SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

firewall-util: introduce nfnl_close_expr_container() helper function

Browse Source 
And merge nfnl_add_expr_lookup_set() and nfnl_add_expr_lookup_map().
This commit is contained in:
Yu Watanabe
2022-07-24 00:05:32 +09:00
parent df7371708e
commit 665bc9e6e2
1 changed files with 40 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/shared/firewall-util-nft.c
+40 -88
View File
@@ -74,7 +74,7 @@ static int nfnl_netlink_sendv(
return r;
}
static int nfnl_add_open_expr_container(sd_netlink_message *m, const char *name) {
static int nfnl_open_expr_container(sd_netlink_message *m, const char *name) {
int r;
assert(m);
@@ -87,6 +87,18 @@ static int nfnl_add_open_expr_container(sd_netlink_message *m, const char *name)
return sd_netlink_message_open_container_union(m, NFTA_EXPR_DATA, name);
}
static int nfnl_close_expr_container(sd_netlink_message *m) {
int r;
assert(m);
r = sd_netlink_message_close_container(m); /* NFTA_EXPR_DATA */
if (r < 0)
return r;
return sd_netlink_message_close_container(m); /* NFTA_LIST_ELEM */
}
static int nfnl_add_expr_fib(
sd_netlink_message *m,
uint32_t nft_fib_flags,
@@ -97,7 +109,7 @@ static int nfnl_add_expr_fib(
assert(m);
r = nfnl_add_open_expr_container(m, "fib");
r = nfnl_open_expr_container(m, "fib");
if (r < 0)
return r;
@@ -113,11 +125,7 @@ static int nfnl_add_expr_fib(
if (r < 0)
return r;
r = sd_netlink_message_close_container(m); /* NFTA_EXPR_DATA */
if (r < 0)
return r;
return sd_netlink_message_close_container(m); /* NFTA_LIST_ELEM */
return nfnl_close_expr_container(m);
}
static int nfnl_add_expr_meta(
@@ -129,7 +137,7 @@ static int nfnl_add_expr_meta(
assert(m);
r = nfnl_add_open_expr_container(m, "meta");
r = nfnl_open_expr_container(m, "meta");
if (r < 0)
return r;
@@ -141,11 +149,7 @@ static int nfnl_add_expr_meta(
if (r < 0)
return r;
r = sd_netlink_message_close_container(m); /* NFTA_EXPR_DATA */
if (r < 0)
return r;
return sd_netlink_message_close_container(m); /* NFTA_LIST_ELEM */
return nfnl_close_expr_container(m);
}
static int nfnl_add_expr_payload(
@@ -159,7 +163,7 @@ static int nfnl_add_expr_payload(
assert(m);
r = nfnl_add_open_expr_container(m, "payload");
r = nfnl_open_expr_container(m, "payload");
if (r < 0)
return r;
@@ -179,56 +183,10 @@ static int nfnl_add_expr_payload(
if (r < 0)
return r;
r = sd_netlink_message_close_container(m); /* NFTA_EXPR_DATA */
if (r < 0)
return r;
return sd_netlink_message_close_container(m); /* NFTA_LIST_ELEM */
return nfnl_close_expr_container(m);
}
static int nfnl_add_expr_lookup_set_data(
sd_netlink_message *m,
const char *set_name,
enum nft_registers sreg) {
int r;
assert(m);
assert(set_name);
r = nfnl_add_open_expr_container(m, "lookup");
if (r < 0)
return r;
r = sd_netlink_message_append_string(m, NFTA_LOOKUP_SET, set_name);
if (r < 0)
return r;
return sd_netlink_message_append_u32(m, NFTA_LOOKUP_SREG, htobe32(sreg));
}
static int nfnl_add_expr_lookup_set(
sd_netlink_message *m,
const char *set_name,
enum nft_registers sreg) {
int r;
assert(m);
assert(set_name);
r = nfnl_add_expr_lookup_set_data(m, set_name, sreg);
if (r < 0)
return r;
r = sd_netlink_message_close_container(m); /* NFTA_EXPR_DATA */
if (r < 0)
return r;
return sd_netlink_message_close_container(m); /* NFTA_LIST_ELEM */
}
static int nfnl_add_expr_lookup_map(
static int nfnl_add_expr_lookup(
sd_netlink_message *m,
const char *set_name,
enum nft_registers sreg,
@@ -239,19 +197,25 @@ static int nfnl_add_expr_lookup_map(
assert(m);
assert(set_name);
r = nfnl_add_expr_lookup_set_data(m, set_name, sreg);
r = nfnl_open_expr_container(m, "lookup");
if (r < 0)
return r;
r = sd_netlink_message_append_u32(m, NFTA_LOOKUP_DREG, htobe32(dreg));
r = sd_netlink_message_append_string(m, NFTA_LOOKUP_SET, set_name);
if (r < 0)
return r;
r = sd_netlink_message_close_container(m); /* NFTA_EXPR_DATA */
r = sd_netlink_message_append_u32(m, NFTA_LOOKUP_SREG, htobe32(sreg));
if (r < 0)
return r;
return sd_netlink_message_close_container(m); /* NFTA_LIST_ELEM */
if (dreg != 0) {
r = sd_netlink_message_append_u32(m, NFTA_LOOKUP_DREG, htobe32(dreg));
if (r < 0)
return r;
}
return nfnl_close_expr_container(m);
}
static int nfnl_add_expr_cmp(
@@ -259,14 +223,14 @@ static int nfnl_add_expr_cmp(
enum nft_cmp_ops cmp_op,
enum nft_registers sreg,
const void *data,
uint32_t dlen) {
size_t dlen) {
int r;
assert(m);
assert(data);
r = nfnl_add_open_expr_container(m, "cmp");
r = nfnl_open_expr_container(m, "cmp");
if (r < 0)
return r;
@@ -282,11 +246,7 @@ static int nfnl_add_expr_cmp(
if (r < 0)
return r;
r = sd_netlink_message_close_container(m); /* NFTA_EXPR_DATA */
if (r < 0)
return r;
return sd_netlink_message_close_container(m); /* NFTA_LIST_ELEM */
return nfnl_close_expr_container(m);
}
static int nfnl_add_expr_bitwise(
@@ -303,7 +263,7 @@ static int nfnl_add_expr_bitwise(
assert(and);
assert(xor);
r = nfnl_add_open_expr_container(m, "bitwise");
r = nfnl_open_expr_container(m, "bitwise");
if (r < 0)
return r;
@@ -327,11 +287,7 @@ static int nfnl_add_expr_bitwise(
if (r < 0)
return r;
r = sd_netlink_message_close_container(m); /* NFTA_EXPR_DATA */
if (r < 0)
return r;
return sd_netlink_message_close_container(m); /* NFTA_LIST_ELEM */
return nfnl_close_expr_container(m);
}
static int nfnl_add_expr_dnat(
@@ -344,7 +300,7 @@ static int nfnl_add_expr_dnat(
assert(m);
r = nfnl_add_open_expr_container(m, "nat");
r = nfnl_open_expr_container(m, "nat");
if (r < 0)
return r;
@@ -364,11 +320,7 @@ static int nfnl_add_expr_dnat(
if (r < 0)
return r;
r = sd_netlink_message_close_container(m);
if (r < 0)
return r;
return sd_netlink_message_close_container(m);
return nfnl_close_expr_container(m);
}
static int nfnl_add_expr_masq(sd_netlink_message *m) {
@@ -420,7 +372,7 @@ static int sd_nfnl_message_new_masq_rule(
return r;
/* 1st statement: use reg1 content to make lookup in @masq_saddr set. */
r = nfnl_add_expr_lookup_set(m, NFT_SYSTEMD_MASQ_SET_NAME, NFT_REG32_01);
r = nfnl_add_expr_lookup(m, NFT_SYSTEMD_MASQ_SET_NAME, NFT_REG32_01, 0);
if (r < 0)
return r;
@@ -486,7 +438,7 @@ static int sd_nfnl_message_new_dnat_rule_pre(
/* 3rd statement: lookup 'l4proto . dport', e.g. 'tcp . 22' as key and
* store address and port for the dnat mapping in REG1/REG2. */
r = nfnl_add_expr_lookup_map(m, NFT_SYSTEMD_DNAT_MAP_NAME, NFT_REG32_01, NFT_REG32_01);
r = nfnl_add_expr_lookup(m, NFT_SYSTEMD_DNAT_MAP_NAME, NFT_REG32_01, NFT_REG32_01);
if (r < 0)
return r;
@@ -581,7 +533,7 @@ static int sd_nfnl_message_new_dnat_rule_out(
*
* reg1 and reg2 are clobbered and will then contain the new
* address/port number. */
r = nfnl_add_expr_lookup_map(m, NFT_SYSTEMD_DNAT_MAP_NAME, NFT_REG32_01, NFT_REG32_01);
r = nfnl_add_expr_lookup(m, NFT_SYSTEMD_DNAT_MAP_NAME, NFT_REG32_01, NFT_REG32_01);
if (r < 0)
return r;