|
|
|
|
@ -67,22 +67,18 @@ struct add_rule_callbacks {
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
static void expr_free(struct nftnl_expr **e) {
|
|
|
|
|
if (*e)
|
|
|
|
|
nftnl_expr_free(*e);
|
|
|
|
|
}
|
|
|
|
|
static void rule_free(struct nftnl_rule **r) {
|
|
|
|
|
if (*r)
|
|
|
|
|
nftnl_rule_free(*r);
|
|
|
|
|
}
|
|
|
|
|
static void chain_free(struct nftnl_chain **c) {
|
|
|
|
|
if (*c)
|
|
|
|
|
nftnl_chain_free(*c);
|
|
|
|
|
}
|
|
|
|
|
static void table_free(struct nftnl_table **t) {
|
|
|
|
|
if (*t)
|
|
|
|
|
nftnl_table_free(*t);
|
|
|
|
|
}
|
|
|
|
|
typedef struct nftnl_expr _nftnl_expr;
|
|
|
|
|
typedef struct nftnl_rule _nftnl_rule;
|
|
|
|
|
typedef struct nftnl_chain _nftnl_chain;
|
|
|
|
|
typedef struct nftnl_table _nftnl_table;
|
|
|
|
|
typedef struct mnl_socket _mnl_socket;
|
|
|
|
|
|
|
|
|
|
G_DEFINE_AUTOPTR_CLEANUP_FUNC(_nftnl_expr, nftnl_expr_free);
|
|
|
|
|
G_DEFINE_AUTOPTR_CLEANUP_FUNC(_nftnl_rule, nftnl_rule_free);
|
|
|
|
|
G_DEFINE_AUTOPTR_CLEANUP_FUNC(_nftnl_chain, nftnl_chain_free);
|
|
|
|
|
G_DEFINE_AUTOPTR_CLEANUP_FUNC(_nftnl_table, nftnl_table_free);
|
|
|
|
|
G_DEFINE_AUTOPTR_CLEANUP_FUNC(_mnl_socket, mnl_socket_close);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
static int match_immediate(struct nftnl_expr *e, void *data) {
|
|
|
|
|
@ -132,7 +128,7 @@ static void check_immediate(struct nftnl_rule *r, struct iterate_callbacks *call
|
|
|
|
|
static int nftables_do_rule(const struct nlmsghdr *nlh, void *data) {
|
|
|
|
|
struct iterate_callbacks *callbacks = data;
|
|
|
|
|
|
|
|
|
|
AUTO_CLEANUP(struct nftnl_rule *r, rule_free) = nftnl_rule_alloc();
|
|
|
|
|
g_autoptr(_nftnl_rule) r = nftnl_rule_alloc();
|
|
|
|
|
if (!r)
|
|
|
|
|
return MNL_CB_ERROR;
|
|
|
|
|
|
|
|
|
|
@ -184,7 +180,7 @@ static const char *iterate_rules(struct mnl_socket *nl, int family, const char *
|
|
|
|
|
uint32_t *seq,
|
|
|
|
|
struct iterate_callbacks *callbacks)
|
|
|
|
|
{
|
|
|
|
|
AUTO_CLEANUP(struct nftnl_rule *r, rule_free) = nftnl_rule_alloc();
|
|
|
|
|
g_autoptr(_nftnl_rule) r = nftnl_rule_alloc();
|
|
|
|
|
if (!r)
|
|
|
|
|
return "failed to allocate rule for iteration";
|
|
|
|
|
|
|
|
|
|
@ -265,7 +261,7 @@ static const char *__batch_request(struct mnl_socket *nl, int family, uint32_t *
|
|
|
|
|
static const char *delete_rules(struct mnl_socket *nl, int family, const char *chain, uint32_t *seq,
|
|
|
|
|
bool (*callback)(struct nftnl_rule *r, void *data), void *data)
|
|
|
|
|
{
|
|
|
|
|
AUTO_CLEANUP(struct nftnl_rule *r, rule_free) = nftnl_rule_alloc();
|
|
|
|
|
g_autoptr(_nftnl_rule) r = nftnl_rule_alloc();
|
|
|
|
|
if (!r)
|
|
|
|
|
return "failed to allocate rule for deletion";
|
|
|
|
|
|
|
|
|
|
@ -302,12 +298,6 @@ static const char *iterate_delete_rules(struct mnl_socket *nl, int family, const
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
static void nftables_socket_close(struct mnl_socket **nl) {
|
|
|
|
|
if (*nl)
|
|
|
|
|
mnl_socket_close(*nl);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
static const char *local_input_chain(struct nftnl_chain *c) {
|
|
|
|
|
nftnl_chain_set_u32(c, NFTNL_CHAIN_HOOKNUM, NF_INET_LOCAL_IN);
|
|
|
|
|
nftnl_chain_set_u32(c, NFTNL_CHAIN_PRIO, 0);
|
|
|
|
|
@ -319,7 +309,7 @@ static const char *local_input_chain(struct nftnl_chain *c) {
|
|
|
|
|
static const char *add_chain(struct mnl_socket *nl, int family, const char *chain, uint32_t *seq,
|
|
|
|
|
const char *(*callback)(struct nftnl_chain *))
|
|
|
|
|
{
|
|
|
|
|
AUTO_CLEANUP(struct nftnl_chain *c, chain_free) = nftnl_chain_alloc();
|
|
|
|
|
g_autoptr(_nftnl_chain) c = nftnl_chain_alloc();
|
|
|
|
|
if (!c)
|
|
|
|
|
return "failed to allocate chain for adding";
|
|
|
|
|
|
|
|
|
|
@ -359,7 +349,7 @@ static const char *add_rule(struct mnl_socket *nl, int family, uint32_t *seq,
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
static const char *udp_filter(struct nftnl_rule *r, int family) {
|
|
|
|
|
AUTO_CLEANUP(struct nftnl_expr *e, expr_free);
|
|
|
|
|
g_autoptr(_nftnl_expr) e;
|
|
|
|
|
|
|
|
|
|
static const uint8_t proto = IPPROTO_UDP;
|
|
|
|
|
|
|
|
|
|
@ -472,7 +462,7 @@ static const char *rtpe_target_filter(struct nftnl_rule *r, int family, struct a
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
static const char *delete_chain(struct mnl_socket *nl, int family, uint32_t *seq, const char *chain) {
|
|
|
|
|
AUTO_CLEANUP(struct nftnl_chain *c, chain_free) = nftnl_chain_alloc();
|
|
|
|
|
g_autoptr(_nftnl_chain) c = nftnl_chain_alloc();
|
|
|
|
|
if (!c)
|
|
|
|
|
return "failed to allocate chain for deletion";
|
|
|
|
|
|
|
|
|
|
@ -541,7 +531,7 @@ static const char *nftables_shutdown_family(struct mnl_socket *nl, int family, u
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
static const char *add_table(struct mnl_socket *nl, int family, uint32_t *seq) {
|
|
|
|
|
AUTO_CLEANUP(struct nftnl_table *t, table_free) = nftnl_table_alloc();
|
|
|
|
|
g_autoptr(_nftnl_table) t = nftnl_table_alloc();
|
|
|
|
|
if (!t)
|
|
|
|
|
return "failed to allocate table";
|
|
|
|
|
|
|
|
|
|
@ -621,7 +611,7 @@ static const char *nftables_do(const char *chain, const char *base_chain,
|
|
|
|
|
if (!base_chain[0])
|
|
|
|
|
base_chain = NULL;
|
|
|
|
|
|
|
|
|
|
AUTO_CLEANUP(struct mnl_socket *nl, nftables_socket_close) = mnl_socket_open(NETLINK_NETFILTER);
|
|
|
|
|
g_autoptr(_mnl_socket) nl = mnl_socket_open(NETLINK_NETFILTER);
|
|
|
|
|
if (!nl)
|
|
|
|
|
return "failed to open netlink socket";
|
|
|
|
|
|
|
|
|
|
|