This patch adds the ability to override nesting into an AF specific
attribute. An example of this is the bridge module.
Regular Nesting:
[IFLA_AF_SPEC]
[AF_INET]
[AF_INET_ATTRS]
Bridge Nesting:
[IFLA_AF_SPEC]
[AF_BRIDGE_ATTRS]
This patch adds ao_fill_af_no_nest to struct rtnl_link_af_ops.
When set to non-zero, this will override the nested AF attribute
and allow nesting of attributes directly into IFLA_AF_SPEC.
Signed-off-by: Jef Oliver <jef.oliver@intel.com>
Signed-off-by: Thomas Haller <thaller@redhat.com>
This patch adds support for the following bridge port flags:
IFLA_BRPORT_UNICAST_FLOOD
IFLA_BRPORT_LEARNING
IFLA_BRPORT_LEARNING_SYNC
Signed-off-by: Jef Oliver <jef.oliver@intel.com>
Signed-off-by: Thomas Haller <thaller@redhat.com>
This patch adds translation functions for translating the port
state between integers and strings.
Signed-off-by: Jef Oliver <jef.oliver@intel.com>
Signed-off-by: Thomas Haller <thaller@redhat.com>
Update copy of kernel header 'if_macsec.h' to Linux 4.8-rc5, so that
upstream commit 2ccbe2cb79f2f74ab739252299b6f9ff27586f2c ("macsec: limit
ICV length to 16 octets") is included. Return -NLE_INVAL when trying to
configure an ICV length greater than 16 octets.
Signed-off-by: Davide Caratti <davide.caratti@gmail.com>
This patch adds the functionality to set IFLA_PROTINFO in a
request. This allows for appending protocol specific information
to a request message.
This patch adds ao_fill_pi to the rtnl_link_af_ops structure. This
registers a function to fill the IFLA_PROTINFO attribute. This
function follows the makeup of ao_fill_af.
This patch adds ao_fill_pi_flags to the rtnl_link_af_ops
structure. This registers an extra flag that can be bitmasked
onto the IFLA_PROTINFO definition. This is useful for address
families that require NLA_F_NESTED.
This patch adds a function named af_fill_pi, which is called by
build_link_msg. This function calls the registered function
pointers for an address family to fill IFLA_PROTINFO and to
bitmask any extra flags.
Signed-off-by: Jef Oliver <jef.oliver@intel.com>
Signed-off-by: Thomas Haller <thaller@redhat.com>
When rtnl_link_build_change_request() builds a change request,
it sets the message type to RTM_NEWLINK by default. If the
request fails, it changes the type to RTM_SETLINK, and resubmits.
For some address families, this will result in a requested change
never being applied by the kernel. An exmaple of this is the Linux
bridge. When a netlink message of type RTM_NEWLINK is recieved,
rather than failing, it simply ignores the message and does not
return a failure.
To fix this, this patch implements an override for address
families that require it. The override can be set when an address
family registers itself in libnl.
This patch adds ao_override_rtm to the rtnl_link_af_ops structure.
This patch adds a static function named af_request_type.
This patch modifies rtnl_link_build_change_request to call
af_request_type to properly set the request type if an address
family wishes to override.
Signed-off-by: Jef Oliver <jef.oliver@intel.com>
Signed-off-by: Thomas Haller <thaller@redhat.com>
The __kernel_sa_family_t type is not present on older systems (e.g.,
RHEL 6), and libnl3 will not built without it. Copy
/usr/include/linux/socket.h from a RHEL7 system to
include/linux-private/linux/socket.h so that it will be found by the
build system.
Fortunately, this socket.h is small and self-contained; it contains
very little (and does not #include any other files) beyond necessary
type.
https://github.com/thom311/libnl/pull/107
Signed-off-by: Jeff Squyres <jsquyres@cisco.com>
Signed-off-by: Thomas Haller <thaller@redhat.com>
libnl currently uses strerror_r() throughout, but this is
problematic because there is a non-standard GNU version
implemented in glibc, and the standard POSIX version, which
differ in signature. When using glibc, one can choose
between the two versions using feature test macros
_GNU_SOURCE and _POSIX_C_SOURCE.
Given libnl is built using the former, we always get the
glibc special version, and all code so far has been written
for that non-standard version.
Other C libraries like musl on the other hand only try
to be posix compliant, and only ever provide the posix
version of strerror_r(), which has a different signature.
The alternative is to use strerror_l() rather than
strerror_r() http://austingroupbugs.net/view.php?id=655
- this will avoid the non-confirming versions issue
- strerror_l() is now recommended by POSIX to replace
strerror_r() usage
So rather than changing all uses of strerror_r() to be in
line with posix, we are going to switch to the recommended
interface strerror_l().
Since strerror_l() is slightly more difficuly to use, we
add a little (private) wrapper that we can use from all
current callsites of strerror_r().
Signed-off-by: André Draszik <adraszik@tycoint.com>
Reviewed-by: Stephane Ayotte <sayotte@tycoint.com>
Signed-off-by: Thomas Haller <thaller@redhat.com>
The ID attributes for IPv4 addresses were broken which causes wrong
nl_object_identical() and cache lookup.
This capability shall indicate that the bug was fixed.
Signed-off-by: Thomas Haller <thaller@redhat.com>
Teach static code analyzers (such as Clang static analyzer) that code
following nl_cli_fatal can never be executed. Avoids false positives
such as detecting use of NULL pointers when that cannot happen.
Signed-off-by: Peter Wu <peter@lekensteyn.nl>
Signed-off-by: Thomas Haller <thaller@redhat.com>
For AF_INET/IPv4 addresses, the ID equality comparison must include
the net-part of the peer address:
unshare -n
ip link add T type dummy
ip link set T up
ip addr add 192.168.5.10/24 dev T
ip addr add 192.168.5.10 peer 192.168.6.1/24 dev T
ip addr add 192.168.5.10 peer 192.168.7.1/24 dev T
ip addr add 192.168.5.10 peer 192.168.7.2/24 dev T
# RTNETLINK answers: File exists
ip addr change 192.168.5.10 peer 192.168.7.2/24 dev T
ip addr show | grep 192.168.7.
# inet 192.168.5.10 peer 192.168.7.1/24 scope global T
For AF_INET6/IPv6 addresses, the prefix length of the address
is not part of the ID:
unshare -n
ip link add T type dummy
ip link set T up
ip addr add 192.168.7.10/24 dev T
ip addr add 192.168.7.10/23 dev T
ip addr add 1:2:3:4:5::1/64 dev T
ip addr add 1:2:3:4:5::1/63 dev T
# RTNETLINK answers: File exists
ip addr change 1:2:3:4:5::1/63 dev T
ip addr show | grep 1:2:3:4:5::1
# inet6 1:2:3:4:5::1/64 scope global
*sigh*
http://lists.infradead.org/pipermail/libnl/2016-June/002158.html
Signed-off-by: Thomas Haller <thaller@redhat.com>
The previous API of xfrmnl_sa_get_*_params() would always require
a @key buffer, but it was not possible to avoid buffer overflow
because the required size was unknown.
That is not really fixable, because the old API is broken.
Now, allow omitting the @key argument to only request the @key_size.
That allows the caller to ask beforehand how large the @key buffer
must be: ((@key_size + 7) / 8).
Unfortunately, omitting the key against previous versions of libnl
leads to a crash. And passing a key against older versions makes it
impossible to avoid buffer-overflow.
Another option would be to add functions like
xfrmnl_sa_get_crypto_params_keylen() so the user can query the required
buffer size by calling that instead of xfrmnl_sa_get_crypto_params().
However, then the user also requires a backport of the new API
and this will not be possible against older libnl3 versions either.
Thus, if the user already requires the fix, he can just as well
require a backport of this patch and then safely call xfrmnl_sa_get_crypto_params()
without @key argument. This way has the advantage/disadvantage, that
it can detect the presence of the patch at runtime.
The cumbersome way to get it right would be:
unsiged key_len;
char *key;
int r;
if (!nl_has_capability(17 /*NL_CAPABILITY_XFRM_SA_KEY_SIZE*/)) {
/* no way to use this API safely. Abort. */
return -NLE_OPNOTSUPP;
}
r = xfrmnl_sa_get_crypto_params(sa, NULL, &key_len, NULL);
if (r < 0)
return r;
key = malloc((key_len + 7) / 8);
if (!key)
return -NLE_NOMEM;
r = xfrmnl_sa_get_crypto_params(sa, NULL, &key_len, &key);
if (r < 0) {
free(key);
return r;
}
...
http://lists.infradead.org/pipermail/libnl/2016-June/002155.html
Signed-off-by: Thomas Haller <thaller@redhat.com>
Currently rtnl_link_info_data_compare doesn't pass
flags (LOOSE_COMPARISON) to the ->io_compare op, so we cannot do a match
on only the attributes that are actually set in the filter object used
in a cache lookup via nl_cache_find().
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Thomas Haller <thaller@redhat.com>
Netlink attribute length is defined as u16. It's possible to exceed nla_len when
creating nested attributes. Storing incorrect length due to overflow will cause
a reader to read only a part of nested attribute or skip it entirely.
As a solution cancel the addition of a nested attribute when nla_len size is
exceeded.
Signed-off-by: Przemyslaw Szczerbik <przemek.szczerbik@gmail.com>
Signed-off-by: Thomas Haller <thaller@redhat.com>
http://lists.infradead.org/pipermail/libnl/2016-May/002131.html
Instead of setting it twice, once during link_request_update() and
later in bridge_get_af(), pass ext_filter_mask to ao_get_af().
Signed-off-by: Thomas Haller <thaller@redhat.com>
The rtnl_neigh_get() function can not be used to look up a fdb entry in the
neigh cache. This is due to that the function searches among destination
addresses (NDA_DST) and not among link layer addresses (NDA_LLADDR), which is
used by fdb entries. A fdb entry can also exist in several vlans, so a vlan id
parameter is also needed to find a unique entry.
This commit adds a function, rtnl_neigh_get_by_vlan() which searches the neigh
cache for a specific neighbour (fdb) entry by interface index, link layer
address and vlan id.
Signed-off-by: Jonas Johansson <jonas.johansson@westermo.se>
Signed-off-by: Thomas Haller <thaller@redhat.com>
http://lists.infradead.org/pipermail/libnl/2016-May/002124.htmlhttps://github.com/thom311/libnl/pull/98
lib/route/link.c already defines 32 attributes which fills the current
uint32_t used for ce_mask. To accommodate more attributes the mask needs
to be expanded. This patch updates the definition to uint64_t.
The nl_object_diff API is maintained for ABI with existing users. A new
nl_object_diff64 API is added for the expanded attribute list. The MSB
of the 32-bit API is used to indicate if higher order attributes had a
mismatch. (Suggested by Thomas).
Note that LINK_ATTR_LINK_NETNSID changes. But since the attribute flags
are not public API it shouldn't be a problem.
http://lists.infradead.org/pipermail/libnl/2015-December/002078.htmlhttp://lists.infradead.org/pipermail/libnl/2015-December/002083.html
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: Thomas Haller <thaller@redhat.com>
Add operation for requesting VLAN data for AF_BRIDGE and parsing of
IFLA_AF_SPEC for AF_BRIDGE. VLANs are saved in a bitmap.
Also add dumping of vlan info to link list and neigh list.
For example:
$ nl-link-list --details --family=bridge
br1 ether 8e:6e:0e:86:e5:86 master br1 <broadcast,multicast,up,running,lowerup>
mtu 1500 txqlen 0 weight 0 index 18
mode default carrier down
bridge: pvid 1 all vlans: 1 301-400 601-610 untagged vlans: 1
bond1 ether 46:ef:e1:c9:46:fe <broadcast,multicast,master>
mtu 1500 txqlen 0 weight 0 index 20
state down mode default carrier down
bridge:
Signed-off-by: Wilson Kok <wkok@cumulusnetworks.com>
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
[thaller@redhat.com: modified original patch to use ao_parse_af_full().
Also renaming new API and drop some #defines]
Signed-off-by: Thomas Haller <thaller@redhat.com>
The encoding of the IFLA_AF_SPEC attribute varies depending on the family
used for the request (RTM_GETLINK) message. For AF_UNSPEC the encoding
has another level of nesting for each address family with the type encoded
first. i.e.,
af_spec = nla_nest_start(skb, IFLA_AF_SPEC)
for each family:
af = nla_nest_start(skb, af_ops->family)
af_ops->fill_link_af(skb, dev, ext_filter_mask)
nest_end
nest_end
This allows the parser to find the address family by looking at the first
type.
Whereas AF_BRIDGE encoding is just:
af_spec = nla_nest_start(skb, IFLA_AF_SPEC)
br_fill_ifvlaninfo{_compressed}(skb, vg)
nest_end
which means the parser can not use the attribute itself to know the family
to which the attribute belongs.
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
[thaller@redhat.com: refactor code by merging a later patch by
tobias.jungel@bisdn.de and introduce new function ao_parse_af_full()]
Signed-off-by: Thomas Haller <thaller@redhat.com>
Upcoming bridge patch wants to add IFLA_EXT_MASK attribute to RTM_GETLINK
requests to retrieve VLAN data. Expand request message to a full ifinfomsg
header and call to hook to append attributes if it exists for an address
family.
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
[thaller@redhat.com: fix memleak in link_request_update()]
Signed-off-by: Thomas Haller <thaller@redhat.com>
Some link types incorrectly dump their own interface name as parent
link; fix this.
Signed-off-by: Beniamino Galvani <bgalvani@redhat.com>
Signed-off-by: Thomas Haller <thaller@redhat.com>
Both link and neighbor cache support specify multiple groups (nl_af_group),
but the alloc_cache functions for both do not set the NL_CACHE_AF_ITER
flag before populating the cache so only the first group is used by
default. This patch adds an API to pass in flags to make that happen
and updates the nl-neigh-list command to make use of it.
http://lists.infradead.org/pipermail/libnl/2015-October/001996.html
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: Thomas Haller <thaller@redhat.com>
An entry of the ingress map can be cleared by setting
the "to" part to zero.
Previously, vlan_put_attrs() would skip over zero "to"
and thus the user cannot unset an ingress map entry.
Add a modified-mask to record the state of each ingress
map entry and also sent explicit zeros to kernel.
when we receive a IFLA_VLAN_INGRESS_QOS message from kernel,
vlan_parse() similarly sets the received entries as modified.
This preserves previous behavior when using a received object
to modify a vlan.
Add a capability NL_CAPABILITY_RTNL_LINK_VLAN_INGRESS_MAP_CLEAR
to indicate the behavioral change.
Signed-off-by: Thomas Haller <thaller@redhat.com>
Commit 7bb956501c added nla functions for
s32. We preferibly add all signed integer operations at the same time.
Thus, also add s8, s16, and s64.
Also, previously the NLA_TYPE_MAX enum was not extended to have
NLA_S32. Fix that too.
Reported-By: Jiri Pirko <jiri@resnulli.us>
Fixes: 7bb956501c
Signed-off-by: Thomas Haller <thaller@redhat.com>
Jef Oliver