++++++++++++++++++ 2 files changed, 67 insertions(+), 52 deletions(-)
--
PATCH 1/4 nft: add builtin_table pointer
Signed-off-by Giuseppe Longo <[email protected]>
--- iptables/nft.c | 20 ++------------------ iptables/nft.h | 20 ++++++++++++++++++++ 2 files changed, 22 insertions(+), 18 deletions(-)
iptables/nft.c +2 -18
@@ -80,24 +80,7 @@ static int mnl_talk(struct nft_handle *h, struct nlmsghdr *nlh,return 0 ; } -#define FILTER 0 -#define MANGLE 1 -#define RAW 2 -#define SECURITY 3 -#define NAT 4 -#define TABLES_MAX 5 - -struct builtin_chain { -const char *name; -const char *type; -uint32_t prio; -uint32_t hook; -}; - -static struct builtin_table { -const char *name; -struct builtin_chain chains[NF_INET_NUMHOOKS ]; -} tables[TABLES_MAX ] = { +static struct builtin_table tables[TABLES_MAX ] = { [RAW ] = { .name ="raw" , .chains = {
@@ -402,6 +385,7 @@ int nft_init(struct nft_handle *h)return -1 ; } h->portid =mnl_socket_get_portid (h->nl); + h->tables = tables;return 0 ; }
iptables/nft.h +20 -0
@@ -4,6 +4,25 @@#include "xshared.h" #include "nft-shared.h" +#define FILTER 0 +#define MANGLE 1 +#define RAW 2 +#define SECURITY 3 +#define NAT 4 +#define TABLES_MAX 5 + +struct builtin_chain { +const char *name; +const char *type; +uint32_t prio; +uint32_t hook; +}; + +struct builtin_table { +const char *name; +struct builtin_chain chains[NF_INET_NUMHOOKS ]; +}; +struct nft_handle {int family;struct mnl_socket *nl;
@@ -11,6 +30,7 @@ struct nft_handle {uint32_t seq;bool commit;struct nft_family_ops *ops; +struct builtin_table *tables; };int nft_init (struct nft_handle *h);
PATCH 2/4 nft: search builtin tables via nft_handle tables pointer
In reply to Giuseppe LongoSigned-off-by Giuseppe Longo <[email protected]>
--- iptables/nft.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
iptables/nft.c +7 -6
@@ -288,20 +288,21 @@ nft_chain_builtin_add(struct nft_handle *h, struct builtin_table *table, }/* find if built-in table already exists */ -static struct builtin_table *nft_table_builtin_find (const char *table) +static struct builtin_table * +nft_table_builtin_find (struct nft_handle *h,const char *table) {int i;bool found = false;for (i=0 ; i<TABLES_MAX ; i++) { -if (strcmp (tables[i].name, table) !=0 ) +if (strcmp (h->tables[i].name, table) !=0 )continue ; found = true;break ; } -return found ? &tables[i] :NULL ; +return found ? &h->tables[i] :NULL ; }/* find if built-in chain already exists */
@@ -349,7 +350,7 @@ nft_chain_builtin_init(struct nft_handle *h, const char *table,int ret =0 ;struct builtin_table *t; - t =nft_table_builtin_find (table); + t =nft_table_builtin_find (h, table);if (t ==NULL ) { ret =-1 ; goto out;
@@ -424,7 +425,7 @@ int nft_table_set_dormant(struct nft_handle *h, const char *table)int ret =0 , i;struct builtin_table *t; - t =nft_table_builtin_find (table); + t =nft_table_builtin_find (h, table);if (t ==NULL ) { ret =-1 ; goto out;
@@ -485,7 +486,7 @@ __nft_chain_set(struct nft_handle *h, const char *table,struct builtin_chain *_c;int ret; - _t =nft_table_builtin_find (table); + _t =nft_table_builtin_find (h, table);/* if this built-in table does not exists, create it */ if (_t !=NULL )nft_table_builtin_add (h, _t, false);
PATCH 3/4 nft: nft_xtables_config_load() called only in nft_init()
In reply to Giuseppe LongoSigned-off-by Giuseppe Longo <[email protected]>
--- iptables/nft.c | 28 ++++++++-------------------- 1 file changed, 8 insertions(+), 20 deletions(-)
iptables/nft.c +8 -20
@@ -388,6 +388,14 @@ int nft_init(struct nft_handle *h) h->portid =mnl_socket_get_portid (h->nl); h->tables = tables; +/* If built-in chains don't exist for this table, create them */ +if (nft_xtables_config_load (h,XTABLES_CONFIG_DEFAULT ,0 ) <0 ) { +int i; + +for (i=0 ; i<TABLES_MAX ; i++) +if (h->tables[i].name !=NULL ) +nft_chain_builtin_init (h, h->tables[i].name,NULL ,NF_ACCEPT ); + }return 0 ; }
@@ -742,10 +750,6 @@ nft_rule_append(struct nft_handle *h, const char *chain, const char *table,uint16_t flags =NLM_F_ACK |NLM_F_CREATE ;int ret =1 ; -/* If built-in chains don't exist for this table, create them */ -if (nft_xtables_config_load (h,XTABLES_CONFIG_DEFAULT ,0 ) <0 ) -nft_chain_builtin_init (h, table, chain,NF_ACCEPT ); - nft_fn = nft_rule_append; r =nft_rule_new (h, chain, table, cs);
@@ -1316,10 +1320,6 @@ int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *tablstruct nft_chain *c;int ret; -/* If built-in chains don't exist for this table, create them */ -if (nft_xtables_config_load (h,XTABLES_CONFIG_DEFAULT ,0 ) <0 ) -nft_chain_builtin_init (h, table,NULL ,NF_ACCEPT ); - c =nft_chain_alloc ();if (c ==NULL )return 0 ;
@@ -1472,10 +1472,6 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain,uint64_t handle;int ret; -/* If built-in chains don't exist for this table, create them */ -if (nft_xtables_config_load (h,XTABLES_CONFIG_DEFAULT ,0 ) <0 ) -nft_chain_builtin_init (h, table,NULL ,NF_ACCEPT ); -/* Find the old chain to be renamed */ c =nft_chain_find (h, table, chain);if (c ==NULL ) {
@@ -2170,10 +2166,6 @@ int nft_rule_insert(struct nft_handle *h, const char *chain,struct nft_rule *r;uint64_t handle; -/* If built-in chains don't exist for this table, create them */ -if (nft_xtables_config_load (h,XTABLES_CONFIG_DEFAULT ,0 ) <0 ) -nft_chain_builtin_init (h, table, chain,NF_ACCEPT ); - nft_fn = nft_rule_insert; list =nft_rule_list_create (h);
@@ -2521,10 +2513,6 @@ int nft_rule_list(struct nft_handle *h, const char *chain, const char *table,struct nft_chain *c;bool found = false; -/* If built-in chains don't exist for this table, create them */ -if (nft_xtables_config_load (h,XTABLES_CONFIG_DEFAULT ,0 ) <0 ) -nft_chain_builtin_init (h, table,NULL ,NF_ACCEPT ); - list =nft_chain_dump (h); iter =nft_chain_list_iter_create (list);
Re: [xtables-arptables PATCH 3/4] nft: nft_xtables_config_load() called only in nft_init()
Hi Giuseppe,
You haven't tested your patch, have you?
You need to change nft_init() so it takes the family to give to the handle as a parameter. Only then nft_xtables_config_load will work. That said, you will have to move nft_init() into xtables.c and remove it from xtables-standalone.c
and fix xtables-save.c, xtables-restore.c etc... (move the nft_init() part after the command parsing in those, so you can put h.family as family param, for instance) I quickly tried and it works well that way.
About xtables-config.c, you have to add the config filename as a paremet to nft_init() as well. it will be required anyway for arptables too!
Cheers,
Tomasz
Quoted 85 lines
Signed-off-by Giuseppe Longo <[email protected]>--- iptables/nft.c | 28 ++++++++-------------------- 1 file changed, 8 insertions(+), 20 deletions(-)iptables/nft.c +8
-21@@ -388,6 +388,14 @@ int nft_init(struct nft_handle *h) h->portid =mnl_socket_get_portid (h->nl); h->tables = tables; +/* If built-in chains don't exist for this table, create them */ +if (nft_xtables_config_load (h,XTABLES_CONFIG_DEFAULT ,0 ) <0 ) { +int i; + +for (i=0 ; i<TABLES_MAX ; i++) +if (h->tables[i].name !=NULL ) +nft_chain_builtin_init (h, h->tables[i].name,NULL ,NF_ACCEPT ); + }return 0 ; }@@ -742,10 +750,6 @@ nft_rule_append(struct nft_handle *h, const char *chain, const char *table,uint16_t flags =NLM_F_ACK |NLM_F_CREATE ;int ret =1 ; -/* If built-in chains don't exist for this table, create them */ -if (nft_xtables_config_load (h,XTABLES_CONFIG_DEFAULT ,0 ) <0 ) -nft_chain_builtin_init (h, table, chain,NF_ACCEPT ); - nft_fn = nft_rule_append; r =nft_rule_new (h, chain, table, cs);@@ -1316,10 +1320,6 @@ int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *tablstruct nft_chain *c;int ret; -/* If built-in chains don't exist for this table, create them */ -if (nft_xtables_config_load (h,XTABLES_CONFIG_DEFAULT ,0 ) <0 ) -nft_chain_builtin_init (h, table,NULL ,NF_ACCEPT ); - c =nft_chain_alloc ();if (c ==NULL )return 0 ;@@ -1472,10 +1472,6 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain,uint64_t handle;int ret; -/* If built-in chains don't exist for this table, create them */ -if (nft_xtables_config_load (h,XTABLES_CONFIG_DEFAULT ,0 ) <0 ) -nft_chain_builtin_init (h, table,NULL ,NF_ACCEPT ); -/* Find the old chain to be renamed */ c =nft_chain_find (h, table, chain);if (c ==NULL ) {@@ -2170,10 +2166,6 @@ int nft_rule_insert(struct nft_handle *h, const char *chain,struct nft_rule *r;uint64_t handle; -/* If built-in chains don't exist for this table, create them */ -if (nft_xtables_config_load (h,XTABLES_CONFIG_DEFAULT ,0 ) <0 ) -nft_chain_builtin_init (h, table, chain,NF_ACCEPT ); - nft_fn = nft_rule_insert; list =nft_rule_list_create (h);@@ -2521,10 +2513,6 @@ int nft_rule_list(struct nft_handle *h, const char *chain, const char *table,struct nft_chain *c;bool found = false; -/* If built-in chains don't exist for this table, create them */ -if (nft_xtables_config_load (h,XTABLES_CONFIG_DEFAULT ,0 ) <0 ) -nft_chain_builtin_init (h, table,NULL ,NF_ACCEPT ); - list =nft_chain_dump (h); iter =nft_chain_list_iter_create (list); --To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [xtables-arptables PATCH 3/4] nft: nft_xtables_config_load() called only in nft_init()
In reply to Giuseppe LongoHi Giuseppe,
I forgot to mention:
Quoted 1 line
h->tables = tables;
Provide tables as a parameter. Here you always take nft.c one. This won't work for arptables.
iptables/nft.c int nft_init(struct nft_handle *h) · line 394
Quoted 5 lines
iptables/nft.c +4
-0+/* If built-in chains don't exist for this table, create them */ +if (nft_xtables_config_load (h,XTABLES_CONFIG_DEFAULT ,0 ) <0 ) { +int i; +
Then do the for loop if only h->tables != NULL :
Quoted 3 lines
iptables/nft.c +3
-0+for (i=0 ; i<TABLES_MAX ; i++) +if (h->tables[i].name !=NULL ) +nft_chain_builtin_init (h, h->tables[i].name,NULL ,NF_ACCEPT );
PATCH 4/4 nft: make functions public
In reply to Giuseppe LongoSigned-off-by Giuseppe Longo <[email protected]>
--- iptables/nft.c | 18 +++++++++--------- iptables/nft.h | 22 ++++++++++++++++++++++ 2 files changed, 31 insertions(+), 9 deletions(-)
iptables/nft.c +9 -9
@@ -53,9 +53,9 @@static void *nft_fn; -static int mnl_talk (struct nft_handle *h,struct nlmsghdr *nlh, -int (*cb)(const struct nlmsghdr *nlh,void *data), -void *data) +int mnl_talk (struct nft_handle *h,struct nlmsghdr *nlh, +int (*cb)(const struct nlmsghdr *nlh,void *data), +void *data) {int ret;char buf[MNL_SOCKET_BUFFER_SIZE ];
@@ -210,7 +210,7 @@ static struct builtin_table tables[TABLES_MAX] = { }, }; -static int +int nft_table_builtin_add (struct nft_handle *h,struct builtin_table *_t,bool dormant) {
@@ -242,7 +242,7 @@ nft_table_builtin_add(struct nft_handle *h, struct builtin_table *_t,return ret; } -static struct nft_chain * +struct nft_chain *nft_chain_builtin_alloc (struct builtin_table *table,struct builtin_chain *chain,int policy) {
@@ -262,7 +262,7 @@ nft_chain_builtin_alloc(struct builtin_table *table,return c; } -static void +void nft_chain_builtin_add (struct nft_handle *h,struct builtin_table *table,struct builtin_chain *chain,int policy) {
@@ -288,7 +288,7 @@ nft_chain_builtin_add(struct nft_handle *h, struct builtin_table *table, }/* find if built-in table already exists */ -static struct builtin_table * +struct builtin_table *nft_table_builtin_find (struct nft_handle *h,const char *table) {int i;
@@ -306,7 +306,7 @@ nft_table_builtin_find(struct nft_handle *h, const char *table) }/* find if built-in chain already exists */ -static struct builtin_chain * +struct builtin_chain *nft_chain_builtin_find (struct builtin_table *t,const char *chain) {int i;
@@ -343,7 +343,7 @@ __nft_chain_builtin_init(struct nft_handle *h, } } -static int +int nft_chain_builtin_init (struct nft_handle *h,const char *table,const char *chain,int policy) {
iptables/nft.h +22 -0
@@ -33,6 +33,28 @@ struct nft_handle {struct builtin_table *tables; }; +int mnl_talk (struct nft_handle *h,struct nlmsghdr *nlh, +int (*cb)(const struct nlmsghdr *nlh,void *data), +void *data); + +int nft_table_builtin_add (struct nft_handle *h,struct builtin_table *_t, +bool dormant); + +struct nft_chain *nft_chain_builtin_alloc (struct builtin_table *table, +struct builtin_chain *chain,int policy); + +void nft_chain_builtin_add (struct nft_handle *h,struct builtin_table *table, +struct builtin_chain *chain,int policy); + +struct builtin_table *nft_table_builtin_find (struct nft_handle *h, +const char *table); + +struct builtin_chain *nft_chain_builtin_find (struct builtin_table *t, +const char *chain); + +int nft_chain_builtin_init (struct nft_handle *h,const char *table, +const char *chain,int policy); +int nft_init (struct nft_handle *h);void nft_fini (struct nft_handle *h);
Hi Giuseppe,
You need to rework patch 3 so it will fit with your future arptables bootstrap.
Patch 1, 2 and 4 are fine.
Cheers,
Tomasz
Quoted 27 lines
The following series implements changes in nft code that permit to reuse some functions in other tool (like xtables-arptables).
I changed
nft.h, now structnft_handlegets a structbuiltin_tablepointer used in functions to works with a properly tables and not with tables declared innft.c.---
Giuseppe Longo (4):
nft: addbuiltin_tablepointer
nft: search builtin tables vianft_handletables pointer
nft:nft_xtables_config_load()called only innft_init()
nft: make functions publiciptables/nft.c | 77 ++++++++++++++++++-------------------------------------- iptables/nft.h | 42 +++++++++++++++++++++++++++++++ 2 files changed, 67 insertions(+), 52 deletions(-)--
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html