Skip to contentSkip to conversation

src: add nft_*_build_msg functions

PATCH In review Arturo Borrero Gonzalez 2 participants 5 messages May 6, 2014 – May 13, 2014 netfilter

lore
Share & tools
lore

Arturo Borrero Gonzalez

author
#0 lore raw

PATCH 1/2 src: add nft_*_build_msg functions

These functions are likely to be used by all userspace programs to interact with the nftables kernel subsystem.

Lets put in the library.

Signed-off-by Arturo Borrero Gonzalez <[email protected]>
---
 include/libnftnl/chain.h |    2 ++
 include/libnftnl/rule.h  |    2 ++
 include/libnftnl/set.h   |    4 ++++
 include/libnftnl/table.h |    2 ++
 src/chain.c              |   11 +++++++++++
 src/libnftnl.map         |    8 ++++++++
 src/rule.c               |   11 +++++++++++
 src/set.c                |   11 +++++++++++
 src/set_elem.c           |   11 +++++++++++
 src/table.c              |   11 +++++++++++
 10 files changed, 73 insertions(+)
include/libnftnl/chain.h +2 -0
index c11cb5e..eecc7e9 100644
@@ -56,6 +56,8 @@ uint64_t nft_chain_attr_get_u64(struct nft_chain *c, uint16_t attr);
 struct nlmsghdr;
 
 void nft_chain_nlmsg_build_payload(struct nlmsghdr *nlh, const struct nft_chain *t);
+void nft_chain_build_msg(struct nft_chain *c, void *buf, uint16_t msg,
+			 unsigned int flags, uint32_t seq);
 
 int nft_chain_parse(struct nft_chain *c, enum nft_parse_type type,
 		    const char *data, struct nft_parse_err *err);
include/libnftnl/rule.h +2 -0
index 62dba59..2412ce1 100644
@@ -53,6 +53,8 @@ void nft_rule_add_expr(struct nft_rule *r, struct nft_rule_expr *expr);
 struct nlmsghdr;
 
 void nft_rule_nlmsg_build_payload(struct nlmsghdr *nlh, struct nft_rule *t);
+void nft_rule_build_msg(struct nft_rule *r, void *buf, uint16_t msg,
+			unsigned int flags, uint32_t seq);
 
 int nft_rule_parse(struct nft_rule *r, enum nft_parse_type type,
 		   const char *data, struct nft_parse_err *err);
include/libnftnl/set.h +4 -0
index a975f1c..e7e267a 100644
@@ -44,6 +44,8 @@ struct nlmsghdr;
 
 #define nft_set_nlmsg_build_hdr	nft_nlmsg_build_hdr
 void nft_set_nlmsg_build_payload(struct nlmsghdr *nlh, struct nft_set *s);
+void nft_set_build_msg(struct nft_set *s, void *buf, uint16_t msg,
+		       unsigned int flags, uint32_t seq);
 int nft_set_nlmsg_parse(const struct nlmsghdr *nlh, struct nft_set *s);
 int nft_set_elems_nlmsg_parse(const struct nlmsghdr *nlh, struct nft_set *s);
 

@@ -104,6 +106,8 @@ bool nft_set_elem_attr_is_set(const struct nft_set_elem *s, uint16_t attr);
 #define nft_set_elem_nlmsg_build_hdr	nft_nlmsg_build_hdr
 void nft_set_elems_nlmsg_build_payload(struct nlmsghdr *nlh, struct nft_set *s);
 void nft_set_elem_nlmsg_build_payload(struct nlmsghdr *nlh, struct nft_set_elem *e);
+void nft_set_elems_build_msg(struct nft_set *s, void *buf, uint16_t msg,
+			     unsigned int flags, uint32_t seq);
 
 int nft_set_elem_parse(struct nft_set_elem *e, enum nft_parse_type type,
 		       const char *data, struct nft_parse_err *err);
include/libnftnl/table.h +2 -0
index fac79e7..cb4d06e 100644
@@ -45,6 +45,8 @@ const char *nft_table_attr_get_str(struct nft_table *t, uint16_t attr);
 struct nlmsghdr;
 
 void nft_table_nlmsg_build_payload(struct nlmsghdr *nlh, const struct nft_table *t);
+void nft_table_build_msg(struct nft_table *t, void *buf, uint16_t msg,
+			 unsigned int flags, uint32_t seq);
 
 int nft_table_parse(struct nft_table *t, enum nft_parse_type type,
 		    const char *data, struct nft_parse_err *err);
src/chain.c +11 -0
index 5311af6..3c9ace7 100644
@@ -372,6 +372,17 @@ void nft_chain_nlmsg_build_payload(struct nlmsghdr *nlh, const struct nft_chain
 }
 EXPORT_SYMBOL(nft_chain_nlmsg_build_payload);
 
+void nft_chain_build_msg(struct nft_chain *c, void *buf, uint16_t msg,
+			 unsigned int flags, uint32_t seq)
+{
+	struct nlmsghdr *nlh;
+	uint32_t family = nft_chain_attr_get_u32(c, NFT_CHAIN_ATTR_FAMILY);
+
+	nlh = nft_chain_nlmsg_build_hdr(buf, msg, family, flags, seq);
+	nft_chain_nlmsg_build_payload(nlh, c);
+}
+EXPORT_SYMBOL(nft_chain_build_msg);
+
 static int nft_chain_parse_attr_cb(const struct nlattr *attr, void *data)
 {
 	const struct nlattr **tb = data;
src/libnftnl.map +8 -0
index b11db67..019eb6c 100644
@@ -206,3 +206,11 @@ LIBNFTNL_1.1 {
   nft_set_attr_set_data;
   nft_set_attr_get_data;
 } LIBNFTNL_1.0;
+
+LIBNFTNL_1.2 {
+  nft_table_build_msg;
+  nft_chain_build_msg;
+  nft_rule_build_msg;
+  nft_set_build_msg;
+  nft_set_elems_build_msg;
+} LIBNFTNL_1.1;
src/rule.c +11 -0
index ac88abb..0c8e0d6 100644
@@ -315,6 +315,17 @@ void nft_rule_nlmsg_build_payload(struct nlmsghdr *nlh, struct nft_rule *r)
 }
 EXPORT_SYMBOL(nft_rule_nlmsg_build_payload);
 
+void nft_rule_build_msg(struct nft_rule *r, void *buf, uint16_t msg,
+			unsigned int flags, uint32_t seq)
+{
+	struct nlmsghdr *nlh;
+	uint32_t family = nft_rule_attr_get_u32(r, NFT_RULE_ATTR_FAMILY);
+
+	nlh = nft_rule_nlmsg_build_hdr(buf, msg, family, flags, seq);
+	nft_rule_nlmsg_build_payload(nlh, r);
+}
+EXPORT_SYMBOL(nft_rule_build_msg);
+
 void nft_rule_add_expr(struct nft_rule *r, struct nft_rule_expr *expr)
 {
 	list_add_tail(&expr->head, &r->expr_list);
src/set.c +11 -0
index 7c15857..417a3fe 100644
@@ -245,6 +245,17 @@ void nft_set_nlmsg_build_payload(struct nlmsghdr *nlh, struct nft_set *s)
 }
 EXPORT_SYMBOL(nft_set_nlmsg_build_payload);
 
+void nft_set_build_msg(struct nft_set *s, void *buf, uint16_t msg,
+		       unsigned int flags, uint32_t seq)
+{
+	struct nlmsghdr *nlh;
+	uint32_t family = nft_set_attr_get_u32(s, NFT_SET_ATTR_FAMILY);
+
+	nlh = nft_set_nlmsg_build_hdr(buf, msg, family, flags, seq);
+	nft_set_nlmsg_build_payload(nlh, s);
+}
+EXPORT_SYMBOL(nft_set_build_msg);
+
 static int nft_set_parse_attr_cb(const struct nlattr *attr, void *data)
 {
 	const struct nlattr **tb = data;
src/set_elem.c +11 -0
index 1eddce2..b4f4a5a 100644
@@ -220,6 +220,17 @@ void nft_set_elems_nlmsg_build_payload(struct nlmsghdr *nlh, struct nft_set *s)
 }
 EXPORT_SYMBOL(nft_set_elems_nlmsg_build_payload);
 
+void nft_set_elems_build_msg(struct nft_set *s, void *buf, uint16_t msg,
+			     unsigned int flags, uint32_t seq)
+{
+	struct nlmsghdr *nlh;
+	uint32_t family = nft_set_attr_get_u32(s, NFT_SET_ATTR_FAMILY);
+
+	nlh = nft_set_nlmsg_build_hdr(buf, msg, family, flags, seq);
+	nft_set_elems_nlmsg_build_payload(nlh, s);
+}
+EXPORT_SYMBOL(nft_set_elems_build_msg);
+
 static int nft_set_elem_parse_attr_cb(const struct nlattr *attr, void *data)
 {
 	const struct nlattr **tb = data;
src/table.c +11 -0
index b4d1663..a63bf64 100644
@@ -196,6 +196,17 @@ void nft_table_nlmsg_build_payload(struct nlmsghdr *nlh, const struct nft_table
 }
 EXPORT_SYMBOL(nft_table_nlmsg_build_payload);
 
+void nft_table_build_msg(struct nft_table *t, void *buf, uint16_t msg,
+			 unsigned int flags, uint32_t seq)
+{
+	struct nlmsghdr *nlh;
+	uint32_t family = nft_table_attr_get_u32(t, NFT_TABLE_ATTR_FAMILY);
+
+	nlh = nft_table_nlmsg_build_hdr(buf, msg, family, flags, seq);
+	nft_table_nlmsg_build_payload(nlh, t);
+}
+EXPORT_SYMBOL(nft_table_build_msg);
+
 static int nft_table_parse_attr_cb(const struct nlattr *attr, void *data)
 {
 	const struct nlattr **tb = data;
author
#1 lore raw

PATCH 2/2 examples: use new nft_*_build_msg() functions

Let's use these new functions in the examples.

Signed-off-by Arturo Borrero Gonzalez <[email protected]>
---
 examples/nft-rule-add.c |    9 ++-------
 examples/nft-rule-del.c |   13 +++++--------
 2 files changed, 7 insertions(+), 15 deletions(-)
examples/nft-rule-add.c +2 -7
index 6961d0d..32302c5 100644
@@ -137,7 +137,6 @@ int main(int argc, char *argv[])
 {
 	struct mnl_socket *nl;
 	struct nft_rule *r;
-	struct nlmsghdr *nlh;
 	struct mnl_nlmsg_batch *batch;
 	uint8_t family;
 	char buf[MNL_SOCKET_BUFFER_SIZE];

@@ -180,12 +179,8 @@ int main(int argc, char *argv[])
 			  NFNL_MSG_BATCH_BEGIN, seq++);
 	mnl_nlmsg_batch_next(batch);
 
-	nlh = nft_rule_nlmsg_build_hdr(mnl_nlmsg_batch_current(batch),
-			NFT_MSG_NEWRULE,
-			nft_rule_attr_get_u32(r, NFT_RULE_ATTR_FAMILY),
-			NLM_F_APPEND|NLM_F_CREATE|NLM_F_ACK, seq++);
-
-	nft_rule_nlmsg_build_payload(nlh, r);
+	nft_rule_build_msg(r, mnl_nlmsg_batch_current(batch), NFT_MSG_NEWRULE,
+			   NLM_F_APPEND|NLM_F_CREATE|NLM_F_ACK, seq++);
 	nft_rule_free(r);
 	mnl_nlmsg_batch_next(batch);
examples/nft-rule-del.c +5 -8
index cec9440..50e8eb8 100644
@@ -42,11 +42,10 @@ int main(int argc, char *argv[])
 {
 	struct mnl_socket *nl;
 	char buf[MNL_SOCKET_BUFFER_SIZE];
-	struct nlmsghdr *nlh;
 	struct mnl_nlmsg_batch *batch;
-	uint32_t portid, seq;
+	uint32_t portid, seq, family;
 	struct nft_rule *r = NULL;
-	int ret, family;
+	int ret;
 
 	if (argc < 4 || argc > 5) {
 		fprintf(stderr, "Usage: %s <family> <table> <chain> [<handle>]\n",

@@ -76,6 +75,7 @@ int main(int argc, char *argv[])
 	seq = time(NULL);
 	nft_rule_attr_set(r, NFT_RULE_ATTR_TABLE, argv[2]);
 	nft_rule_attr_set(r, NFT_RULE_ATTR_CHAIN, argv[3]);
+	nft_rule_attr_set_u32(r, NFT_RULE_ATTR_FAMILY, family);
 
 	/* If no handle is specified, delete all rules in the chain */
 	if (argc == 5)

@@ -87,12 +87,9 @@ int main(int argc, char *argv[])
 			  NFNL_MSG_BATCH_BEGIN, seq++);
 	mnl_nlmsg_batch_next(batch);
 
-	nlh = nft_rule_nlmsg_build_hdr(mnl_nlmsg_batch_current(batch),
-				NFT_MSG_DELRULE,
-				family,
-				NLM_F_ACK, seq++);
+	nft_rule_build_msg(r, mnl_nlmsg_batch_current(batch), NFT_MSG_DELRULE,
+			   NLM_F_ACK, seq++);
 
-	nft_rule_nlmsg_build_payload(nlh, r);
 	nft_rule_free(r);
 	mnl_nlmsg_batch_next(batch);
maintainer
#2 lore raw

Re: [libnftnl PATCH 2/2] examples: use new nft_*_build_msg() functions

Quoted 22 lines · Arturo Borrero Gonzalez

Let's use these new functions in the examples.

Signed-off-by Arturo Borrero Gonzalez <[email protected]>
---
 examples/nft-rule-add.c |    9 ++-------
 examples/nft-rule-del.c |   13 +++++--------
 2 files changed, 7 insertions(+), 15 deletions(-)
examples/nft-rule-add.c +0 -1
index 6961d0d..32302c5 100644
@@ -137,7 +137,6 @@ int main(int argc, char *argv[])
 {
 	struct mnl_socket *nl;
 	struct nft_rule *r;
-	struct nlmsghdr *nlh;
 	struct mnl_nlmsg_batch *batch;
 	uint8_t family;
 	char buf[MNL_SOCKET_BUFFER_SIZE];

@@ -180,12 +179,8 @@ int main(int argc, char *argv[])
 			  NFNL_MSG_BATCH_BEGIN, seq++);

examples/nft-rule-add.c int main(int argc, char *argv[]) · line 183

Quoted 10 lines
examples/nft-rule-add.c +2 -6
 	mnl_nlmsg_batch_next(batch);
 
-	nlh = nft_rule_nlmsg_build_hdr(mnl_nlmsg_batch_current(batch),
-			NFT_MSG_NEWRULE,
-			nft_rule_attr_get_u32(r, NFT_RULE_ATTR_FAMILY),
-			NLM_F_APPEND|NLM_F_CREATE|NLM_F_ACK, seq++);
-
-	nft_rule_nlmsg_build_payload(nlh, r);
+	nft_rule_build_msg(r, mnl_nlmsg_batch_current(batch), NFT_MSG_NEWRULE,
+			   NLM_F_APPEND|NLM_F_CREATE|NLM_F_ACK, seq++);

Is this the only potential user of this new _build_ function? If so, I'd prefer to keep this back until we have more clients, I don't want to prematurely increase the size of the library with code that we don't need yet.

Let me know,
Thanks.

author
#3 lore raw

Re: [libnftnl PATCH 2/2] examples: use new nft_*_build_msg() functions

Quoted 6 lines · Pablo Neira Ayuso

Is this the only potential user of this new _build_ function? If so, I'd prefer to keep this back until we have more clients, I don't want to prematurely increase the size of the library with code that we don't need yet.

We can make use of these functions in nft and nft-sync as well.

I think this is kind of the first step to get higher level functions. A second step would be to add _delete() and _add() functions to libnftnl or other, higher level, library.

You know, src/mnl.c is repeating over and over almost the same code.

Let me know your thoughts.

regards.

Signature · 5 lines
Arturo Borrero González
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
maintainer
#4 lore raw
In reply to Arturo Borrero Gonzalez
Quoted 24 lines · Arturo Borrero Gonzalez

These functions are likely to be used by all userspace programs to interact with the nftables kernel subsystem.

Lets put in the library.

Signed-off-by Arturo Borrero Gonzalez <[email protected]>
---
 include/libnftnl/chain.h |    2 ++
 include/libnftnl/rule.h  |    2 ++
 include/libnftnl/set.h   |    4 ++++
 include/libnftnl/table.h |    2 ++
 src/chain.c              |   11 +++++++++++
 src/libnftnl.map         |    8 ++++++++
 src/rule.c               |   11 +++++++++++
 src/set.c                |   11 +++++++++++
 src/set_elem.c           |   11 +++++++++++
 src/table.c              |   11 +++++++++++
 10 files changed, 73 insertions(+)
include/libnftnl/chain.h +0 -0
index c11cb5e..eecc7e9 100644

include/libnftnl/chain.h uint64_t nft_chain_attr_get_u64(struct nft_chain *c, uint16_t attr); · line 60

Quoted 5 lines
include/libnftnl/chain.h +2 -0
@@ -56,6 +56,8 @@ uint64_t nft_chain_attr_get_u64(struct nft_chain *c, uint16_t attr);
 struct nlmsghdr;
 
 void nft_chain_nlmsg_build_payload(struct nlmsghdr *nlh, const struct nft_chain *t);
+void nft_chain_build_msg(struct nft_chain *c, void *buf, uint16_t msg,
+			 unsigned int flags, uint32_t seq);

We should return the struct nlmsghdr * there, so we can still use the _fprintf function from libmnl in case we need to debug the message that has been made.