nftnl_rs/netlink/

netlink.rs

/*-
 * nftnl-rs - a netlink NFtables firewall.
 * Copyright (C) 2020 Aleksandr Morozov
 * 
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 *  file, You can obtain one at https://mozilla.org/MPL/2.0/.
 */

use bitflags::bitflags;
use crate::error::NftnlError;
use crate::int_error_code;
use crate::netlink::NLA_TYPE_MASK;
use crate::{netlink::mnl_align, error::NtflRes};

use super::linux::*;

bitflags! {
    /// Flags values for the batch header.
    pub struct NlmFFlags: u16
    {
        /// It is request message.
        const NLM_F_REQUEST = 1;

        /// Multipart message, terminated by NLMSG_DONE
        const NLM_F_MULTI = 2;

        /// Reply with ack, with zero or error code
        const NLM_F_ACK = 4;

        /// Echo this request
        const NLM_F_ECHO = 8;

        /// Dump was inconsistent due to sequence change
        const NLM_F_DUMP_INTR = 16;

        /* Modifiers to GET request */

        ///  specify tree	root
        const NLM_F_ROOT = 0x100;

        /// return all matching
        const NLM_F_MATCH = 0x200;
        /// atomic GET
        const NLM_F_ATOMIC = 0x400;
        const NLM_F_DUMP = Self::NLM_F_ROOT.union(Self::NLM_F_MATCH).bits();
        
        /* Modifiers to NEW request */

        /// Override existing
        const NLM_F_REPLACE = 0x100;

        /// Do not touch, if it exists
        const NLM_F_EXCL = 0x200;

        /// Create, if it does not exist
        const NLM_F_CREATE = 0x400;

        /// Add to end of list
        const NLM_F_APPEND = 0x800;
    }
}



/// A binding structure for the `struct nlattr`.
/// 
/// A quote from the `libmnl`:
///  <------- NLA_HDRLEN ------> <-- NLA_ALIGN(payload)-->
/// +---------------------+- - -+- - - - - - - - - -+- - -+
/// |        Header       | Pad |     Payload       | Pad |
/// |   (struct nlattr)   | ing |                   | ing |
/// +---------------------+- - -+- - - - - - - - - -+- - -+
///  <-------------- nlattr->nla_len -------------->
#[repr(C)]
#[derive(Copy, Clone, Debug)]
pub struct Nlattr 
{
	pub nla_len: __u16,
	pub nla_type: __u16,
}

impl Nlattr
{
    /// Get type of netlink attribute automatically converting it into the 
    /// generic type D.
    /// 
    /// # Returns
    /// 
    /// A [Result] in form of the type [NtflRes] is returned:
    /// 
    /// * [Result::Ok] with the inner type generic `D`
    /// 
    /// * [Result::Err] with the error description.
    pub 
    fn mnl_attr_get_type<D>(&self) -> NtflRes<D>
    where D: TryFrom<u16, Error = NftnlError>
    {
        return D::try_from(self.nla_type & NLA_TYPE_MASK);
    }

    /// Performs a validation of the raw data which should be a string.
    /// 
    /// # Arguments 
    /// 
    /// * `data` - a slice of raw data.
    /// 
    /// # Returns
    /// 
    /// A [Result] as alias [NtflRes] is returned.
    /// 
    /// * [Result::Ok] is returned if validation was successfull.
    /// 
    /// * [Result::Err] is returned with error description if validation 
    ///     failed.
    pub 
    fn validate_string(&self, data: &[u8]) -> NtflRes<()>
    {
        let full_data_len = data.len() + mnl_align(std::mem::size_of::<Nlattr>());

        if self.nla_len == 0
        {
            int_error_code!(libc::EINVAL, "empty string!");
        }
        else if full_data_len != self.nla_len as usize
        {
            int_error_code!(libc::EINVAL, "expected string len: '{}' got '{}'!", full_data_len, self.nla_len);
        }

        return Ok(());
    }

    /// Performs a validation of the raw data which should be a NULL terminated C-string.
    /// 
    /// # Arguments 
    /// 
    /// * `data` - a slice of raw data.
    /// 
    /// # Returns
    /// 
    /// A [Result] as alias [NtflRes] is returned.
    /// 
    /// * [Result::Ok] is returned if validation was successfull.
    /// 
    /// * [Result::Err] is returned with error description if validation 
    ///     failed.
    pub 
    fn validate_null_string(&self, data: &[u8]) -> NtflRes<()>
    {
        let full_data_len = mnl_align(data.len() + mnl_align(std::mem::size_of::<Nlattr>()));

        if self.nla_len == 0
        {
            int_error_code!(libc::EINVAL, "empty string!");
        }
        else if full_data_len != mnl_align(self.nla_len as usize) 
        {
            int_error_code!(libc::EINVAL, "expected null string len: '{}' got '{}'!", full_data_len, self.nla_len);
        }
        else if *data.last().unwrap() != 0
        {
            int_error_code!(libc::EINVAL, "string is not null terminated!");
        }

        return Ok(());
    }

    /// Performs a validation of the raw data which should be a nested block of data
    /// the content of which is unknown.
    /// 
    /// # Arguments 
    /// 
    /// * `data` - a slice of raw data.
    /// 
    /// # Returns
    /// 
    /// A [Result] as alias [NtflRes] is returned.
    /// 
    /// * [Result::Ok] is returned if validation was successfull.
    /// 
    /// * [Result::Err] is returned with error description if validation 
    ///     failed.
    pub 
    fn validate_nested(&self, data: &[u8]) -> NtflRes<()>
    {
        let full_data_len = data.len() + mnl_align(std::mem::size_of::<Nlattr>());

        if full_data_len != self.nla_len as usize
        {
            int_error_code!(libc::EINVAL, "expected string len: '{}' got '{}'!", full_data_len, self.nla_len);
        }
        else if self.nla_len == 0
        {
            // empty nested attributes are OK.
            return Ok(());
        }
        else if (self.nla_len as usize) < mnl_align(std::mem::size_of::<Nlattr>())
        {
            int_error_code!(libc::EINVAL, "corrupted nested attribute: size less 1 header: '{}'", 
                self.nla_len);
        }

        return Ok(());
    }
}


/// Error message.
#[repr(C)]
#[derive(Copy, Clone, Debug, PartialEq, Eq)]
pub struct Nlmsgerr 
{
    /// Error number
	error: i32,

    /// A message header
	msg: Nlmsghdr
}

impl Nlmsgerr
{
    pub 
    fn get_error(&self) -> i32
    {
        return self.error;
    }
}


/// A message header.
/// 
/// A copy of the packet description from the libmnl
///  * Netlink message:
/// ```text
/// |<----------------- 4 bytes ------------------->|  
/// |<----- 2 bytes ------>|<------- 2 bytes ------>|  
/// |-----------------------------------------------|  
/// |      Message length (including header)        |
/// |-----------------------------------------------|
/// |     Message type     |     Message flags      |
/// |-----------------------------------------------|
/// |           Message sequence number             |
/// |-----------------------------------------------|
/// |                 Netlink PortID                |
/// |-----------------------------------------------|
/// |                                               |
/// .                   Payload                     .
/// |_______________________________________________|
/// ```
/// 
/// ```text
///  There is usually an extra header after the the Netlink header (at the 
///  beginning of the payload). This extra header is specific of the Netlink
///  subsystem. After this extra header, it comes the sequence of attributes
///  that are expressed in Type-Length-Value (TLV) format.
/// ```
#[repr(C)]
#[derive(Copy, Clone, Debug, PartialEq, Eq)]
pub struct Nlmsghdr 
{
    /// Length of message including header
	pub nlmsg_len: __u32,

    /// Message content
	pub nlmsg_type: __u16,

    /// Additional flags
	pub nlmsg_flags: __u16,
    
    /// Sequence number
	pub nlmsg_seq: __u32,

    /// Sending process port ID
	pub nlmsg_pid: __u32,
}

impl Nlmsghdr
{
    pub 
    fn nftnl_nlmsg_flags_native(&self) -> Option<NlmFFlags>
    {
        return NlmFFlags::from_bits(self.nlmsg_flags);
    }

    /// verifies that port id value is correct.
    pub 
    fn mnl_nlmsg_portid_ok(&self, portid: u32) -> bool
    {
        let res = 
            if portid > 0
            {
                self.nlmsg_pid == portid
            }
            else
            {
                true
            };

        return self.nlmsg_pid > 0 && res;
    }

    /// Verifies the sequence number is correct.
    pub 
    fn mnl_nlmsg_seq_ok(&self, seq: u32) -> bool
    {
        let res = 
            if seq > 0
            {
                self.nlmsg_seq == seq
            }
            else
            {
                true
            };

        return self.nlmsg_seq > 0 && res;
    }

}