mirror of
https://github.com/moby/moby.git
synced 2026-01-11 18:51:37 +00:00
79 lines
2.0 KiB
Go
79 lines
2.0 KiB
Go
//go:build cgo && !static_build
|
|
|
|
package nftables
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
"unsafe"
|
|
|
|
"github.com/containerd/log"
|
|
"go.opentelemetry.io/otel"
|
|
)
|
|
|
|
// #cgo pkg-config: libnftables
|
|
// #cgo nocallback nft_run_cmd_from_buffer
|
|
// #cgo nocallback nft_ctx_get_output_buffer
|
|
// #cgo nocallback nft_ctx_get_error_buffer
|
|
// #include <stdlib.h>
|
|
// #include <nftables/libnftables.h>
|
|
import "C"
|
|
|
|
type nftHandle = *C.struct_nft_ctx
|
|
|
|
// nftApply calls libnftables to execute the nftables commands in nftCmd.
|
|
// Acquire t.applyLock before calling this function.
|
|
func (t *table) nftApply(ctx context.Context, nftCmd []byte) error {
|
|
ctx, span := otel.Tracer("").Start(ctx, spanPrefix+".nftApply.cgo")
|
|
defer span.End()
|
|
|
|
if t.nftHandle == nil {
|
|
handle, err := newNftHandle()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
t.nftHandle = handle
|
|
}
|
|
|
|
cCmd := C.CString(string(nftCmd))
|
|
defer C.free(unsafe.Pointer(cCmd))
|
|
|
|
ret := C.nft_run_cmd_from_buffer(t.nftHandle, cCmd)
|
|
stdout := C.GoString(C.nft_ctx_get_output_buffer(t.nftHandle))
|
|
stderr := C.GoString(C.nft_ctx_get_error_buffer(t.nftHandle))
|
|
if ret != 0 {
|
|
return fmt.Errorf("libnftables: failed to apply commands (code %d), stderr: %s", int(ret), stderr)
|
|
}
|
|
log.G(ctx).WithFields(log.Fields{"stdout": stdout, "stderr": stderr}).Debug("nftables: updated via libnftables")
|
|
return nil
|
|
}
|
|
|
|
func newNftHandle() (_ *C.struct_nft_ctx, retErr error) {
|
|
handle := C.nft_ctx_new(C.NFT_CTX_DEFAULT)
|
|
if handle == nil {
|
|
return nil, errors.New("libnftables: failed to create new nft handle")
|
|
}
|
|
defer func() {
|
|
if retErr != nil {
|
|
C.nft_ctx_free(handle)
|
|
}
|
|
}()
|
|
if ret := C.nft_ctx_buffer_output(handle); ret != 0 {
|
|
return nil, fmt.Errorf("libnftables: failed to set output buffer (code %d)", int(ret))
|
|
}
|
|
if ret := C.nft_ctx_buffer_error(handle); ret != 0 {
|
|
return nil, fmt.Errorf("libnftables: failed to set error buffer (code %d)", int(ret))
|
|
}
|
|
return handle, nil
|
|
}
|
|
|
|
func (t *table) closeNftHandle() {
|
|
t.applyLock.Lock()
|
|
defer t.applyLock.Unlock()
|
|
if t.nftHandle != nil {
|
|
C.nft_ctx_free(t.nftHandle)
|
|
t.nftHandle = nil
|
|
}
|
|
}
|