This patch adds support for the following bridge port flags:
IFLA_BRPORT_UNICAST_FLOOD
IFLA_BRPORT_LEARNING
IFLA_BRPORT_LEARNING_SYNC
Signed-off-by: Jef Oliver <jef.oliver@intel.com>
Signed-off-by: Thomas Haller <thaller@redhat.com>
This patch adds translation functions for translating the port
state between integers and strings.
Signed-off-by: Jef Oliver <jef.oliver@intel.com>
Signed-off-by: Thomas Haller <thaller@redhat.com>
The ID attributes for IPv4 addresses were broken which causes wrong
nl_object_identical() and cache lookup.
This capability shall indicate that the bug was fixed.
Signed-off-by: Thomas Haller <thaller@redhat.com>
Teach static code analyzers (such as Clang static analyzer) that code
following nl_cli_fatal can never be executed. Avoids false positives
such as detecting use of NULL pointers when that cannot happen.
Signed-off-by: Peter Wu <peter@lekensteyn.nl>
Signed-off-by: Thomas Haller <thaller@redhat.com>
The previous API of xfrmnl_sa_get_*_params() would always require
a @key buffer, but it was not possible to avoid buffer overflow
because the required size was unknown.
That is not really fixable, because the old API is broken.
Now, allow omitting the @key argument to only request the @key_size.
That allows the caller to ask beforehand how large the @key buffer
must be: ((@key_size + 7) / 8).
Unfortunately, omitting the key against previous versions of libnl
leads to a crash. And passing a key against older versions makes it
impossible to avoid buffer-overflow.
Another option would be to add functions like
xfrmnl_sa_get_crypto_params_keylen() so the user can query the required
buffer size by calling that instead of xfrmnl_sa_get_crypto_params().
However, then the user also requires a backport of the new API
and this will not be possible against older libnl3 versions either.
Thus, if the user already requires the fix, he can just as well
require a backport of this patch and then safely call xfrmnl_sa_get_crypto_params()
without @key argument. This way has the advantage/disadvantage, that
it can detect the presence of the patch at runtime.
The cumbersome way to get it right would be:
unsiged key_len;
char *key;
int r;
if (!nl_has_capability(17 /*NL_CAPABILITY_XFRM_SA_KEY_SIZE*/)) {
/* no way to use this API safely. Abort. */
return -NLE_OPNOTSUPP;
}
r = xfrmnl_sa_get_crypto_params(sa, NULL, &key_len, NULL);
if (r < 0)
return r;
key = malloc((key_len + 7) / 8);
if (!key)
return -NLE_NOMEM;
r = xfrmnl_sa_get_crypto_params(sa, NULL, &key_len, &key);
if (r < 0) {
free(key);
return r;
}
...
http://lists.infradead.org/pipermail/libnl/2016-June/002155.html
Signed-off-by: Thomas Haller <thaller@redhat.com>
Netlink attribute length is defined as u16. It's possible to exceed nla_len when
creating nested attributes. Storing incorrect length due to overflow will cause
a reader to read only a part of nested attribute or skip it entirely.
As a solution cancel the addition of a nested attribute when nla_len size is
exceeded.
Signed-off-by: Przemyslaw Szczerbik <przemek.szczerbik@gmail.com>
Signed-off-by: Thomas Haller <thaller@redhat.com>
http://lists.infradead.org/pipermail/libnl/2016-May/002131.html
The rtnl_neigh_get() function can not be used to look up a fdb entry in the
neigh cache. This is due to that the function searches among destination
addresses (NDA_DST) and not among link layer addresses (NDA_LLADDR), which is
used by fdb entries. A fdb entry can also exist in several vlans, so a vlan id
parameter is also needed to find a unique entry.
This commit adds a function, rtnl_neigh_get_by_vlan() which searches the neigh
cache for a specific neighbour (fdb) entry by interface index, link layer
address and vlan id.
Signed-off-by: Jonas Johansson <jonas.johansson@westermo.se>
Signed-off-by: Thomas Haller <thaller@redhat.com>
http://lists.infradead.org/pipermail/libnl/2016-May/002124.htmlhttps://github.com/thom311/libnl/pull/98
lib/route/link.c already defines 32 attributes which fills the current
uint32_t used for ce_mask. To accommodate more attributes the mask needs
to be expanded. This patch updates the definition to uint64_t.
The nl_object_diff API is maintained for ABI with existing users. A new
nl_object_diff64 API is added for the expanded attribute list. The MSB
of the 32-bit API is used to indicate if higher order attributes had a
mismatch. (Suggested by Thomas).
Note that LINK_ATTR_LINK_NETNSID changes. But since the attribute flags
are not public API it shouldn't be a problem.
http://lists.infradead.org/pipermail/libnl/2015-December/002078.htmlhttp://lists.infradead.org/pipermail/libnl/2015-December/002083.html
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: Thomas Haller <thaller@redhat.com>
Add operation for requesting VLAN data for AF_BRIDGE and parsing of
IFLA_AF_SPEC for AF_BRIDGE. VLANs are saved in a bitmap.
Also add dumping of vlan info to link list and neigh list.
For example:
$ nl-link-list --details --family=bridge
br1 ether 8e:6e:0e:86:e5:86 master br1 <broadcast,multicast,up,running,lowerup>
mtu 1500 txqlen 0 weight 0 index 18
mode default carrier down
bridge: pvid 1 all vlans: 1 301-400 601-610 untagged vlans: 1
bond1 ether 46:ef:e1:c9:46:fe <broadcast,multicast,master>
mtu 1500 txqlen 0 weight 0 index 20
state down mode default carrier down
bridge:
Signed-off-by: Wilson Kok <wkok@cumulusnetworks.com>
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
[thaller@redhat.com: modified original patch to use ao_parse_af_full().
Also renaming new API and drop some #defines]
Signed-off-by: Thomas Haller <thaller@redhat.com>
Both link and neighbor cache support specify multiple groups (nl_af_group),
but the alloc_cache functions for both do not set the NL_CACHE_AF_ITER
flag before populating the cache so only the first group is used by
default. This patch adds an API to pass in flags to make that happen
and updates the nl-neigh-list command to make use of it.
http://lists.infradead.org/pipermail/libnl/2015-October/001996.html
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: Thomas Haller <thaller@redhat.com>
An entry of the ingress map can be cleared by setting
the "to" part to zero.
Previously, vlan_put_attrs() would skip over zero "to"
and thus the user cannot unset an ingress map entry.
Add a modified-mask to record the state of each ingress
map entry and also sent explicit zeros to kernel.
when we receive a IFLA_VLAN_INGRESS_QOS message from kernel,
vlan_parse() similarly sets the received entries as modified.
This preserves previous behavior when using a received object
to modify a vlan.
Add a capability NL_CAPABILITY_RTNL_LINK_VLAN_INGRESS_MAP_CLEAR
to indicate the behavioral change.
Signed-off-by: Thomas Haller <thaller@redhat.com>
Commit 7bb956501c added nla functions for
s32. We preferibly add all signed integer operations at the same time.
Thus, also add s8, s16, and s64.
Also, previously the NLA_TYPE_MAX enum was not extended to have
NLA_S32. Fix that too.
Reported-By: Jiri Pirko <jiri@resnulli.us>
Fixes: 7bb956501c
Signed-off-by: Thomas Haller <thaller@redhat.com>
The ifi_change field can be set with the mask of the flags that need
to be changed as part of the link message to the kernel. This means only
the specific flags that have been changed will be modified in the kernel,
rather than the entire flags entry.
[thaller@redhat.com: add capability to indicate the change in behavior]
https://github.com/thom311/libnl/pull/86
If recvmsg indicates that the message read was truncated libnl retries
to read the complete message after increasing the message buffer. This
only works if the message flags MSG_PEEK | MSG_TRUNC are set. If
NL_MSG_PEEK is not enabled on the nl_sock structure, flags are left
empty and the rest of the truncated message is discarded, hence a
subsequent recvmsg returns the next message (in case of a multipart
message, the NLMSG_DONE) is read and returned.
This patch aborts message processing if the message was truncated and
the NL_MSG_PEEK flags was not activated for the nl_sock structure.
http://lists.infradead.org/pipermail/libnl/2015-June/001888.html
[thaller@redhat.com: add NL_CAPABILITY_NL_RECV_FAIL_TRUNK_NO_PEEK]
Signed-off-by: Thomas Egerer <hakke_007@gmx.de>
Signed-off-by: Thomas Haller <thaller@redhat.com>
Also reserve a range of capabilities (0x7000 to 0x7FFF) that we won't
use upstream. Add a macro NL_CAPABILITY_IS_USER_RESERVED() to check
if the capability is in that range.
Signed-off-by: Thomas Haller <thaller@redhat.com>
Including linux/if.h in netlink/route/link.h causes issues
in cases where libnl is used in conjuntion with other third
party libraries that include net/if.h. Seems to be a long
checkered history of symbol collisions between these two
files. As it turns out, including linux/if.h from within
netlink/route/link.h is actually unecessary. I resurrected
a forgotten path from this thread:
http://lists.infradead.org/pipermail/libnl/2012-April/000525.html
By removing the include as the patch suggests we can get
around the nuissance of the symbol collisions.
https://github.com/thom311/libnl/pull/73
Signed-off-by: Thomas Haller <thaller@redhat.com>
This is based on the patch by sagil@infinidat.com, but heavily modified.
Add a function nl_socket_set_fd(), I renamed it from nl_connect_fd().
Now nl_connect() and nl_socket_set_fd() are implemented independently as
they share little code. But they have similar functionality:
to initialize a libnl socket and set it's file descriptor.
A user who wants libnl to setup the socket can continue to use nl_connect().
A user with special requirements should setup the socket entirely. That includes
calling socket() (with or without SOCK_CLOEXEC), bind(), setting buffer size.
For the same reason I dropped nl_create_fd(). It didn't do much more then
calling socket() -- which the user can do directly.
https://github.com/thom311/libnl/pull/68
Signed-off-by: Thomas Haller <thaller@redhat.com>
- Added option to create socket (fd) without bind.
It is now possible to forward the socket fd to another child process...
...later use nl_connect_fd() to connect to socket from the child process.
- Added option to disable CLOEXEC even if defined (in socket.h)
'nl_socket_enable_cloexec' & 'nl_socket_disable_cloexec'
No change to current default behavior.
Signed-off-by: Sagi Lowenhardt <sagil@infinidat.com>
This patch changes the signatures of some functions to allow const pointers in
places where a const qualified pointer is enough access for what the function
does (e.g. nla_get_u8). It also changes some functions that take a pointer
parameter and return a pointer derived from it to use the strchr idiom.
This is not exhaustive in terms of places where const can be added, but it's
a decent chunk that should not make the external api any more restrictive.
http://lists.infradead.org/pipermail/libnl/2015-February/001826.html
Signed-off-by: Rohan Joyce <rojoyce.github@gmail.com>
Signed-off-by: Thomas Haller <thaller@redhat.com>
[thaller@redhat.com: add symbols to libnl-route-3.sym]
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Thomas Haller <thaller@redhat.com>
[thaller@redhat.com: changed whitespace and libnl-route.sym]
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Thomas Haller <thaller@redhat.com>
Jef Oliver