SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

firewall-util: unify nft_message_append_setelem_iprange() and _ip6range()

Browse Source
This commit is contained in:
Yu Watanabe
2026-09-23 13:53:23 +09:00
parent 4ad65ce2f3
commit 5594d06b56
1 changed files with 10 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/shared/firewall-util.c
+10 -46
View File
@@ -822,45 +822,7 @@ int fw_nftables_del_table(sd_netlink *nfnl, int family) {
static int nft_message_append_setelem_iprange(
sd_netlink_message *m,
const union in_addr_union *source,
unsigned prefixlen) {
uint32_t mask, start, end;
unsigned nplen;
int r;
assert(m);
assert(source);
assert(prefixlen <= 32);
nplen = 32 - prefixlen;
mask = (1U << nplen) - 1U;
mask = htobe32(~mask);
start = source->in.s_addr & mask;
r = sd_netlink_message_open_container(m, NFTA_SET_ELEM_LIST_ELEMENTS);
if (r < 0)
return r;
r = sd_nfnl_nft_message_append_setelem(m, 0, &start, sizeof(start), NULL, 0, 0);
if (r < 0)
return r;
end = be32toh(start) + (1U << nplen);
if (end < be32toh(start))
end = 0U;
end = htobe32(end);
r = sd_nfnl_nft_message_append_setelem(m, 1, &end, sizeof(end), NULL, 0, NFT_SET_ELEM_INTERVAL_END);
if (r < 0)
return r;
return sd_netlink_message_close_container(m); /* NFTA_SET_ELEM_LIST_ELEMENTS */
}
static int nft_message_append_setelem_ip6range(
sd_netlink_message *m,
int af,
const union in_addr_union *source,
unsigned prefixlen) {
@@ -868,9 +830,10 @@ static int nft_message_append_setelem_ip6range(
int r;
assert(m);
assert(IN_SET(af, AF_INET, AF_INET6));
assert(source);
r = in_addr_prefix_range(AF_INET6, source, prefixlen, &start, &end);
r = in_addr_prefix_range(af, source, prefixlen, &start, &end);
if (r < 0)
return r;
@@ -878,11 +841,15 @@ static int nft_message_append_setelem_ip6range(
if (r < 0)
return r;
r = sd_nfnl_nft_message_append_setelem(m, 0, &start.in6, sizeof(start.in6), NULL, 0, 0);
r = sd_nfnl_nft_message_append_setelem(
m, /* index= */ 0, &start, FAMILY_ADDRESS_SIZE(af),
/* data= */ NULL, /* data_len= */ 0, /* flags= */ 0);
if (r < 0)
return r;
r = sd_nfnl_nft_message_append_setelem(m, 1, &end.in6, sizeof(end.in6), NULL, 0, NFT_SET_ELEM_INTERVAL_END);
r = sd_nfnl_nft_message_append_setelem(
m, /* index= */ 1, &end, FAMILY_ADDRESS_SIZE(af),
/* data= */ NULL, /* data_len= */ 0, NFT_SET_ELEM_INTERVAL_END);
if (r < 0)
return r;
@@ -918,10 +885,7 @@ int nft_set_element_modify_iprange(
if (r < 0)
return r;
if (af == AF_INET)
r = nft_message_append_setelem_iprange(m, source, source_prefixlen);
else
r = nft_message_append_setelem_ip6range(m, source, source_prefixlen);
r = nft_message_append_setelem_iprange(m, af, source, source_prefixlen);
if (r < 0)
return r;