[PATCH v1 1/6] netlink_netfilter: decode base attributes

Mathis Marion Mathis.Marion at silabs.com
Thu Jun 12 09:56:01 UTC 2025


From: Mathis Marion <mathis.marion at silabs.com>

Signed-off-by: Mathis Marion <mathis.marion at silabs.com>
---
 src/netlink_netfilter.c             | 239 ++++++++++++++++++++++++++++
 src/xlat/nft_chain_attrs.in         |  15 ++
 src/xlat/nft_flowtable_attrs.in     |  10 ++
 src/xlat/nft_gen_attrs.in           |   6 +
 src/xlat/nft_obj_attrs.in           |  11 ++
 src/xlat/nft_rule_attrs.in          |  14 ++
 src/xlat/nft_set_attrs.in           |  21 +++
 src/xlat/nft_set_elem_list_attrs.in |   7 +
 src/xlat/nft_table_attrs.in         |  10 ++
 src/xlat/nft_trace_attrs.in         |  20 +++
 10 files changed, 353 insertions(+)
 create mode 100644 src/xlat/nft_chain_attrs.in
 create mode 100644 src/xlat/nft_flowtable_attrs.in
 create mode 100644 src/xlat/nft_gen_attrs.in
 create mode 100644 src/xlat/nft_obj_attrs.in
 create mode 100644 src/xlat/nft_rule_attrs.in
 create mode 100644 src/xlat/nft_set_attrs.in
 create mode 100644 src/xlat/nft_set_elem_list_attrs.in
 create mode 100644 src/xlat/nft_table_attrs.in
 create mode 100644 src/xlat/nft_trace_attrs.in

diff --git a/src/netlink_netfilter.c b/src/netlink_netfilter.c
index 45e3dcbb3..029a9bdf7 100644
--- a/src/netlink_netfilter.c
+++ b/src/netlink_netfilter.c
@@ -13,10 +13,241 @@
 #include <arpa/inet.h>
 #include "netlink.h"
 #include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nf_tables.h>
 
 #include "xlat/netfilter_versions.h"
 #include "xlat/nl_netfilter_msg_types.h"
 #include "xlat/nl_netfilter_subsys_ids.h"
+#include "xlat/nft_chain_attrs.h"
+#include "xlat/nft_flowtable_attrs.h"
+#include "xlat/nft_gen_attrs.h"
+#include "xlat/nft_obj_attrs.h"
+#include "xlat/nft_rule_attrs.h"
+#include "xlat/nft_set_attrs.h"
+#include "xlat/nft_set_elem_list_attrs.h"
+#include "xlat/nft_table_attrs.h"
+#include "xlat/nft_trace_attrs.h"
+
+struct nfta_decoder {
+	const struct xlat *xlat;
+	const char *dflt;
+	const nla_decoder_t *decoders;
+	unsigned int size;
+};
+
+static const nla_decoder_t nfta_table_decoders[] = {
+	[NFTA_TABLE_NAME]	= decode_nla_str,
+	[NFTA_TABLE_FLAGS]	= decode_nla_be32,
+	[NFTA_TABLE_USE]	= decode_nla_be32,
+	[NFTA_TABLE_HANDLE]	= decode_nla_be64,
+	[NFTA_TABLE_PAD]	= NULL,
+	[NFTA_TABLE_USERDATA]	= NULL,
+	[NFTA_TABLE_OWNER]	= decode_nla_be32,
+};
+
+static const struct nfta_decoder nfta_table_decoder = {
+	.xlat = nft_table_attrs,
+	.dflt = "NFTA_TABLE_???",
+	.decoders = nfta_table_decoders,
+	.size = ARRAY_SIZE(nfta_table_decoders),
+};
+
+static const nla_decoder_t nfta_chain_decoders[] = {
+	[NFTA_CHAIN_TABLE]	= decode_nla_str,
+	[NFTA_CHAIN_HANDLE]	= decode_nla_be64,
+	[NFTA_CHAIN_NAME]	= decode_nla_str,
+	[NFTA_CHAIN_HOOK]	= NULL, // TODO
+	[NFTA_CHAIN_POLICY]	= decode_nla_be32,
+	[NFTA_CHAIN_USE]	= decode_nla_be32,
+	[NFTA_CHAIN_TYPE]	= decode_nla_str,
+	[NFTA_CHAIN_COUNTERS]	= NULL, // TODO
+	[NFTA_CHAIN_PAD]	= NULL,
+	[NFTA_CHAIN_FLAGS]	= decode_nla_be32,
+	[NFTA_CHAIN_ID]		= decode_nla_be32,
+	[NFTA_CHAIN_USERDATA]	= NULL,
+};
+
+static const struct nfta_decoder nfta_chain_decoder = {
+	.xlat = nft_chain_attrs,
+	.dflt = "NFTA_CHAIN_???",
+	.decoders = nfta_chain_decoders,
+	.size = ARRAY_SIZE(nfta_chain_decoders),
+};
+
+static const nla_decoder_t nfta_rule_decoders[] = {
+	[NFTA_RULE_TABLE]	= decode_nla_str,
+	[NFTA_RULE_CHAIN]	= decode_nla_str,
+	[NFTA_RULE_HANDLE]	= decode_nla_be64,
+	[NFTA_RULE_EXPRESSIONS]	= NULL, // TODO
+	[NFTA_RULE_COMPAT]	= NULL, // TODO
+	[NFTA_RULE_POSITION]	= decode_nla_be64,
+	[NFTA_RULE_USERDATA]	= NULL,
+	[NFTA_RULE_PAD]		= NULL,
+	[NFTA_RULE_ID]		= decode_nla_be32,
+	[NFTA_RULE_POSITION_ID]	= decode_nla_be32,
+	[NFTA_RULE_CHAIN_ID]	= decode_nla_be32,
+};
+
+static const struct nfta_decoder nfta_rule_decoder = {
+	.xlat = nft_rule_attrs,
+	.dflt = "NFTA_RULE_???",
+	.decoders = nfta_rule_decoders,
+	.size = ARRAY_SIZE(nfta_rule_decoders),
+};
+
+static const nla_decoder_t nfta_set_decoders[] = {
+	[NFTA_SET_TABLE]	= decode_nla_str,
+	[NFTA_SET_NAME]		= decode_nla_str,
+	[NFTA_SET_FLAGS]	= decode_nla_be32,
+	[NFTA_SET_KEY_TYPE]	= decode_nla_be32,
+	[NFTA_SET_KEY_LEN]	= decode_nla_be32,
+	[NFTA_SET_DATA_TYPE]	= decode_nla_be32,
+	[NFTA_SET_DATA_LEN]	= decode_nla_be32,
+	[NFTA_SET_POLICY]	= decode_nla_be32,
+	[NFTA_SET_DESC]		= NULL, // TODO
+	[NFTA_SET_ID]		= decode_nla_be32,
+	[NFTA_SET_TIMEOUT]	= decode_nla_be64,
+	[NFTA_SET_GC_INTERVAL]	= decode_nla_be32,
+	[NFTA_SET_USERDATA]	= NULL,
+	[NFTA_SET_PAD]		= NULL,
+	[NFTA_SET_OBJ_TYPE]	= decode_nla_be32,
+	[NFTA_SET_HANDLE]	= decode_nla_be64,
+	[NFTA_SET_EXPR]		= NULL, // TODO
+	[NFTA_SET_EXPRESSIONS]	= NULL, // TODO
+};
+
+static const struct nfta_decoder nfta_set_decoder = {
+	.xlat = nft_set_attrs,
+	.dflt = "NFTA_SET_???",
+	.decoders = nfta_set_decoders,
+	.size = ARRAY_SIZE(nfta_set_decoders),
+};
+
+static const nla_decoder_t nfta_set_elem_list_decoders[] = {
+	[NFTA_SET_ELEM_LIST_TABLE]	= decode_nla_str,
+	[NFTA_SET_ELEM_LIST_SET]	= decode_nla_str,
+	[NFTA_SET_ELEM_LIST_ELEMENTS]	= NULL,
+	[NFTA_SET_ELEM_LIST_SET_ID]	= decode_nla_be32,
+};
+
+static const struct nfta_decoder nfta_setelem_decoder = {
+	.xlat = nft_set_elem_list_attrs,
+	.dflt = "NFTA_SET_ELEM_LIST_???",
+	.decoders = nfta_set_elem_list_decoders,
+	.size = ARRAY_SIZE(nfta_set_elem_list_decoders),
+};
+
+static const nla_decoder_t nfta_trace_decoders[] = {
+	[NFTA_TRACE_TABLE]		= decode_nla_str,
+	[NFTA_TRACE_CHAIN]		= decode_nla_str,
+	[NFTA_TRACE_RULE_HANDLE]	= decode_nla_be64,
+	[NFTA_TRACE_TYPE]		= decode_nla_be32,
+	[NFTA_TRACE_VERDICT]		= NULL, // TODO
+	[NFTA_TRACE_ID]			= decode_nla_u32,
+	[NFTA_TRACE_LL_HEADER]		= NULL,
+	[NFTA_TRACE_NETWORK_HEADER]	= NULL,
+	[NFTA_TRACE_TRANSPORT_HEADER]	= NULL,
+	[NFTA_TRACE_IIF]		= decode_nla_be32,
+	[NFTA_TRACE_IIFTYPE]		= decode_nla_be16,
+	[NFTA_TRACE_OIF]		= decode_nla_be32,
+	[NFTA_TRACE_OIFTYPE]		= decode_nla_be16,
+	[NFTA_TRACE_MARK]		= decode_nla_be32,
+	[NFTA_TRACE_NFPROTO]		= decode_nla_be32,
+	[NFTA_TRACE_POLICY]		= decode_nla_be32,
+	[NFTA_TRACE_PAD]		= NULL,
+};
+
+static const struct nfta_decoder nfta_trace_decoder = {
+	.xlat = nft_trace_attrs,
+	.dflt = "NFTA_TRACE_???",
+	.decoders = nfta_trace_decoders,
+	.size = ARRAY_SIZE(nfta_trace_decoders),
+};
+
+static const nla_decoder_t nfta_gen_decoders[] = {
+	[NFTA_GEN_ID]		= decode_nla_be32,
+	[NFTA_GEN_PROC_PID]	= decode_nla_be32,
+	[NFTA_GEN_PROC_NAME]	= decode_nla_str,
+};
+
+static const struct nfta_decoder nfta_gen_decoder = {
+	.xlat = nft_gen_attrs,
+	.dflt = "NFTA_GEN_???",
+	.decoders = nfta_gen_decoders,
+	.size = ARRAY_SIZE(nfta_gen_decoders),
+};
+
+static const nla_decoder_t nfta_obj_decoders[] = {
+	[NFTA_OBJ_TABLE]	= decode_nla_str,
+	[NFTA_OBJ_NAME]		= decode_nla_str,
+	[NFTA_OBJ_TYPE]		= decode_nla_be32,
+	[NFTA_OBJ_DATA]		= NULL,
+	[NFTA_OBJ_USE]		= decode_nla_be32,
+	[NFTA_OBJ_HANDLE]	= decode_nla_be64,
+	[NFTA_OBJ_PAD]		= NULL,
+	[NFTA_OBJ_USERDATA]	= NULL,
+};
+
+static const struct nfta_decoder nfta_obj_decoder = {
+	.xlat = nft_obj_attrs,
+	.dflt = "NFTA_OBJ_???",
+	.decoders = nfta_obj_decoders,
+	.size = ARRAY_SIZE(nfta_obj_decoders),
+};
+
+static const nla_decoder_t nfta_flowtable_decoders[] = {
+	[NFTA_FLOWTABLE_TABLE]	= decode_nla_str,
+	[NFTA_FLOWTABLE_NAME]	= decode_nla_str,
+	[NFTA_FLOWTABLE_HOOK]	= NULL,
+	[NFTA_FLOWTABLE_USE]	= decode_nla_be32,
+	[NFTA_FLOWTABLE_HANDLE]	= decode_nla_be64,
+	[NFTA_FLOWTABLE_PAD]	= NULL,
+	[NFTA_FLOWTABLE_FLAGS]	= decode_nla_be32,
+};
+
+static const struct nfta_decoder nfta_flowtable_decoder = {
+	.xlat = nft_flowtable_attrs,
+	.dflt = "NFTA_FLOWTABLE_???",
+	.decoders = nfta_flowtable_decoders,
+	.size = ARRAY_SIZE(nfta_flowtable_decoders),
+};
+
+static const struct nfta_decoder *decoders[NFT_MSG_MAX] = {
+	[NFT_MSG_NEWTABLE]		= &nfta_table_decoder,
+	[NFT_MSG_GETTABLE]		= &nfta_table_decoder,
+	[NFT_MSG_DELTABLE]		= &nfta_table_decoder,
+	[NFT_MSG_NEWCHAIN]		= &nfta_chain_decoder,
+	[NFT_MSG_GETCHAIN]		= &nfta_chain_decoder,
+	[NFT_MSG_DELCHAIN]		= &nfta_chain_decoder,
+	[NFT_MSG_NEWRULE]		= &nfta_rule_decoder,
+	[NFT_MSG_GETRULE]		= &nfta_rule_decoder,
+	[NFT_MSG_DELRULE]		= &nfta_rule_decoder,
+	[NFT_MSG_NEWSET]		= &nfta_set_decoder,
+	[NFT_MSG_GETSET]		= &nfta_set_decoder,
+	[NFT_MSG_DELSET]		= &nfta_set_decoder,
+	[NFT_MSG_NEWSETELEM]		= &nfta_setelem_decoder,
+	[NFT_MSG_GETSETELEM]		= &nfta_setelem_decoder,
+	[NFT_MSG_DELSETELEM]		= &nfta_setelem_decoder,
+	[NFT_MSG_NEWGEN]		= &nfta_gen_decoder,
+	[NFT_MSG_GETGEN]		= &nfta_gen_decoder,
+	[NFT_MSG_TRACE]			= &nfta_trace_decoder,
+	[NFT_MSG_NEWOBJ]		= &nfta_obj_decoder,
+	[NFT_MSG_GETOBJ]		= &nfta_obj_decoder,
+	[NFT_MSG_DELOBJ]		= &nfta_obj_decoder,
+	[NFT_MSG_GETOBJ_RESET]		= &nfta_obj_decoder,
+	[NFT_MSG_NEWFLOWTABLE]		= &nfta_flowtable_decoder,
+	[NFT_MSG_GETFLOWTABLE]		= &nfta_flowtable_decoder,
+	[NFT_MSG_DELFLOWTABLE]		= &nfta_flowtable_decoder,
+	[NFT_MSG_GETRULE_RESET]		= &nfta_rule_decoder,
+	[NFT_MSG_DESTROYTABLE]		= &nfta_table_decoder,
+	[NFT_MSG_DESTROYCHAIN]		= &nfta_chain_decoder,
+	[NFT_MSG_DESTROYRULE]		= &nfta_rule_decoder,
+	[NFT_MSG_DESTROYSET]		= &nfta_set_decoder,
+	[NFT_MSG_DESTROYSETELEM]	= &nfta_setelem_decoder,
+	[NFT_MSG_DESTROYOBJ]		= &nfta_obj_decoder,
+	[NFT_MSG_DESTROYFLOWTABLE]	= &nfta_flowtable_decoder,
+	[NFT_MSG_GETSETELEM_RESET]	= &nfta_setelem_decoder,
+};
 
 bool
 decode_netlink_netfilter(struct tcb *const tcp,
@@ -33,6 +264,7 @@ decode_netlink_netfilter(struct tcb *const tcp,
 		printstr_ex(tcp, addr, len, QUOTE_FORCE_HEX);
 	else if (!umove_or_printaddr(tcp, addr, &nfmsg)) {
 		const uint8_t subsys_id = (uint8_t) (nlmsghdr->nlmsg_type >> 8);
+		const uint8_t msg_type = NFNL_MSG_TYPE(nlmsghdr->nlmsg_type);
 		uint16_t res_id = ntohs(nfmsg.res_id);
 
 		tprint_struct_begin();
@@ -71,6 +303,13 @@ decode_netlink_netfilter(struct tcb *const tcp,
 			    || nlmsghdr->nlmsg_type < NLMSG_MIN_TYPE)
 				printstr_ex(tcp, addr + offset,
 					    len - offset, QUOTE_FORCE_HEX);
+			else if (msg_type < ARRAY_SIZE(decoders) &&
+				 decoders[msg_type])
+				decode_nlattr(tcp, addr + offset, len - offset,
+					      decoders[msg_type]->xlat,
+					      decoders[msg_type]->dflt,
+					      decoders[msg_type]->decoders,
+					      decoders[msg_type]->size, NULL);
 			else
 				decode_nlattr(tcp, addr + offset, len - offset,
 					      NULL, NULL, NULL, 0, NULL);
diff --git a/src/xlat/nft_chain_attrs.in b/src/xlat/nft_chain_attrs.in
new file mode 100644
index 000000000..fb9dc1749
--- /dev/null
+++ b/src/xlat/nft_chain_attrs.in
@@ -0,0 +1,15 @@
+#unconditional
+#value_indexed
+NFTA_CHAIN_UNSPEC
+NFTA_CHAIN_TABLE
+NFTA_CHAIN_HANDLE
+NFTA_CHAIN_NAME
+NFTA_CHAIN_HOOK
+NFTA_CHAIN_POLICY
+NFTA_CHAIN_USE
+NFTA_CHAIN_TYPE
+NFTA_CHAIN_COUNTERS
+NFTA_CHAIN_PAD
+NFTA_CHAIN_FLAGS
+NFTA_CHAIN_ID
+NFTA_CHAIN_USERDATA
diff --git a/src/xlat/nft_flowtable_attrs.in b/src/xlat/nft_flowtable_attrs.in
new file mode 100644
index 000000000..b2080a100
--- /dev/null
+++ b/src/xlat/nft_flowtable_attrs.in
@@ -0,0 +1,10 @@
+#unconditional
+#value_indexed
+NFTA_FLOWTABLE_UNSPEC
+NFTA_FLOWTABLE_TABLE
+NFTA_FLOWTABLE_NAME
+NFTA_FLOWTABLE_HOOK
+NFTA_FLOWTABLE_USE
+NFTA_FLOWTABLE_HANDLE
+NFTA_FLOWTABLE_PAD
+NFTA_FLOWTABLE_FLAGS
diff --git a/src/xlat/nft_gen_attrs.in b/src/xlat/nft_gen_attrs.in
new file mode 100644
index 000000000..c38265367
--- /dev/null
+++ b/src/xlat/nft_gen_attrs.in
@@ -0,0 +1,6 @@
+#unconditional
+#value_indexed
+NFTA_GEN_UNSPEC
+NFTA_GEN_ID
+NFTA_GEN_PROC_PID
+NFTA_GEN_PROC_NAME
diff --git a/src/xlat/nft_obj_attrs.in b/src/xlat/nft_obj_attrs.in
new file mode 100644
index 000000000..089411d2d
--- /dev/null
+++ b/src/xlat/nft_obj_attrs.in
@@ -0,0 +1,11 @@
+#unconditional
+#value_indexed
+NFTA_OBJ_UNSPEC
+NFTA_OBJ_TABLE
+NFTA_OBJ_NAME
+NFTA_OBJ_TYPE
+NFTA_OBJ_DATA
+NFTA_OBJ_USE
+NFTA_OBJ_HANDLE
+NFTA_OBJ_PAD
+NFTA_OBJ_USERDATA
diff --git a/src/xlat/nft_rule_attrs.in b/src/xlat/nft_rule_attrs.in
new file mode 100644
index 000000000..c0d5cba1b
--- /dev/null
+++ b/src/xlat/nft_rule_attrs.in
@@ -0,0 +1,14 @@
+#unconditional
+#value_indexed
+NFTA_RULE_UNSPEC
+NFTA_RULE_TABLE
+NFTA_RULE_CHAIN
+NFTA_RULE_HANDLE
+NFTA_RULE_EXPRESSIONS
+NFTA_RULE_COMPAT
+NFTA_RULE_POSITION
+NFTA_RULE_USERDATA
+NFTA_RULE_PAD
+NFTA_RULE_ID
+NFTA_RULE_POSITION_ID
+NFTA_RULE_CHAIN_ID
diff --git a/src/xlat/nft_set_attrs.in b/src/xlat/nft_set_attrs.in
new file mode 100644
index 000000000..b1fea05cc
--- /dev/null
+++ b/src/xlat/nft_set_attrs.in
@@ -0,0 +1,21 @@
+#unconditional
+#value_indexed
+NFTA_SET_UNSPEC
+NFTA_SET_TABLE
+NFTA_SET_NAME
+NFTA_SET_FLAGS
+NFTA_SET_KEY_TYPE
+NFTA_SET_KEY_LEN
+NFTA_SET_DATA_TYPE
+NFTA_SET_DATA_LEN
+NFTA_SET_POLICY
+NFTA_SET_DESC
+NFTA_SET_ID
+NFTA_SET_TIMEOUT
+NFTA_SET_GC_INTERVAL
+NFTA_SET_USERDATA
+NFTA_SET_PAD
+NFTA_SET_OBJ_TYPE
+NFTA_SET_HANDLE
+NFTA_SET_EXPR
+NFTA_SET_EXPRESSIONS
diff --git a/src/xlat/nft_set_elem_list_attrs.in b/src/xlat/nft_set_elem_list_attrs.in
new file mode 100644
index 000000000..b8a48c91c
--- /dev/null
+++ b/src/xlat/nft_set_elem_list_attrs.in
@@ -0,0 +1,7 @@
+#unconditional
+#value_indexed
+NFTA_SET_ELEM_LIST_UNSPEC
+NFTA_SET_ELEM_LIST_TABLE
+NFTA_SET_ELEM_LIST_SET
+NFTA_SET_ELEM_LIST_ELEMENTS
+NFTA_SET_ELEM_LIST_SET_ID
diff --git a/src/xlat/nft_table_attrs.in b/src/xlat/nft_table_attrs.in
new file mode 100644
index 000000000..c1d84d1f6
--- /dev/null
+++ b/src/xlat/nft_table_attrs.in
@@ -0,0 +1,10 @@
+#unconditional
+#value_indexed
+NFTA_TABLE_UNSPEC
+NFTA_TABLE_NAME
+NFTA_TABLE_FLAGS
+NFTA_TABLE_USE
+NFTA_TABLE_HANDLE
+NFTA_TABLE_PAD
+NFTA_TABLE_USERDATA
+NFTA_TABLE_OWNER
diff --git a/src/xlat/nft_trace_attrs.in b/src/xlat/nft_trace_attrs.in
new file mode 100644
index 000000000..6d7869378
--- /dev/null
+++ b/src/xlat/nft_trace_attrs.in
@@ -0,0 +1,20 @@
+#unconditional
+#value_indexed
+NFTA_TRACE_UNSPEC
+NFTA_TRACE_TABLE
+NFTA_TRACE_CHAIN
+NFTA_TRACE_RULE_HANDLE
+NFTA_TRACE_TYPE
+NFTA_TRACE_VERDICT
+NFTA_TRACE_ID
+NFTA_TRACE_LL_HEADER
+NFTA_TRACE_NETWORK_HEADER
+NFTA_TRACE_TRANSPORT_HEADER
+NFTA_TRACE_IIF
+NFTA_TRACE_IIFTYPE
+NFTA_TRACE_OIF
+NFTA_TRACE_OIFTYPE
+NFTA_TRACE_MARK
+NFTA_TRACE_NFPROTO
+NFTA_TRACE_POLICY
+NFTA_TRACE_PAD
-- 
2.47.2



More information about the Strace-devel mailing list