src: expr: missing commas in json output support

PATCH Applied Alvaro Neira 3 participants 17 messages Aug 9, 2013 netfilter

lore

Share & tools

lore

Alvaro Neira

author

2013-08-09 11:12 UTC #0 lore raw

PATCH 1/13 src: expr: missing commas in json output support

From: Álvaro Neira Ayuso <[email protected]>

Added missing commas in json output support

Signed-off-by Alvaro Neira Ayuso <[email protected]>

---
 src/expr/meta.c |    2 +-
 src/expr/nat.c  |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

src/expr/meta.c +1 -1

index ac01732..8f163f6 100644
@@ -208,7 +208,7 @@ nft_rule_expr_meta_snprintf(char *buf, size_t len, uint32_t type,
 				meta->dreg, meta_key2str(meta->key));
 	case NFT_RULE_O_JSON:
 		return snprintf(buf, len, "\"dreg\" : %u, "
-					  "\"key\" : %s",
+					  "\"key\" : \"%s\"",
 				meta->dreg, meta_key2str(meta->key));
 	default:
 		break;

src/expr/nat.c +1 -1

index 4b7ec27..654d4d7 100644
@@ -262,7 +262,7 @@ nft_rule_expr_nat_snprintf_json(char *buf, size_t size,
 	if (nat->type == NFT_NAT_SNAT)
 		ret = snprintf(buf, len, "\"nat_type\" : \"snat\", ");
 	else if (nat->type == NFT_NAT_DNAT)
-		ret = snprintf(buf, len, "\nat_type\" : \"dnat\", ");
+		ret = snprintf(buf, len, "\"nat_type\" : \"dnat\", ");
 
 	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Alvaro Neira

author

2013-08-09 11:12 UTC #1 lore raw

PATCH 2/13 src: expr: missing curly braces in json output support

From: Álvaro Neira Ayuso <[email protected]>

Added missing curly braces in json output support

Signed-off-by Alvaro Neira Ayuso <[email protected]>

---
 src/expr/bitwise.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

src/expr/bitwise.c +3 -3

index f0a2eff..edc5a39 100644
@@ -242,21 +242,21 @@ nft_rule_expr_bitwise_snprintf_json(char *buf, size_t size,
 		       bitwise->sreg, bitwise->dreg);
 	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
 
-	ret = snprintf(buf+offset, len, "\"mask\" : ");
+	ret = snprintf(buf+offset, len, "\"mask\" : {");
 	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
 
 	ret = nft_data_reg_snprintf(buf+offset, len, &bitwise->mask,
 				    NFT_RULE_O_JSON, 0, DATA_VALUE);
 	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
 
-	ret = snprintf(buf+offset, len, ", \"xor\" : ");
+	ret = snprintf(buf+offset, len, "}, \"xor\" : {");
 	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
 
 	ret = nft_data_reg_snprintf(buf+offset, len, &bitwise->xor,
 				    NFT_RULE_O_JSON, 0, DATA_VALUE);
 	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
 
-	ret = snprintf(buf+offset, len, "\"");
+	ret = snprintf(buf+offset, len, "}");
 	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
 
 	return offset;

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Alvaro Neira

author

2013-08-09 11:12 UTC #2 lore raw

PATCH 3/13 src: expr: change wrong value in data_reg

In reply to Alvaro Neira

From: Álvaro Neira Ayuso <[email protected]>

Changed wrong value in data_reg_chain snprintf

Signed-off-by Alvaro Neira Ayuso <[email protected]>

---
 src/expr/data_reg.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

src/expr/data_reg.c +2 -2

index fceec5a..825e474 100644
@@ -359,8 +359,8 @@ int nft_data_reg_snprintf(char *buf, size_t size, union nft_data_reg *reg,
 		case NFT_RULE_O_JSON:
 			return snprintf(buf, size,
 					"\"data_reg\": { \"type\" : \"chain\", "
-						"\"chain\" : %d"
-					"}", reg->verdict);
+						"\"chain\" : \"%s\""
+					"}", reg->chain);
 		default:
 			break;
 		}

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Alvaro Neira

author

2013-08-09 11:12 UTC #3 lore raw

PATCH 4/13 src: fix display of compat_flag and compat_proto

In reply to Alvaro Neira

From: Álvaro Neira Ayuso <[email protected]>

Fixed display compat_proto value and compat_flag if available

Signed-off-by Alvaro Neira Ayuso <[email protected]>

---
 src/rule.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

src/rule.c +3 -2

index 9d6a996..41534bd 100644
@@ -633,9 +633,10 @@ static int nft_rule_snprintf_json(char *buf, size_t size, struct nft_rule *r,
 					r->rule_flags);
 	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
 
-	if(NFT_RULE_ATTR_COMPAT_PROTO != 0 || NFT_RULE_ATTR_COMPAT_FLAGS != 0){
+	if (r->flags & (1 << NFT_RULE_ATTR_COMPAT_PROTO) ||
+	    r->flags & (1 << NFT_RULE_ATTR_COMPAT_FLAGS)) {
 		ret = snprintf(buf+offset,len,"\"compat_flags\" : %u, "
-									  "\"compat_proto\" : %u, ",
+					      "\"compat_proto\" : %u, ",
 					r->compat.flags, r->compat.proto);
 		SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
 	}

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Alvaro Neira

author

2013-08-09 11:12 UTC #4 lore raw

PATCH 5/13 expr: ct: optional output in ct

In reply to Alvaro Neira

From: Álvaro Neira Ayuso <[email protected]>

Display direction and key if available

Signed-off-by Alvaro Neira Ayuso <[email protected]>

---
 src/expr/ct.c |   29 +++++++++++++++++++++++++----
 1 file changed, 25 insertions(+), 4 deletions(-)

src/expr/ct.c +25 -4

index 99448c6..f86fd4d 100644
@@ -226,6 +226,30 @@ err:
 }
 
 static int
+nft_expr_ct_snprintf_json(char *buf, size_t size, struct nft_rule_expr *e)
+{
+	int ret, len = size, offset = 0;
+	struct nft_expr_ct *ct = nft_expr_data(e);
+
+	ret = snprintf(buf, size, "\"dreg\" : %u", ct->dreg);
+	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+	if (e->flags & (1 << NFT_EXPR_CT_KEY)) {
+		ret = snprintf(buf+offset, size, ", \"key\" : \"%s\"",
+						ctkey2str(ct->key));
+		SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+	}
+
+	if (e->flags & (1 << NFT_EXPR_CT_DIR)) {
+		ret = snprintf(buf+offset, size, ", \"dir\" : %u", ct->dir);
+		SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+	}
+
+	return offset;
+
+}
+
+static int
 nft_rule_expr_ct_snprintf(char *buf, size_t len, uint32_t type,
 			    uint32_t flags, struct nft_rule_expr *e)
 {

@@ -241,10 +265,7 @@ nft_rule_expr_ct_snprintf(char *buf, size_t len, uint32_t type,
 					  "<dir>%u</dir>",
 				ct->dreg, ctkey2str(ct->key), ct->dir);
 	case NFT_RULE_O_JSON:
-		return snprintf(buf, len, "\"dreg\" : %u, "
-					  "\"key\" : \"%s\", "
-					  "\"dir\" : %u",
-				ct->dreg, ctkey2str(ct->key), ct->dir);
+		return nft_expr_ct_snprintf_json(buf, len, e);
 	default:
 		break;
 	}

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Alvaro Neira

author

2013-08-09 11:13 UTC #5 lore raw

PATCH 6/13 json: bitwise: add missing node len

In reply to Alvaro Neira

From: Álvaro Neira Ayuso <[email protected]>

I have added the len node in bitwise which was missing

Signed-off-by Alvaro Neira Ayuso <[email protected]>

---
 src/expr/bitwise.c  |    5 +++--
 src/expr/data_reg.c |    4 ++--
 2 files changed, 5 insertions(+), 4 deletions(-)

src/expr/bitwise.c +3 -2

index edc5a39..6c86acb 100644
@@ -238,8 +238,9 @@ nft_rule_expr_bitwise_snprintf_json(char *buf, size_t size,
 	int len = size, offset = 0, ret;
 
 	ret = snprintf(buf, len, "\"sreg\" : %u, "
-				"\"dreg\" : %u, ",
-		       bitwise->sreg, bitwise->dreg);
+				"\"dreg\" : %u, "
+				"\"len\" : %u, ",
+		       bitwise->sreg, bitwise->dreg, bitwise->len);
 	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
 
 	ret = snprintf(buf+offset, len, "\"mask\" : {");

src/expr/data_reg.c +2 -2

index 825e474..4c354ef 100644
@@ -250,10 +250,10 @@ nft_data_reg_value_snprintf_json(char *buf, size_t size,
 			SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
 		}
 
-		ret = snprintf(buf+offset, len, "\"");
+		ret = snprintf(buf+offset, len, "\", ");
 		SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
 	}
-
+	offset -= 2;
 	ret = snprintf(buf+offset, len, "}");
 	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Alvaro Neira

author

2013-08-09 11:13 UTC #6 lore raw

PATCH 7/13 src: json: delete unneeded JSON prefixes

In reply to Alvaro Neira

From: Álvaro Neira Ayuso <[email protected]>

This patch changes some JSON nodes with prefixes like XML nodes

Signed-off-by Alvaro Neira Ayuso <[email protected]>

---
 src/rule.c                    |    2 +-
 src/set_elem.c                |    6 +++---
 src/table.c                   |    4 ++--
 tests/jsonfiles/01-table.json |    2 +-
 tests/jsonfiles/02-table.json |    2 +-
 5 files changed, 8 insertions(+), 8 deletions(-)

src/rule.c +1 -1

index 41534bd..8a86f54 100644
@@ -629,7 +629,7 @@ static int nft_rule_snprintf_json(char *buf, size_t size, struct nft_rule *r,
 				(unsigned long long)r->handle);
 	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
 
-	ret = snprintf(buf+offset, len, "\"rule_flags\" : %u, ",
+	ret = snprintf(buf+offset, len, "\"flags\" : %u, ",
 					r->rule_flags);
 	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);

src/set_elem.c +3 -3

index 73c100f..c3ac1da 100644
@@ -469,10 +469,10 @@ static int nft_set_elem_snprintf_json(char *buf, size_t size,
 {
 	int ret, len = size, offset = 0, type = -1;
 
-	ret = snprintf(buf, size, "\"set_elem_flags\": %u", e->set_elem_flags);
+	ret = snprintf(buf, size, "\"flags\": %u", e->set_elem_flags);
 	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
 
-	ret = snprintf(buf+offset, size, ",\"set_elem_key\": {");
+	ret = snprintf(buf+offset, size, ",\"key\": {");
 	SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
 
 	ret = nft_data_reg_snprintf(buf+offset, len, &e->key,

@@ -490,7 +490,7 @@ static int nft_set_elem_snprintf_json(char *buf, size_t size,
 		type = DATA_VERDICT;
 
 	if (type != -1) {
-		ret = snprintf(buf+offset, size, ",\"set_elem_data\": {");
+		ret = snprintf(buf+offset, size, ",\"data\": {");
 		SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
 
 		ret = nft_data_reg_snprintf(buf+offset, len, &e->data,

src/table.c +2 -2

index 85993eb..18d9077 100644
@@ -295,7 +295,7 @@ static int nft_table_json_parse(struct nft_table *t, char *json)
 
 	nft_table_attr_set_u32(t, NFT_TABLE_ATTR_FAMILY, family);
 
-	if (nft_jansson_value_parse_val(root, "table_flags",
+	if (nft_jansson_value_parse_val(root, "flags",
 					NFT_TYPE_U32, &table_flag) == -1)
 		goto err;

@@ -340,7 +340,7 @@ static int nft_table_snprintf_json(char *buf, size_t size, struct nft_table *t)
 			"{\"table\" : {"
 			"\"name\" : \"%s\","
 			"\"family\" : \"%s\","
-			"\"table_flags\" : %d"
+			"\"flags\" : %d"
 			"}"
 			"}" ,
 			t->name, nft_family2str(t->family), t->table_flags);

tests/jsonfiles/01-table.json +1 -1

index a5ba38b..b4fc91b 100644
@@ -1 +1 @@
-{"table" : {"name" : "filter","family" : "ip","table_flags" : 0}}
+{"table" : {"name" : "filter","family" : "ip","flags" : 0}}

tests/jsonfiles/02-table.json +1 -1

index f1171a1..01eff74 100644
@@ -1 +1 @@
-{"table" : {"name" : "filter2","family" : "ip6","table_flags" : 0}}
+{"table" : {"name" : "filter2","family" : "ip6","flags" : 0}}

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Alvaro Neira

author

2013-08-09 11:13 UTC #7 lore raw

PATCH 8/13 expr: bytecode: add nft_str2ntoh function

In reply to Alvaro Neira

From: Álvaro Neira Ayuso <[email protected]>

Add function that will be use in the JSON parser

Signed-off-by Alvaro Neira Ayuso <[email protected]>

---
 src/expr/byteorder.c |   25 +++++++++++++++++--------
 1 file changed, 17 insertions(+), 8 deletions(-)

src/expr/byteorder.c +17 -8

index 79ba439..c6c4b91 100644
@@ -181,13 +181,25 @@ static char *expr_byteorder_str[] = {
 	[NFT_BYTEORDER_NTOH] = "ntoh",
 };
 
+static inline int nft_str2ntoh(const char *op)
+{
+	if (strcmp(op, "ntoh") == 0)
+		return NFT_BYTEORDER_NTOH;
+	else if (strcmp(op, "hton") == 0)
+		return NFT_BYTEORDER_HTON;
+	else {
+		errno = EINVAL;
+		return -1;
+	}
+}
+
 static int
 nft_rule_expr_byteorder_xml_parse(struct nft_rule_expr *e, mxml_node_t *tree)
 {
 #ifdef XML_PARSING
 	struct nft_expr_byteorder *byteorder = nft_expr_data(e);
 	const char *op;
-	int32_t reg;
+	int32_t reg, ntoh;
 
 	reg = nft_mxml_reg_parse(tree, "sreg", MXML_DESCEND_FIRST);
 	if (reg < 0)

@@ -207,15 +219,12 @@ nft_rule_expr_byteorder_xml_parse(struct nft_rule_expr *e, mxml_node_t *tree)
 	if (op == NULL)
 		return -1;
 
-	if (strcmp(op, "ntoh") == 0)
-		byteorder->op = NFT_BYTEORDER_NTOH;
-	else if (strcmp(op, "hton") == 0)
-		byteorder->op = NFT_BYTEORDER_HTON;
-	else {
-		errno = EINVAL;
+	ntoh = nft_str2ntoh(op);
+
+	if (ntoh < 0)
 		return -1;
-	}
 
+	byteorder->op = ntoh;
 	e->flags |= (1 << NFT_EXPR_BYTEORDER_OP);
 
 	if (nft_mxml_num_parse(tree, "len", MXML_DESCEND_FIRST, BASE_DEC,

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Alvaro Neira

author

2013-08-09 11:13 UTC #8 lore raw

PATCH 9/13 expr: cmp: add nft_str2cmp function

In reply to Alvaro Neira

From: Álvaro Neira Ayuso <[email protected]>

Add function that will be use in the JSON parser

Signed-off-by Alvaro Neira Ayuso <[email protected]>

---
 src/expr/cmp.c |   38 ++++++++++++++++++++++++--------------
 1 file changed, 24 insertions(+), 14 deletions(-)

src/expr/cmp.c +24 ~~-14~~

index 291ebcd..8ca4cb5 100644
@@ -154,12 +154,32 @@ static char *expr_cmp_str[] = {
 	[NFT_CMP_GTE]	= "gte",
 };
 
+static inline int nft_str2cmp(const char *op)
+{
+	if (strcmp(op, "eq") == 0)
+		return NFT_CMP_EQ;
+	else if (strcmp(op, "neq") == 0)
+		return NFT_CMP_NEQ;
+	else if (strcmp(op, "lt") == 0)
+		return NFT_CMP_LT;
+	else if (strcmp(op, "lte") == 0)
+		return NFT_CMP_LTE;
+	else if (strcmp(op, "gt") == 0)
+		return NFT_CMP_GT;
+	else if (strcmp(op, "gte") == 0)
+		return NFT_CMP_GTE;
+	else {
+		errno = EINVAL;
+		return -1;
+	}
+}
+
 static int nft_rule_expr_cmp_xml_parse(struct nft_rule_expr *e, mxml_node_t *tree)
 {
 #ifdef XML_PARSING
 	struct nft_expr_cmp *cmp = nft_expr_data(e);
 	const char *op;
-	int32_t reg;
+	int32_t reg, op_value;
 
 	reg = nft_mxml_reg_parse(tree, "sreg", MXML_DESCEND_FIRST);
 	if (reg < 0)

@@ -172,21 +192,11 @@ static int nft_rule_expr_cmp_xml_parse(struct nft_rule_expr *e, mxml_node_t *tre
 	if (op == NULL)
 		return -1;
 
-	if (strcmp(op, "eq") == 0)
-		cmp->op = NFT_CMP_EQ;
-	else if (strcmp(op, "neq") == 0)
-		cmp->op = NFT_CMP_NEQ;
-	else if (strcmp(op, "lt") == 0)
-		cmp->op = NFT_CMP_LT;
-	else if (strcmp(op, "lte") == 0)
-		cmp->op = NFT_CMP_LTE;
-	else if (strcmp(op, "gt") == 0)
-		cmp->op = NFT_CMP_GT;
-	else if (strcmp(op, "gte") == 0)
-		cmp->op = NFT_CMP_GTE;
-	else
+	op_value = nft_str2cmp(op);
+	if (op_value < 0)
 		return -1;
 
+	cmp->op = op_value;
 	e->flags |= (1 << NFT_EXPR_CMP_OP);
 
 	if (nft_mxml_data_reg_parse(tree, "cmpdata",

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Alvaro Neira

author

2013-08-09 11:14 UTC #9 lore raw

PATCH 10/13 expr: nat: add nft_str2nat function

In reply to Alvaro Neira

From: Álvaro Neira Ayuso <[email protected]>

Add function that will be use in the JSON parser

Signed-off-by Alvaro Neira Ayuso <[email protected]>

---
 src/expr/nat.c |   27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

src/expr/nat.c +17 ~~-10~~

index 654d4d7..c81dc7f 100644
@@ -15,6 +15,7 @@
 #include <stdio.h>
 #include <stdint.h>
 #include <limits.h>
+#include <string.h>
 #include <errno.h>
 #include <arpa/inet.h>
 #include <libmnl/libmnl.h>

@@ -183,6 +184,17 @@ nft_rule_expr_nat_build(struct nlmsghdr *nlh, struct nft_rule_expr *e)
 				 htonl(nat->sreg_proto_max));
 }
 
+static inline int nft_str2nat(const char *nat)
+{
+	if (strcmp(nat, "snat") == 0)
+		return NFT_NAT_SNAT;
+	else if (strcmp(nat, "dnat") == 0)
+		return NFT_NAT_DNAT;
+	else {
+		errno = EINVAL;
+		return -1;
+	}
+}
 
 static int nft_rule_expr_nat_xml_parse(struct nft_rule_expr *e, mxml_node_t *tree)
 {

@@ -190,19 +202,17 @@ static int nft_rule_expr_nat_xml_parse(struct nft_rule_expr *e, mxml_node_t *tre
 	struct nft_expr_nat *nat = nft_expr_data(e);
 	const char *nat_type;
 	int32_t reg;
-	int family;
+	int family, nat_type_value;
 
 	nat_type = nft_mxml_str_parse(tree, "nat_type", MXML_DESCEND_FIRST);
 	if (nat_type == NULL)
 		return -1;
 
-	if (strcmp(nat_type, "snat") == 0) {
-		nat->type = NFT_NAT_SNAT;
-	} else if (strcmp(nat_type, "dnat") == 0) {
-		nat->type = NFT_NAT_DNAT;
-	} else
-		goto err;
+	nat_type_value = nft_str2nat(nat_type);
+	if (nat_type_value < 0)
+		return -1;
 
+	nat->type = nat_type_value;
 	e->flags |= (1 << NFT_EXPR_NAT_TYPE);
 
 	family = nft_mxml_family_parse(tree, "family", MXML_DESCEND_FIRST);

@@ -243,9 +253,6 @@ static int nft_rule_expr_nat_xml_parse(struct nft_rule_expr *e, mxml_node_t *tre
 	e->flags |= (1 << NFT_EXPR_NAT_REG_PROTO_MAX);
 
 	return 0;
-err:
-	errno = EINVAL;
-	return -1;
 #else
 	errno = EOPNOTSUPP;
 	return -1;

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Alvaro Neira

author

2013-08-09 11:14 UTC #10 lore raw

PATCH 11/13 expr: payload: add nft_str2base function

In reply to Alvaro Neira

From: Álvaro Neira Ayuso <[email protected]>

Add function that will be use in the JSON parser

Signed-off-by Alvaro Neira Ayuso <[email protected]>

---
 src/expr/payload.c |   32 ++++++++++++++++++++------------
 1 file changed, 20 insertions(+), 12 deletions(-)

src/expr/payload.c +20 ~~-12~~

index 34aee90..e32ae1b 100644
@@ -13,6 +13,7 @@
 
 #include <stdio.h>
 #include <stdint.h>
+#include <string.h>
 #include <limits.h>
 #include <arpa/inet.h>
 #include <errno.h>

@@ -178,13 +179,27 @@ nft_rule_expr_payload_snprintf_json(char *buf, size_t len, uint32_t flags,
 	return offset;
 }
 
+static inline int nft_str2base(const char *base)
+{
+	if (strcmp(base, "link") == 0)
+		return NFT_PAYLOAD_LL_HEADER;
+	else if (strcmp(base, "network") == 0)
+		return NFT_PAYLOAD_NETWORK_HEADER;
+	else if (strcmp(base, "transport") == 0)
+		return NFT_PAYLOAD_TRANSPORT_HEADER;
+	else {
+		errno = EINVAL;
+		return -1;
+	}
+}
+
 static int
 nft_rule_expr_payload_xml_parse(struct nft_rule_expr *e, mxml_node_t *tree)
 {
 #ifdef XML_PARSING
 	struct nft_expr_payload *payload = nft_expr_data(e);
 	const char *base_str;
-	int32_t reg;
+	int32_t reg, base;
 
 	reg = nft_mxml_reg_parse(tree, "dreg", MXML_DESCEND_FIRST);
 	if (reg < 0)

@@ -197,14 +212,10 @@ nft_rule_expr_payload_xml_parse(struct nft_rule_expr *e, mxml_node_t *tree)
 	if (base_str == NULL)
 		return -1;
 
-	if (strcmp(base_str, "link") == 0)
-		payload->base = NFT_PAYLOAD_LL_HEADER;
-	else if (strcmp(base_str, "network") == 0)
-		payload->base = NFT_PAYLOAD_NETWORK_HEADER;
-	else if (strcmp(base_str, "transport") == 0)
-		payload->base = NFT_PAYLOAD_TRANSPORT_HEADER;
-	else
-		goto err;
+	base = nft_str2base(base_str);
+
+	if (base < 0)
+		return -1;
 
 	e->flags |= (1 << NFT_EXPR_PAYLOAD_BASE);

@@ -220,9 +231,6 @@ nft_rule_expr_payload_xml_parse(struct nft_rule_expr *e, mxml_node_t *tree)
 
 	e->flags |= (1 << NFT_EXPR_PAYLOAD_LEN);
 	return 0;
-err:
-	errno = EINVAL;
-	return -1;
 #else
 	errno = EOPNOTSUPP;
 	return -1;

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Arturo Borrero Gonzalez

2013-08-09 11:31 UTC #11 lore raw

Re: [libnftables PATCH 11/13] expr: payload: add nft_str2base function

Quoted 56 lines · Alvaro Neira

From: Álvaro Neira Ayuso <[email protected]>

Add function that will be use in the JSON parser

Signed-off-by Alvaro Neira Ayuso <[email protected]>

---
 src/expr/payload.c |   32 ++++++++++++++++++++------------
 1 file changed, 20 insertions(+), 12 deletions(-)

src/expr/payload.c +16 -3

index 34aee90..e32ae1b 100644
@@ -13,6 +13,7 @@
 
 #include <stdio.h>
 #include <stdint.h>
+#include <string.h>
 #include <limits.h>
 #include <arpa/inet.h>
 #include <errno.h>

@@ -178,13 +179,27 @@ nft_rule_expr_payload_snprintf_json(char *buf, size_t len, uint32_t flags,
        return offset;
 }
 
+static inline int nft_str2base(const char *base)
+{
+       if (strcmp(base, "link") == 0)
+               return NFT_PAYLOAD_LL_HEADER;
+       else if (strcmp(base, "network") == 0)
+               return NFT_PAYLOAD_NETWORK_HEADER;
+       else if (strcmp(base, "transport") == 0)
+               return NFT_PAYLOAD_TRANSPORT_HEADER;
+       else {
+               errno = EINVAL;
+               return -1;
+       }
+}
+
 static int
 nft_rule_expr_payload_xml_parse(struct nft_rule_expr *e, mxml_node_t *tree)
 {
 #ifdef XML_PARSING
        struct nft_expr_payload *payload = nft_expr_data(e);
        const char *base_str;
-       int32_t reg;
+       int32_t reg, base;
 
        reg = nft_mxml_reg_parse(tree, "dreg", MXML_DESCEND_FIRST);
        if (reg < 0)

@@ -197,14 +212,10 @@ nft_rule_expr_payload_xml_parse(struct nft_rule_expr *e, mxml_node_t *tree)
        if (base_str == NULL)
                return -1;
 
-       if (strcmp(base_str, "link") == 0)
-               payload->base = NFT_PAYLOAD_LL_HEADER;

src/expr/payload.c nft_rule_expr_payload_xml_parse(struct nft_rule_expr *e, mxml_node_t *tree) · line 218

Quoted 10 lines

src/expr/payload.c +4 -6

-       else if (strcmp(base_str, "network") == 0)
-               payload->base = NFT_PAYLOAD_NETWORK_HEADER;
-       else if (strcmp(base_str, "transport") == 0)
-               payload->base = NFT_PAYLOAD_TRANSPORT_HEADER;
-       else
-               goto err;
+       base = nft_str2base(base_str);
+
+       if (base < 0)
+               return -1;

I think we need this:

payload->base = base;

Also, maybe goto err in case of base < 0

Signature · 5 lines

Arturo Borrero González
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Pablo Neira Ayuso

maintainer

2013-08-09 11:43 UTC #12 lore raw

Re: [libnftables PATCH 11/13] expr: payload: add nft_str2base function

Quoted 16 lines · Arturo Borrero Gonzalez

Quoted 5 lines

        if (base_str == NULL)
                return -1;

src/expr/payload.c +0 -2

-       if (strcmp(base_str, "link") == 0)
-               payload->base = NFT_PAYLOAD_LL_HEADER;

src/expr/payload.c nft_rule_expr_payload_xml_parse(struct nft_rule_expr *e, mxml_node_t *tree) · line 218

Quoted 10 lines

src/expr/payload.c +4 -6

-       else if (strcmp(base_str, "network") == 0)
-               payload->base = NFT_PAYLOAD_NETWORK_HEADER;
-       else if (strcmp(base_str, "transport") == 0)
-               payload->base = NFT_PAYLOAD_TRANSPORT_HEADER;
-       else
-               goto err;
+       base = nft_str2base(base_str);
+
+       if (base < 0)
+               return -1;

Quoted 3 lines

I think we need this:
payload->base = base;

Good catch, I'm going to manually fix this. Thanks for reviewing.

Quoted 1 line

Also, maybe goto err in case of base < 0

errno is already set from the new function.

Arturo Borrero Gonzalez

2013-08-09 11:34 UTC #13 lore raw

Re: [libnftables PATCH 11/13] expr: payload: add nft_str2base function

In reply to Alvaro Neira

src/expr/payload.c nft_rule_expr_payload_xml_parse(struct nft_rule_expr *e, mxml_node_t *tree) · line 225

Quoted 3 lines · Alvaro Neira

src/expr/payload.c +0 -3

-err:
-       errno = EINVAL;
-       return -1;

not going to err anymore, obviously

Signature · 5 lines

Arturo Borrero González
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Alvaro Neira

author

2013-08-09 11:14 UTC #14 lore raw

PATCH 12/13 example: nft-rule-get: family parameter added

In reply to Alvaro Neira

From: Álvaro Neira Ayuso <[email protected]>

I have added the parameter family in the example nft-rule-get.

Signed-off-by Alvaro Neira Ayuso <[email protected]>

---
 examples/nft-rule-get.c |   29 ++++++++++++++++++++++++-----
 1 file changed, 24 insertions(+), 5 deletions(-)

examples/nft-rule-get.c +24 -5

index 2404f27..e78a5cf 100644
@@ -14,6 +14,7 @@
 #include <string.h>
 #include <netinet/in.h>
 
+#include <linux/netfilter.h>
 #include <linux/netfilter/nf_tables.h>
 
 #include <libmnl/libmnl.h>

@@ -52,13 +53,31 @@ int main(int argc, char *argv[])
 	struct nlmsghdr *nlh;
 	uint32_t portid, seq, type = NFT_RULE_O_DEFAULT;
 	struct nft_rule *t = NULL;
-	int ret;
+	int ret, family;
 
-	if (argc == 2 && strcmp(argv[1], "xml") == 0 ){
+	if (argc < 2 || argc > 3) {
+		fprintf(stderr, "Usage: %s <family> [xml|json]\n",
+			argv[0]);
+		exit(EXIT_FAILURE);
+	}
+
+	if (strcmp(argv[1], "ip") == 0)
+		family = NFPROTO_IPV4;
+	else if (strcmp(argv[1], "ip6") == 0)
+		family = NFPROTO_IPV6;
+	else if (strcmp(argv[1], "bridge") == 0)
+		family = NFPROTO_BRIDGE;
+	else if (strcmp(argv[1], "arp") == 0)
+		family = NFPROTO_ARP;
+	else {
+		fprintf(stderr, "Unknown family: ip, ip6, bridge, arp\n");
+		exit(EXIT_FAILURE);
+	}
+
+	if (argc == 3 && strcmp(argv[2], "xml") == 0 )
 		type = NFT_RULE_O_XML;
-	}else if (argc == 2 && strcmp(argv[1], "json") == 0 ){
+	else if (argc == 3 && strcmp(argv[2], "json") == 0 )
 		type = NFT_RULE_O_JSON;
-	}
 
 	/* XXX requires table, chain and handle attributes for selective get */

@@ -69,7 +88,7 @@ int main(int argc, char *argv[])
 	}
 
 	seq = time(NULL);
-	nlh = nft_rule_nlmsg_build_hdr(buf, NFT_MSG_GETRULE, AF_INET,
+	nlh = nft_rule_nlmsg_build_hdr(buf, NFT_MSG_GETRULE, family,
 					NLM_F_DUMP, seq);
 
 	nl = mnl_socket_open(NETLINK_NETFILTER);

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Alvaro Neira

author

2013-08-09 11:14 UTC #15 lore raw

PATCH 13/13 jansson: Add nft_jansson_family function

In reply to Alvaro Neira

From: Álvaro Neira Ayuso <[email protected]>

Refactor some existing code with the new function nft_jansson_family

Signed-off-by Alvaro Neira Ayuso <[email protected]>

---
 src/chain.c    |   10 ++--------
 src/internal.h |    1 +
 src/jansson.c  |   18 ++++++++++++++++++
 src/table.c    |    9 ++-------
 4 files changed, 23 insertions(+), 15 deletions(-)

src/chain.c +2 -8

index e2e6f90..a6d99ca 100644
@@ -517,14 +517,8 @@ static int nft_chain_json_parse(struct nft_chain *c, char *json)
 
 	nft_chain_attr_set_u64(c, NFT_CHAIN_ATTR_PACKETS, uval64);
 
-	valstr = nft_jansson_value_parse_str(root, "family");
-
-	if (valstr == NULL)
-		goto err;
-
-	val32 = nft_str2family(valstr);
-	if (val32 == -1)
-		goto err;
+	if (nft_jansson_parse_family(root, &val32) != 0)
+		return -1;
 
 	nft_chain_attr_set_u32(c, NFT_CHAIN_ATTR_FAMILY, val32);

src/internal.h +1 -0

index 17d1286..62eb3c5 100644
@@ -49,6 +49,7 @@ int nft_jansson_value_parse_val(json_t *root, const char *tag,
 const char *nft_jansson_value_parse_str(json_t *root, const char *tag);
 bool nft_jansson_node_exist(json_t *root, const char *tag);
 json_t *nft_jansson_get_root(char *json, const char *tag, json_error_t *err);
+int nft_jansson_parse_family(json_t *root, void *out);
 #endif
 
 const char *nft_family2str(uint32_t family);

src/jansson.c +18 -0

index 4c778d9..cc3ab23 100644
@@ -90,4 +90,22 @@ json_t *nft_jansson_get_root(char *json, const char *tag, json_error_t *err)
 
 	return root;
 }
+int nft_jansson_parse_family(json_t *root, void *out)
+{
+	const char *str;
+	int family;
+
+	str = nft_jansson_value_parse_str(root, "family");
+	if (str == NULL)
+		return -1;
+
+	family = nft_str2family(str);
+	if (family < 0) {
+		errno = EINVAL;
+		return -1;
+	}
+
+	memcpy(out, &family, sizeof(family));
+	return 0;
+}
 #endif

src/table.c +2 -7

index 18d9077..1fa0dac 100644
@@ -285,13 +285,8 @@ static int nft_table_json_parse(struct nft_table *t, char *json)
 
 	nft_table_attr_set_str(t, NFT_TABLE_ATTR_NAME, strdup(str));
 
-	str = nft_jansson_value_parse_str(root, "family");
-	if (str == NULL)
-		goto err;
-
-	family = nft_str2family(str);
-	if (family < 0)
-		goto err;
+	if (nft_jansson_parse_family(root, &family) != 0)
+		return -1;
 
 	nft_table_attr_set_u32(t, NFT_TABLE_ATTR_FAMILY, family);

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Pablo Neira Ayuso

maintainer Applied

2013-08-09 11:44 UTC #16 lore raw

In reply to Alvaro Neira

Applied this fixes with minor glitches, thanks Alvaro.