xref: /aosp_15_r20/external/libnl/lib/netfilter/exp_obj.c (revision 4dc78e53d49367fa8e61b07018507c90983a077d)

/* SPDX-License-Identifier: LGPL-2.1-only */
/*
 * Copyright (c) 2003-2008 Thomas Graf <[email protected]>
 * Copyright (c) 2007 Philip Craig <[email protected]>
 * Copyright (c) 2007 Secure Computing Corporation
 * Copyright (c) 2012 Rich Fought <[email protected]>
 */

#include "nl-default.h"

#include <sys/types.h>

#include <linux/netfilter/nfnetlink_conntrack.h>
#include <linux/netfilter/nf_conntrack_common.h>

#include <linux/netfilter/nf_conntrack_tcp.h>

#include <netlink/netfilter/nfnl.h>
#include <netlink/netfilter/exp.h>

#include "nl-priv-dynamic-core/object-api.h"
#include "nl-netfilter.h"
#include "nl-priv-dynamic-core/nl-core.h"

// The 32-bit attribute mask in the common object header isn't
// big enough to handle all attributes of an expectation.  So
// we'll for sure specify optional attributes + parent attributes
// that are required for valid object comparison.  Comparison of
// these parent attributes will include nested attributes.

/** @cond SKIP */
#define EXP_ATTR_FAMILY			(1UL << 0) // 8-bit
#define EXP_ATTR_TIMEOUT		(1UL << 1) // 32-bit
#define EXP_ATTR_ID			(1UL << 2) // 32-bit
#define EXP_ATTR_HELPER_NAME		(1UL << 3) // string
#define EXP_ATTR_ZONE			(1UL << 4) // 16-bit
#define EXP_ATTR_FLAGS			(1UL << 5) // 32-bit
#define EXP_ATTR_CLASS			(1UL << 6) // 32-bit
#define EXP_ATTR_FN			(1UL << 7) // String
// Tuples
#define EXP_ATTR_EXPECT_IP_SRC		(1UL << 8)
#define EXP_ATTR_EXPECT_IP_DST		(1UL << 9)
#define EXP_ATTR_EXPECT_L4PROTO_NUM	(1UL << 10)
#define EXP_ATTR_EXPECT_L4PROTO_PORTS	(1UL << 11)
#define EXP_ATTR_EXPECT_L4PROTO_ICMP	(1UL << 12)
#define EXP_ATTR_MASTER_IP_SRC		(1UL << 13)
#define EXP_ATTR_MASTER_IP_DST		(1UL << 14)
#define EXP_ATTR_MASTER_L4PROTO_NUM	(1UL << 15)
#define EXP_ATTR_MASTER_L4PROTO_PORTS	(1UL << 16)
#define EXP_ATTR_MASTER_L4PROTO_ICMP	(1UL << 17)
#define EXP_ATTR_MASK_IP_SRC		(1UL << 18)
#define EXP_ATTR_MASK_IP_DST		(1UL << 19)
#define EXP_ATTR_MASK_L4PROTO_NUM	(1UL << 20)
#define EXP_ATTR_MASK_L4PROTO_PORTS	(1UL << 21)
#define EXP_ATTR_MASK_L4PROTO_ICMP	(1UL << 22)
#define EXP_ATTR_NAT_IP_SRC		(1UL << 23)
#define EXP_ATTR_NAT_IP_DST		(1UL << 24)
#define EXP_ATTR_NAT_L4PROTO_NUM	(1UL << 25)
#define EXP_ATTR_NAT_L4PROTO_PORTS	(1UL << 26)
#define EXP_ATTR_NAT_L4PROTO_ICMP	(1UL << 27)
#define EXP_ATTR_NAT_DIR		(1UL << 28)
/** @endcond */

static void exp_free_data(struct nl_object *c)
{
	struct nfnl_exp *exp = (struct nfnl_exp *) c;

	if (exp == NULL)
		return;

	nl_addr_put(exp->exp_expect.src);
	nl_addr_put(exp->exp_expect.dst);
	nl_addr_put(exp->exp_master.src);
	nl_addr_put(exp->exp_master.dst);
	nl_addr_put(exp->exp_mask.src);
	nl_addr_put(exp->exp_mask.dst);
	nl_addr_put(exp->exp_nat.src);
	nl_addr_put(exp->exp_nat.dst);

	free(exp->exp_fn);
	free(exp->exp_helper_name);
}

static int exp_clone(struct nl_object *_dst, struct nl_object *_src)
{
	struct nfnl_exp *dst = (struct nfnl_exp *) _dst;
	struct nfnl_exp *src = (struct nfnl_exp *) _src;
	struct nl_addr *addr;

	dst->exp_helper_name = NULL;
	dst->exp_fn = NULL;
	dst->exp_expect.src = NULL;
	dst->exp_expect.dst = NULL;
	dst->exp_master.src = NULL;
	dst->exp_master.dst = NULL;
	dst->exp_mask.src = NULL;
	dst->exp_mask.dst = NULL;
	dst->exp_nat.src = NULL;
	dst->exp_nat.dst = NULL;

	if (src->exp_expect.src) {
		addr = nl_addr_clone(src->exp_expect.src);
		if (!addr)
			return -NLE_NOMEM;
		dst->exp_expect.src = addr;
	}

	if (src->exp_expect.dst) {
		addr = nl_addr_clone(src->exp_expect.dst);
		if (!addr)
			return -NLE_NOMEM;
		dst->exp_expect.dst = addr;
	}

	if (src->exp_master.src) {
		addr = nl_addr_clone(src->exp_master.src);
		if (!addr)
			return -NLE_NOMEM;
		dst->exp_master.src = addr;
	}

	if (src->exp_master.dst) {
		addr = nl_addr_clone(src->exp_master.dst);
		if (!addr)
			return -NLE_NOMEM;
		dst->exp_master.dst = addr;
	}

	if (src->exp_mask.src) {
		addr = nl_addr_clone(src->exp_mask.src);
		if (!addr)
			return -NLE_NOMEM;
		dst->exp_mask.src = addr;
	}

	if (src->exp_mask.dst) {
		addr = nl_addr_clone(src->exp_mask.dst);
		if (!addr)
			return -NLE_NOMEM;
		dst->exp_mask.dst = addr;
	}

	if (src->exp_nat.src) {
		addr = nl_addr_clone(src->exp_nat.src);
		if (!addr)
			return -NLE_NOMEM;
		dst->exp_nat.src = addr;
	}

	if (src->exp_nat.dst) {
		addr = nl_addr_clone(src->exp_nat.dst);
		if (!addr)
			return -NLE_NOMEM;
		dst->exp_nat.dst = addr;
	}

	if (src->exp_fn)
		dst->exp_fn = strdup(src->exp_fn);

	if (src->exp_helper_name)
		dst->exp_helper_name = strdup(src->exp_helper_name);

	return 0;
}

static void dump_addr(struct nl_dump_params *p, struct nl_addr *addr, int port)
{
	char buf[64];

	if (addr)
		nl_dump(p, "%s", nl_addr2str(addr, buf, sizeof(buf)));

	if (port)
		nl_dump(p, ":%u ", port);
	else if (addr)
		nl_dump(p, " ");
}

static void dump_icmp(struct nl_dump_params *p, struct nfnl_exp *exp, int tuple)
{
	if (nfnl_exp_test_icmp(exp, tuple)) {

		nl_dump(p, "icmp type %d ", nfnl_exp_get_icmp_type(exp, tuple));

		nl_dump(p, "code %d ", nfnl_exp_get_icmp_code(exp, tuple));

		nl_dump(p, "id %d ", nfnl_exp_get_icmp_id(exp, tuple));
	}
}

static void exp_dump_tuples(struct nfnl_exp *exp, struct nl_dump_params *p)
{
	struct nl_addr *tuple_src, *tuple_dst;
	int tuple_sport, tuple_dport;
	int i = 0;
	char buf[64];

	for (i = NFNL_EXP_TUPLE_EXPECT; i < NFNL_EXP_TUPLE_MAX; i++) {
		tuple_src = NULL;
		tuple_dst = NULL;
		tuple_sport = 0;
		tuple_dport = 0;

		// Test needed for NAT case
		if (nfnl_exp_test_src(exp, i))
			tuple_src = nfnl_exp_get_src(exp, i);
		if (nfnl_exp_test_dst(exp, i))
			tuple_dst = nfnl_exp_get_dst(exp, i);

		// Don't have tests for individual ports/types/codes/ids,
		if (nfnl_exp_test_l4protonum(exp, i)) {
			nl_dump(p, "%s ",
				nl_ip_proto2str(nfnl_exp_get_l4protonum(exp, i), buf, sizeof(buf)));
		}

		if (nfnl_exp_test_ports(exp, i)) {
			tuple_sport = nfnl_exp_get_src_port(exp, i);
			tuple_dport = nfnl_exp_get_dst_port(exp, i);
		}

		dump_addr(p, tuple_src, tuple_sport);
		dump_addr(p, tuple_dst, tuple_dport);
		dump_icmp(p, exp, 0);
	}

	if (nfnl_exp_test_nat_dir(exp))
		nl_dump(p, "nat dir %u ", exp->exp_nat_dir);

}

/* FIXME Compatible with /proc/net/nf_conntrack */
static void exp_dump_line(struct nl_object *a, struct nl_dump_params *p)
{
	struct nfnl_exp *exp = (struct nfnl_exp *) a;

	nl_new_line(p);

	exp_dump_tuples(exp, p);

	nl_dump(p, "\n");
}

static void exp_dump_details(struct nl_object *a, struct nl_dump_params *p)
{
	struct nfnl_exp *exp = (struct nfnl_exp *) a;
	char buf[64];
	int fp = 0;

	exp_dump_line(a, p);

	nl_dump(p, "    id 0x%x ", exp->exp_id);
	nl_dump_line(p, "family %s ",
		nl_af2str(exp->exp_family, buf, sizeof(buf)));

	if (nfnl_exp_test_timeout(exp)) {
		uint64_t timeout_ms = nfnl_exp_get_timeout(exp) * 1000UL;
		nl_dump(p, "timeout %s ",
			nl_msec2str(timeout_ms, buf, sizeof(buf)));
	}

	if (nfnl_exp_test_helper_name(exp))
		nl_dump(p, "helper %s ", exp->exp_helper_name);

	if (nfnl_exp_test_fn(exp))
		nl_dump(p, "fn %s ", exp->exp_fn);

	if (nfnl_exp_test_class(exp))
		nl_dump(p, "class %u ", nfnl_exp_get_class(exp));

	if (nfnl_exp_test_zone(exp))
		nl_dump(p, "zone %u ", nfnl_exp_get_zone(exp));

	if (nfnl_exp_test_flags(exp))
		nl_dump(p, "<");
#define PRINT_FLAG(str) \
	{ nl_dump(p, "%s%s", fp++ ? "," : "", (str)); }

	if (exp->exp_flags & NF_CT_EXPECT_PERMANENT)
		PRINT_FLAG("PERMANENT");
	if (exp->exp_flags & NF_CT_EXPECT_INACTIVE)
		PRINT_FLAG("INACTIVE");
	if (exp->exp_flags & NF_CT_EXPECT_USERSPACE)
		PRINT_FLAG("USERSPACE");
#undef PRINT_FLAG

	if (nfnl_exp_test_flags(exp))
		nl_dump(p, ">");

	nl_dump(p, "\n");
}

static int exp_cmp_l4proto_ports (union nfnl_exp_protodata *a, union nfnl_exp_protodata *b) {
	// Must return 0 for match, 1 for mismatch
	int d = 0;
	d = ( (a->port.src != b->port.src) ||
	      (a->port.dst != b->port.dst) );

	return d;
}

static int exp_cmp_l4proto_icmp (union nfnl_exp_protodata *a, union nfnl_exp_protodata *b) {
	// Must return 0 for match, 1 for mismatch
	int d = 0;
	d = ( (a->icmp.code != b->icmp.code) ||
	      (a->icmp.type != b->icmp.type) ||
	      (a->icmp.id != b->icmp.id) );

	return d;
}

static uint64_t exp_compare(struct nl_object *_a, struct nl_object *_b,
			    uint64_t attrs, int flags)
{
	struct nfnl_exp *a = (struct nfnl_exp *) _a;
	struct nfnl_exp *b = (struct nfnl_exp *) _b;
	uint64_t diff = 0;

#define _DIFF(ATTR, EXPR) ATTR_DIFF(attrs, ATTR, a, b, EXPR)
#define _DIFF_VAL(ATTR, FIELD) _DIFF(ATTR, a->FIELD != b->FIELD)
#define _DIFF_STRING(ATTR, FIELD) _DIFF(ATTR, (strcmp(a->FIELD, b->FIELD) != 0))
#define _DIFF_ADDR(ATTR, FIELD)                                                \
	((flags & LOOSE_COMPARISON) ?                                          \
		 _DIFF(ATTR, nl_addr_cmp_prefix(a->FIELD, b->FIELD)) :         \
		 _DIFF(ATTR, nl_addr_cmp(a->FIELD, b->FIELD)))
#define _DIFF_L4PROTO_PORTS(ATTR, FIELD)                                       \
	_DIFF(ATTR, exp_cmp_l4proto_ports(&(a->FIELD), &(b->FIELD)))
#define _DIFF_L4PROTO_ICMP(ATTR, FIELD)                                        \
	_DIFF(ATTR, exp_cmp_l4proto_icmp(&(a->FIELD), &(b->FIELD)))
	diff |= _DIFF_VAL(EXP_ATTR_FAMILY, exp_family);
	diff |= _DIFF_VAL(EXP_ATTR_TIMEOUT, exp_timeout);
	diff |= _DIFF_VAL(EXP_ATTR_ID, exp_id);
	diff |= _DIFF_VAL(EXP_ATTR_ZONE, exp_zone);
	diff |= _DIFF_VAL(EXP_ATTR_CLASS, exp_class);
	diff |= _DIFF_VAL(EXP_ATTR_FLAGS, exp_flags);
	diff |= _DIFF_VAL(EXP_ATTR_NAT_DIR, exp_nat_dir);

	diff |= _DIFF_STRING(EXP_ATTR_FN, exp_fn);
	diff |= _DIFF_STRING(EXP_ATTR_HELPER_NAME, exp_helper_name);

	diff |= _DIFF_ADDR(EXP_ATTR_EXPECT_IP_SRC, exp_expect.src);
	diff |= _DIFF_ADDR(EXP_ATTR_EXPECT_IP_DST, exp_expect.dst);
	diff |= _DIFF_VAL(EXP_ATTR_EXPECT_L4PROTO_NUM,
			  exp_expect.proto.l4protonum);
	diff |= _DIFF_L4PROTO_PORTS(EXP_ATTR_EXPECT_L4PROTO_PORTS,
				    exp_expect.proto.l4protodata);
	diff |= _DIFF_L4PROTO_ICMP(EXP_ATTR_EXPECT_L4PROTO_ICMP,
				   exp_expect.proto.l4protodata);

	diff |= _DIFF_ADDR(EXP_ATTR_MASTER_IP_SRC, exp_master.src);
	diff |= _DIFF_ADDR(EXP_ATTR_MASTER_IP_DST, exp_master.dst);
	diff |= _DIFF_VAL(EXP_ATTR_MASTER_L4PROTO_NUM,
			  exp_master.proto.l4protonum);
	diff |= _DIFF_L4PROTO_PORTS(EXP_ATTR_MASTER_L4PROTO_PORTS,
				    exp_master.proto.l4protodata);
	diff |= _DIFF_L4PROTO_ICMP(EXP_ATTR_MASTER_L4PROTO_ICMP,
				   exp_master.proto.l4protodata);

	diff |= _DIFF_ADDR(EXP_ATTR_MASK_IP_SRC, exp_mask.src);
	diff |= _DIFF_ADDR(EXP_ATTR_MASK_IP_DST, exp_mask.dst);
	diff |= _DIFF_VAL(EXP_ATTR_MASK_L4PROTO_NUM, exp_mask.proto.l4protonum);
	diff |= _DIFF_L4PROTO_PORTS(EXP_ATTR_MASK_L4PROTO_PORTS,
				    exp_mask.proto.l4protodata);
	diff |= _DIFF_L4PROTO_ICMP(EXP_ATTR_MASK_L4PROTO_ICMP,
				   exp_mask.proto.l4protodata);

	diff |= _DIFF_ADDR(EXP_ATTR_NAT_IP_SRC, exp_nat.src);
	diff |= _DIFF_ADDR(EXP_ATTR_NAT_IP_DST, exp_nat.dst);
	diff |= _DIFF_VAL(EXP_ATTR_NAT_L4PROTO_NUM, exp_nat.proto.l4protonum);
	diff |= _DIFF_L4PROTO_PORTS(EXP_ATTR_NAT_L4PROTO_PORTS,
				    exp_nat.proto.l4protodata);
	diff |= _DIFF_L4PROTO_ICMP(EXP_ATTR_NAT_L4PROTO_ICMP,
				   exp_nat.proto.l4protodata);
#undef _DIFF
#undef _DIFF_VAL
#undef _DIFF_STRING
#undef _DIFF_ADDR
#undef _DIFF_L4PROTO_PORTS
#undef _DIFF_L4PROTO_ICMP

	return diff;
}

// CLI arguments?
static const struct trans_tbl exp_attrs[] = {
	__ADD(EXP_ATTR_FAMILY,				family),
	__ADD(EXP_ATTR_TIMEOUT,				timeout),
	__ADD(EXP_ATTR_ID,				id),
	__ADD(EXP_ATTR_HELPER_NAME,			helpername),
	__ADD(EXP_ATTR_ZONE,				zone),
	__ADD(EXP_ATTR_CLASS,				class),
	__ADD(EXP_ATTR_FLAGS,				flags),
	__ADD(EXP_ATTR_FN,				function),
	__ADD(EXP_ATTR_EXPECT_IP_SRC,			expectipsrc),
	__ADD(EXP_ATTR_EXPECT_IP_DST,			expectipdst),
	__ADD(EXP_ATTR_EXPECT_L4PROTO_NUM,		expectprotonum),
	__ADD(EXP_ATTR_EXPECT_L4PROTO_PORTS,		expectports),
	__ADD(EXP_ATTR_EXPECT_L4PROTO_ICMP,		expecticmp),
	__ADD(EXP_ATTR_MASTER_IP_SRC,			masteripsrc),
	__ADD(EXP_ATTR_MASTER_IP_DST,			masteripdst),
	__ADD(EXP_ATTR_MASTER_L4PROTO_NUM,		masterprotonum),
	__ADD(EXP_ATTR_MASTER_L4PROTO_PORTS,		masterports),
	__ADD(EXP_ATTR_MASTER_L4PROTO_ICMP,		mastericmp),
	__ADD(EXP_ATTR_MASK_IP_SRC,			maskipsrc),
	__ADD(EXP_ATTR_MASK_IP_DST,			maskipdst),
	__ADD(EXP_ATTR_MASK_L4PROTO_NUM,		maskprotonum),
	__ADD(EXP_ATTR_MASK_L4PROTO_PORTS,		maskports),
	__ADD(EXP_ATTR_MASK_L4PROTO_ICMP,		maskicmp),
	__ADD(EXP_ATTR_NAT_IP_SRC,			natipsrc),
	__ADD(EXP_ATTR_NAT_IP_DST,			natipdst),
	__ADD(EXP_ATTR_NAT_L4PROTO_NUM,			natprotonum),
	__ADD(EXP_ATTR_NAT_L4PROTO_PORTS,		natports),
	__ADD(EXP_ATTR_NAT_L4PROTO_ICMP,		naticmp),
	__ADD(EXP_ATTR_NAT_DIR,				natdir),
};

static char *exp_attrs2str(int attrs, char *buf, size_t len)
{
	return __flags2str(attrs, buf, len, exp_attrs, ARRAY_SIZE(exp_attrs));
}

/**
 * @name Allocation/Freeing
 * @{
 */

struct nfnl_exp *nfnl_exp_alloc(void)
{
	return (struct nfnl_exp *) nl_object_alloc(&exp_obj_ops);
}

void nfnl_exp_get(struct nfnl_exp *exp)
{
	nl_object_get((struct nl_object *) exp);
}

void nfnl_exp_put(struct nfnl_exp *exp)
{
	nl_object_put((struct nl_object *) exp);
}

/** @} */

/**
 * @name Attributes
 * @{
 */

void nfnl_exp_set_family(struct nfnl_exp *exp, uint8_t family)
{
	exp->exp_family = family;
	exp->ce_mask |= EXP_ATTR_FAMILY;
}

uint8_t nfnl_exp_get_family(const struct nfnl_exp *exp)
{
	if (exp->ce_mask & EXP_ATTR_FAMILY)
		return exp->exp_family;
	else
		return AF_UNSPEC;
}

void nfnl_exp_set_flags(struct nfnl_exp *exp, uint32_t flags)
{
	exp->exp_flags |= flags;
	exp->ce_mask |= EXP_ATTR_FLAGS;
}

int nfnl_exp_test_flags(const struct nfnl_exp *exp)
{
	return !!(exp->ce_mask & EXP_ATTR_FLAGS);
}

void nfnl_exp_unset_flags(struct nfnl_exp *exp, uint32_t flags)
{
	exp->exp_flags &= ~flags;
	exp->ce_mask |= EXP_ATTR_FLAGS;
}

uint32_t nfnl_exp_get_flags(const struct nfnl_exp *exp)
{
	return exp->exp_flags;
}

static const struct trans_tbl flag_table[] = {
	__ADD(IPS_EXPECTED, expected),
	__ADD(IPS_SEEN_REPLY, seen_reply),
	__ADD(IPS_ASSURED, assured),
};

char * nfnl_exp_flags2str(int flags, char *buf, size_t len)
{
	return __flags2str(flags, buf, len, flag_table,
			   ARRAY_SIZE(flag_table));
}

int nfnl_exp_str2flags(const char *name)
{
	return __str2flags(name, flag_table, ARRAY_SIZE(flag_table));
}

void nfnl_exp_set_timeout(struct nfnl_exp *exp, uint32_t timeout)
{
	exp->exp_timeout = timeout;
	exp->ce_mask |= EXP_ATTR_TIMEOUT;
}

int nfnl_exp_test_timeout(const struct nfnl_exp *exp)
{
	return !!(exp->ce_mask & EXP_ATTR_TIMEOUT);
}

uint32_t nfnl_exp_get_timeout(const struct nfnl_exp *exp)
{
	return exp->exp_timeout;
}

void nfnl_exp_set_id(struct nfnl_exp *exp, uint32_t id)
{
	exp->exp_id = id;
	exp->ce_mask |= EXP_ATTR_ID;
}

int nfnl_exp_test_id(const struct nfnl_exp *exp)
{
	return !!(exp->ce_mask & EXP_ATTR_ID);
}

uint32_t nfnl_exp_get_id(const struct nfnl_exp *exp)
{
	return exp->exp_id;
}

int nfnl_exp_set_helper_name(struct nfnl_exp *exp, void *name)
{
	free(exp->exp_helper_name);
	exp->exp_helper_name = strdup(name);
	if (!exp->exp_helper_name)
		return -NLE_NOMEM;

	exp->ce_mask |= EXP_ATTR_HELPER_NAME;
	return 0;
}

int  nfnl_exp_test_helper_name(const struct nfnl_exp *exp)
{
	return !!(exp->ce_mask & EXP_ATTR_HELPER_NAME);
}

const char * nfnl_exp_get_helper_name(const struct nfnl_exp *exp)
{
	return exp->exp_helper_name;
}

void nfnl_exp_set_zone(struct nfnl_exp *exp, uint16_t zone)
{
	exp->exp_zone = zone;
	exp->ce_mask |= EXP_ATTR_ZONE;
}

int nfnl_exp_test_zone(const struct nfnl_exp *exp)
{
	return !!(exp->ce_mask & EXP_ATTR_ZONE);
}

uint16_t nfnl_exp_get_zone(const struct nfnl_exp *exp)
{
	return exp->exp_zone;
}

void nfnl_exp_set_class(struct nfnl_exp *exp, uint32_t class)
{
	exp->exp_class = class;
	exp->ce_mask |= EXP_ATTR_CLASS;
}

int nfnl_exp_test_class(const struct nfnl_exp *exp)
{
	return !!(exp->ce_mask & EXP_ATTR_CLASS);
}

uint32_t nfnl_exp_get_class(const struct nfnl_exp *exp)
{
	return exp->exp_class;
}

int nfnl_exp_set_fn(struct nfnl_exp *exp, void *fn)
{
	free(exp->exp_fn);
	exp->exp_fn = strdup(fn);
	if (!exp->exp_fn)
		return -NLE_NOMEM;

	exp->ce_mask |= EXP_ATTR_FN;
	return 0;
}

int nfnl_exp_test_fn(const struct nfnl_exp *exp)
{
	return !!(exp->ce_mask & EXP_ATTR_FN);
}

const char * nfnl_exp_get_fn(const struct nfnl_exp *exp)
{
	return exp->exp_fn;
}

void nfnl_exp_set_nat_dir(struct nfnl_exp *exp, uint8_t nat_dir)
{
	exp->exp_nat_dir = nat_dir;
	exp->ce_mask |= EXP_ATTR_NAT_DIR;
}

int nfnl_exp_test_nat_dir(const struct nfnl_exp *exp)
{
	return !!(exp->ce_mask & EXP_ATTR_NAT_DIR);
}

uint8_t nfnl_exp_get_nat_dir(const struct nfnl_exp *exp)
{
	return exp->exp_nat_dir;
}

#define EXP_GET_TUPLE(e, t) \
	(t == NFNL_EXP_TUPLE_MASTER) ? \
		&(e->exp_master) : \
	(t == NFNL_EXP_TUPLE_MASK) ? \
		&(e->exp_mask) : \
	(t == NFNL_EXP_TUPLE_NAT) ? \
		&(e->exp_nat) : &(exp->exp_expect)

static int exp_get_src_attr(int tuple)
{
	int attr = 0;

	switch (tuple) {
		case NFNL_EXP_TUPLE_MASTER:
			attr = EXP_ATTR_MASTER_IP_SRC;
			break;
		case NFNL_EXP_TUPLE_MASK:
			attr = EXP_ATTR_MASK_IP_SRC;
			break;
		case NFNL_EXP_TUPLE_NAT:
			attr = EXP_ATTR_NAT_IP_SRC;
			break;
		case NFNL_EXP_TUPLE_EXPECT:
		default :
			attr = EXP_ATTR_EXPECT_IP_SRC;
	}

	return attr;
}

static int exp_get_dst_attr(int tuple)
{
	int attr = 0;

	switch (tuple) {
		case NFNL_EXP_TUPLE_MASTER:
			attr = EXP_ATTR_MASTER_IP_DST;
			break;
		case NFNL_EXP_TUPLE_MASK:
			attr = EXP_ATTR_MASK_IP_DST;
			break;
		case NFNL_EXP_TUPLE_NAT:
			attr = EXP_ATTR_NAT_IP_DST;
			break;
		case NFNL_EXP_TUPLE_EXPECT:
		default :
			attr = EXP_ATTR_EXPECT_IP_DST;
	}

	return attr;
}


static int exp_set_addr(struct nfnl_exp *exp, struct nl_addr *addr,
                          int attr, struct nl_addr ** exp_addr)
{
	if (exp->ce_mask & EXP_ATTR_FAMILY) {
		if (addr->a_family != exp->exp_family)
			return -NLE_AF_MISMATCH;
	} else
		nfnl_exp_set_family(exp, addr->a_family);

	if (*exp_addr)
		nl_addr_put(*exp_addr);

	nl_addr_get(addr);
	*exp_addr = addr;
	exp->ce_mask |= attr;

	return 0;
}

int nfnl_exp_set_src(struct nfnl_exp *exp, int tuple, struct nl_addr *addr)
{
	struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);

	return exp_set_addr(exp, addr, exp_get_src_attr(tuple), &dir->src);
}

int nfnl_exp_set_dst(struct nfnl_exp *exp, int tuple, struct nl_addr *addr)
{
	struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);

	return exp_set_addr(exp, addr, exp_get_dst_attr(tuple), &dir->dst);
}

int nfnl_exp_test_src(const struct nfnl_exp *exp, int tuple)
{
	return !!(exp->ce_mask & exp_get_src_attr(tuple));
}

int nfnl_exp_test_dst(const struct nfnl_exp *exp, int tuple)
{
	return !!(exp->ce_mask & exp_get_dst_attr(tuple));
}

struct nl_addr *nfnl_exp_get_src(const struct nfnl_exp *exp, int tuple)
{
	const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);

	if (!(exp->ce_mask & exp_get_src_attr(tuple)))
		return NULL;
	return dir->src;
}

struct nl_addr *nfnl_exp_get_dst(const struct nfnl_exp *exp, int tuple)
{
	const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);

	if (!(exp->ce_mask & exp_get_dst_attr(tuple)))
		return NULL;
	return dir->dst;
}

static int exp_get_l4protonum_attr(int tuple)
{
	int attr = 0;

	switch (tuple) {
		case NFNL_EXP_TUPLE_MASTER:
			attr = EXP_ATTR_MASTER_L4PROTO_NUM;
			break;
		case NFNL_EXP_TUPLE_MASK:
			attr = EXP_ATTR_MASK_L4PROTO_NUM;
			break;
		case NFNL_EXP_TUPLE_NAT:
			attr = EXP_ATTR_NAT_L4PROTO_NUM;
			break;
		case NFNL_EXP_TUPLE_EXPECT:
		default :
			attr = EXP_ATTR_EXPECT_L4PROTO_NUM;
	}

	return attr;
}

void nfnl_exp_set_l4protonum(struct nfnl_exp *exp, int tuple, uint8_t l4protonum)
{
	struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);

	dir->proto.l4protonum = l4protonum;
	exp->ce_mask |= exp_get_l4protonum_attr(tuple);
}

int nfnl_exp_test_l4protonum(const struct nfnl_exp *exp, int tuple)
{
	return !!(exp->ce_mask & exp_get_l4protonum_attr(tuple));
}

uint8_t nfnl_exp_get_l4protonum(const struct nfnl_exp *exp, int tuple)
{
	const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
	return dir->proto.l4protonum;
}

static int exp_get_l4ports_attr(int tuple)
{
	int attr = 0;

	switch (tuple) {
		case NFNL_EXP_TUPLE_MASTER:
			attr = EXP_ATTR_MASTER_L4PROTO_PORTS;
			break;
		case NFNL_EXP_TUPLE_MASK:
			attr = EXP_ATTR_MASK_L4PROTO_PORTS;
			break;
		case NFNL_EXP_TUPLE_NAT:
			attr = EXP_ATTR_NAT_L4PROTO_PORTS;
			break;
		case NFNL_EXP_TUPLE_EXPECT:
		default :
			attr = EXP_ATTR_EXPECT_L4PROTO_PORTS;
	}

	return attr;
}

void nfnl_exp_set_ports(struct nfnl_exp *exp, int tuple, uint16_t srcport, uint16_t dstport)
{
	struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);

	dir->proto.l4protodata.port.src = srcport;
	dir->proto.l4protodata.port.dst = dstport;

	exp->ce_mask |= exp_get_l4ports_attr(tuple);
}

int nfnl_exp_test_ports(const struct nfnl_exp *exp, int tuple)
{
	return !!(exp->ce_mask & exp_get_l4ports_attr(tuple));
}

uint16_t nfnl_exp_get_src_port(const struct nfnl_exp *exp, int tuple)
{
	const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
	return dir->proto.l4protodata.port.src;
}

uint16_t nfnl_exp_get_dst_port(const struct nfnl_exp *exp, int tuple)
{
	const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);

	return dir->proto.l4protodata.port.dst;
}

static int exp_get_l4icmp_attr(int tuple)
{
	int attr = 0;

	switch (tuple) {
		case NFNL_EXP_TUPLE_MASTER:
			attr = EXP_ATTR_MASTER_L4PROTO_ICMP;
			break;
		case NFNL_EXP_TUPLE_MASK:
			attr = EXP_ATTR_MASK_L4PROTO_ICMP;
			break;
		case NFNL_EXP_TUPLE_NAT:
			attr = EXP_ATTR_NAT_L4PROTO_ICMP;
			break;
		case NFNL_EXP_TUPLE_EXPECT:
		default :
			attr = EXP_ATTR_EXPECT_L4PROTO_ICMP;
	}

	return attr;
}

void nfnl_exp_set_icmp(struct nfnl_exp *exp, int tuple, uint16_t id, uint8_t type, uint8_t code)
{
	struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);

	dir->proto.l4protodata.icmp.id = id;
	dir->proto.l4protodata.icmp.type = type;
	dir->proto.l4protodata.icmp.code = code;

	exp->ce_mask |= exp_get_l4icmp_attr(tuple);
}

int nfnl_exp_test_icmp(const struct nfnl_exp *exp, int tuple)
{
	int attr = exp_get_l4icmp_attr(tuple);
	return !!(exp->ce_mask & attr);
}

uint16_t nfnl_exp_get_icmp_id(const struct nfnl_exp *exp, int tuple)
{
	const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);

	return dir->proto.l4protodata.icmp.id;
}

uint8_t nfnl_exp_get_icmp_type(const struct nfnl_exp *exp, int tuple)
{
	const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);

	return dir->proto.l4protodata.icmp.type;
}

uint8_t nfnl_exp_get_icmp_code(const struct nfnl_exp *exp, int tuple)
{
	const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);

	return dir->proto.l4protodata.icmp.code;
}

/** @} */

struct nl_object_ops exp_obj_ops = {
	.oo_name	= "netfilter/exp",
	.oo_size	= sizeof(struct nfnl_exp),
	.oo_free_data   = exp_free_data,
	.oo_clone	= exp_clone,
	.oo_dump = {
		[NL_DUMP_LINE]		= exp_dump_line,
		[NL_DUMP_DETAILS]	= exp_dump_details,
	},
	.oo_compare	= exp_compare,
	.oo_attrs2str	= exp_attrs2str,
};

/** @} */