From patchwork Thu Jan 30 00:16:32 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefano Brivio X-Patchwork-Id: 1231225 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=Y8H/5yQ+; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 487LWN3ZDMz9sPJ for ; Thu, 30 Jan 2020 11:16:48 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726990AbgA3AQs (ORCPT ); Wed, 29 Jan 2020 19:16:48 -0500 Received: from us-smtp-2.mimecast.com ([207.211.31.81]:26313 "EHLO us-smtp-delivery-1.mimecast.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726671AbgA3AQs (ORCPT ); Wed, 29 Jan 2020 19:16:48 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1580343407; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=aOqzfSUM4RfxJr4chadpSgROg22XpftxbSWKLoqt+D0=; b=Y8H/5yQ+n2jvnGGSMgX7y15Z6sSO2iekZuEvgPzU+hibMxtoSz9Q7BhRsYYtLllOi3SklM B2MxukO43Xxt8gFMjhgBsU0zc0fmtuEe+C4JhvyMvYhL0N0bVbr93fms4A6zA2M4TIiDaU OLfEIQW9/fuxPOqIBI8AWPDNw1Dthxs= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-99-uWEvJQAzN4ilZjuOATiljA-1; Wed, 29 Jan 2020 19:16:43 -0500 X-MC-Unique: uWEvJQAzN4ilZjuOATiljA-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id AE67A13E1; Thu, 30 Jan 2020 00:16:41 +0000 (UTC) Received: from epycfail.redhat.com (ovpn-200-43.brq.redhat.com [10.40.200.43]) by smtp.corp.redhat.com (Postfix) with ESMTP id 0DC9919486; Thu, 30 Jan 2020 00:16:38 +0000 (UTC) From: Stefano Brivio To: Pablo Neira Ayuso , netfilter-devel@vger.kernel.org Cc: Florian Westphal , =?utf-8?q?Kadlecsik_J=C3=B3zsef?= , Eric Garver , Phil Sutter Subject: [PATCH libnftnl v4 1/3] include: resync nf_tables.h cache copy Date: Thu, 30 Jan 2020 01:16:32 +0100 Message-Id: In-Reply-To: References: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Get this header in sync with nf-next as of merge commit b3a608222336 (5.6-rc1-ish). Signed-off-by: Stefano Brivio --- v4: New patch include/linux/netfilter/nf_tables.h | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h index 261864736b26..065218a20bb7 100644 --- a/include/linux/netfilter/nf_tables.h +++ b/include/linux/netfilter/nf_tables.h @@ -48,6 +48,7 @@ enum nft_registers { #define NFT_REG_SIZE 16 #define NFT_REG32_SIZE 4 +#define NFT_REG32_COUNT (NFT_REG32_15 - NFT_REG32_00 + 1) /** * enum nft_verdicts - nf_tables internal verdicts @@ -301,14 +302,28 @@ enum nft_set_policies { * enum nft_set_desc_attributes - set element description * * @NFTA_SET_DESC_SIZE: number of elements in set (NLA_U32) + * @NFTA_SET_DESC_CONCAT: description of field concatenation (NLA_NESTED) */ enum nft_set_desc_attributes { NFTA_SET_DESC_UNSPEC, NFTA_SET_DESC_SIZE, + NFTA_SET_DESC_CONCAT, __NFTA_SET_DESC_MAX }; #define NFTA_SET_DESC_MAX (__NFTA_SET_DESC_MAX - 1) +/** + * enum nft_set_field_attributes - attributes of concatenated fields + * + * @NFTA_SET_FIELD_LEN: length of single field, in bits (NLA_U32) + */ +enum nft_set_field_attributes { + NFTA_SET_FIELD_UNSPEC, + NFTA_SET_FIELD_LEN, + __NFTA_SET_FIELD_MAX +}; +#define NFTA_SET_FIELD_MAX (__NFTA_SET_FIELD_MAX - 1) + /** * enum nft_set_attributes - nf_tables set netlink attributes * @@ -370,6 +385,7 @@ enum nft_set_elem_flags { * @NFTA_SET_ELEM_USERDATA: user data (NLA_BINARY) * @NFTA_SET_ELEM_EXPR: expression (NLA_NESTED: nft_expr_attributes) * @NFTA_SET_ELEM_OBJREF: stateful object reference (NLA_STRING) + * @NFTA_SET_ELEM_KEY_END: closing key value (NLA_NESTED: nft_data) */ enum nft_set_elem_attributes { NFTA_SET_ELEM_UNSPEC, @@ -382,6 +398,7 @@ enum nft_set_elem_attributes { NFTA_SET_ELEM_EXPR, NFTA_SET_ELEM_PAD, NFTA_SET_ELEM_OBJREF, + NFTA_SET_ELEM_KEY_END, __NFTA_SET_ELEM_MAX }; #define NFTA_SET_ELEM_MAX (__NFTA_SET_ELEM_MAX - 1) From patchwork Thu Jan 30 00:16:33 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefano Brivio X-Patchwork-Id: 1231226 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=QITssPI4; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 487LWP1XY3z9sNF for ; Thu, 30 Jan 2020 11:16:49 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726996AbgA3AQt (ORCPT ); Wed, 29 Jan 2020 19:16:49 -0500 Received: from us-smtp-delivery-1.mimecast.com ([205.139.110.120]:48649 "EHLO us-smtp-1.mimecast.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726939AbgA3AQs (ORCPT ); Wed, 29 Jan 2020 19:16:48 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1580343407; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=MvKgv6TgarQ9N0Ncv8Gzii/NSwWTjB9V5Djf9ZIGaOk=; b=QITssPI4aF0takDi6Gsqj5MQW70kvv/6vq/4Rt6IS4Z0tE5GCEE0pdDaUpmijQkKpHbvw7 ohpANBy3nJSIuvEEFIN4WgJbj+oi4A4c3eX9Ao8NTcTKQWXZjwh5TO5ZWWO4O42cmm0Xm0 lOKvqg/2yEHJGs7GQwPMHWnAblnW5nY= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-404-Z7ySXfQ3NqKBoHBvUdNAUA-1; Wed, 29 Jan 2020 19:16:45 -0500 X-MC-Unique: Z7ySXfQ3NqKBoHBvUdNAUA-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 92C141005513; Thu, 30 Jan 2020 00:16:44 +0000 (UTC) Received: from epycfail.redhat.com (ovpn-200-43.brq.redhat.com [10.40.200.43]) by smtp.corp.redhat.com (Postfix) with ESMTP id 290E819486; Thu, 30 Jan 2020 00:16:41 +0000 (UTC) From: Stefano Brivio To: Pablo Neira Ayuso , netfilter-devel@vger.kernel.org Cc: Florian Westphal , =?utf-8?q?Kadlecsik_J=C3=B3zsef?= , Eric Garver , Phil Sutter Subject: [PATCH libnftnl v4 2/3] set: Add support for NFTA_SET_DESC_CONCAT attributes Date: Thu, 30 Jan 2020 01:16:33 +0100 Message-Id: In-Reply-To: References: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org If NFTNL_SET_DESC_CONCAT data is passed, pass that to the kernel as NFTA_SET_DESC_CONCAT attributes: it describes the length of single concatenated fields, in bytes. Similarly, parse NFTA_SET_DESC_CONCAT attributes if received from the kernel. This is the libnftnl counterpart for nftables patch: src: Add support for NFTNL_SET_DESC_CONCAT v4: - move NFTNL_SET_DESC_CONCAT to the end of enum nftnl_set_attr to avoid ABI breakage (Pablo Neira Ayuso) v3: - use NFTNL_SET_DESC_CONCAT and NFTA_SET_DESC_CONCAT instead of a stand-alone NFTA_SET_SUBKEY attribute (Pablo Neira Ayuso) - pass field length in bytes instead of bits, fields would get unnecessarily big otherwise v2: - fixed grammar in commit message - removed copy of array bytes in nftnl_set_nlmsg_build_subkey_payload(), we're simply passing values to htonl() (Phil Sutter) Signed-off-by: Stefano Brivio --- include/libnftnl/set.h | 1 + include/set.h | 2 + src/set.c | 111 ++++++++++++++++++++++++++++++++++------- 3 files changed, 95 insertions(+), 19 deletions(-) diff --git a/include/libnftnl/set.h b/include/libnftnl/set.h index db3fa686d60a..bbbf58ded99a 100644 --- a/include/libnftnl/set.h +++ b/include/libnftnl/set.h @@ -29,6 +29,7 @@ enum nftnl_set_attr { NFTNL_SET_USERDATA, NFTNL_SET_OBJ_TYPE, NFTNL_SET_HANDLE, + NFTNL_SET_DESC_CONCAT, __NFTNL_SET_MAX }; #define NFTNL_SET_MAX (__NFTNL_SET_MAX - 1) diff --git a/include/set.h b/include/set.h index 446acd24ca7c..895ffdb48bdb 100644 --- a/include/set.h +++ b/include/set.h @@ -25,6 +25,8 @@ struct nftnl_set { enum nft_set_policies policy; struct { uint32_t size; + uint8_t field_len[NFT_REG32_COUNT]; + uint8_t field_count; } desc; struct list_head element_list; diff --git a/src/set.c b/src/set.c index 78447c676f51..651dcfa56022 100644 --- a/src/set.c +++ b/src/set.c @@ -89,6 +89,7 @@ void nftnl_set_unset(struct nftnl_set *s, uint16_t attr) case NFTNL_SET_ID: case NFTNL_SET_POLICY: case NFTNL_SET_DESC_SIZE: + case NFTNL_SET_DESC_CONCAT: case NFTNL_SET_TIMEOUT: case NFTNL_SET_GC_INTERVAL: break; @@ -174,6 +175,10 @@ int nftnl_set_set_data(struct nftnl_set *s, uint16_t attr, const void *data, case NFTNL_SET_DESC_SIZE: memcpy(&s->desc.size, data, sizeof(s->desc.size)); break; + case NFTNL_SET_DESC_CONCAT: + memcpy(&s->desc.field_len, data, data_len); + while (s->desc.field_len[++s->desc.field_count]); + break; case NFTNL_SET_TIMEOUT: memcpy(&s->timeout, data, sizeof(s->timeout)); break; @@ -266,6 +271,9 @@ const void *nftnl_set_get_data(const struct nftnl_set *s, uint16_t attr, case NFTNL_SET_DESC_SIZE: *data_len = sizeof(uint32_t); return &s->desc.size; + case NFTNL_SET_DESC_CONCAT: + *data_len = s->desc.field_count; + return s->desc.field_len; case NFTNL_SET_TIMEOUT: *data_len = sizeof(uint64_t); return &s->timeout; @@ -351,13 +359,42 @@ err: return NULL; } +static void nftnl_set_nlmsg_build_desc_size_payload(struct nlmsghdr *nlh, + struct nftnl_set *s) +{ + mnl_attr_put_u32(nlh, NFTA_SET_DESC_SIZE, htonl(s->desc.size)); +} + +static void nftnl_set_nlmsg_build_desc_concat_payload(struct nlmsghdr *nlh, + struct nftnl_set *s) +{ + struct nlattr *nest; + int i; + + nest = mnl_attr_nest_start(nlh, NFTA_SET_DESC_CONCAT); + for (i = 0; i < NFT_REG32_COUNT && i < s->desc.field_count; i++) { + struct nlattr *nest_elem; + + nest_elem = mnl_attr_nest_start(nlh, NFTA_LIST_ELEM); + mnl_attr_put_u32(nlh, NFTA_SET_FIELD_LEN, + htonl(s->desc.field_len[i])); + mnl_attr_nest_end(nlh, nest_elem); + } + mnl_attr_nest_end(nlh, nest); +} + static void nftnl_set_nlmsg_build_desc_payload(struct nlmsghdr *nlh, struct nftnl_set *s) { struct nlattr *nest; nest = mnl_attr_nest_start(nlh, NFTA_SET_DESC); - mnl_attr_put_u32(nlh, NFTA_SET_DESC_SIZE, htonl(s->desc.size)); + + if (s->flags & (1 << NFTNL_SET_DESC_SIZE)) + nftnl_set_nlmsg_build_desc_size_payload(nlh, s); + if (s->flags & (1 << NFTNL_SET_DESC_CONCAT)) + nftnl_set_nlmsg_build_desc_concat_payload(nlh, s); + mnl_attr_nest_end(nlh, nest); } @@ -387,7 +424,7 @@ void nftnl_set_nlmsg_build_payload(struct nlmsghdr *nlh, struct nftnl_set *s) mnl_attr_put_u32(nlh, NFTA_SET_ID, htonl(s->id)); if (s->flags & (1 << NFTNL_SET_POLICY)) mnl_attr_put_u32(nlh, NFTA_SET_POLICY, htonl(s->policy)); - if (s->flags & (1 << NFTNL_SET_DESC_SIZE)) + if (s->flags & (1 << NFTNL_SET_DESC_SIZE | 1 << NFTNL_SET_DESC_CONCAT)) nftnl_set_nlmsg_build_desc_payload(nlh, s); if (s->flags & (1 << NFTNL_SET_TIMEOUT)) mnl_attr_put_u64(nlh, NFTA_SET_TIMEOUT, htobe64(s->timeout)); @@ -445,39 +482,75 @@ static int nftnl_set_parse_attr_cb(const struct nlattr *attr, void *data) return MNL_CB_OK; } -static int nftnl_set_desc_parse_attr_cb(const struct nlattr *attr, void *data) +static int +nftnl_set_desc_concat_field_parse_attr_cb(const struct nlattr *attr, void *data) +{ + int type = mnl_attr_get_type(attr); + struct nftnl_set *s = data; + + if (type != NFTA_SET_FIELD_LEN) + return MNL_CB_OK; + + if (mnl_attr_validate(attr, MNL_TYPE_U32)) + return MNL_CB_ERROR; + + s->desc.field_len[s->desc.field_count] = ntohl(mnl_attr_get_u32(attr)); + s->desc.field_count++; + + return MNL_CB_OK; +} + +static int +nftnl_set_desc_concat_parse_attr_cb(const struct nlattr *attr, void *data) { - const struct nlattr **tb = data; int type = mnl_attr_get_type(attr); + struct nftnl_set *s = data; + + if (type != NFTA_LIST_ELEM) + return MNL_CB_OK; + + return mnl_attr_parse_nested(attr, + nftnl_set_desc_concat_field_parse_attr_cb, + s); +} + +static int nftnl_set_desc_parse_attr_cb(const struct nlattr *attr, void *data) +{ + int type = mnl_attr_get_type(attr), err; + struct nftnl_set *s = data; if (mnl_attr_type_valid(attr, NFTA_SET_DESC_MAX) < 0) return MNL_CB_OK; switch (type) { case NFTA_SET_DESC_SIZE: - if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) + if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) { abi_breakage(); + break; + } + + s->desc.size = ntohl(mnl_attr_get_u32(attr)); + s->flags |= (1 << NFTNL_SET_DESC_SIZE); + break; + case NFTA_SET_DESC_CONCAT: + err = mnl_attr_parse_nested(attr, + nftnl_set_desc_concat_parse_attr_cb, + s); + if (err != MNL_CB_OK) + abi_breakage(); + + s->flags |= (1 << NFTNL_SET_DESC_CONCAT); + break; + default: break; } - tb[type] = attr; return MNL_CB_OK; } -static int nftnl_set_desc_parse(struct nftnl_set *s, - const struct nlattr *attr) +static int nftnl_set_desc_parse(struct nftnl_set *s, const struct nlattr *attr) { - struct nlattr *tb[NFTA_SET_DESC_MAX + 1] = {}; - - if (mnl_attr_parse_nested(attr, nftnl_set_desc_parse_attr_cb, tb) < 0) - return -1; - - if (tb[NFTA_SET_DESC_SIZE]) { - s->desc.size = ntohl(mnl_attr_get_u32(tb[NFTA_SET_DESC_SIZE])); - s->flags |= (1 << NFTNL_SET_DESC_SIZE); - } - - return 0; + return mnl_attr_parse_nested(attr, nftnl_set_desc_parse_attr_cb, s); } EXPORT_SYMBOL(nftnl_set_nlmsg_parse); From patchwork Thu Jan 30 00:16:34 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefano Brivio X-Patchwork-Id: 1231227 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=Fmp1q/94; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 487LWV0l6Wz9sNF for ; Thu, 30 Jan 2020 11:16:54 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727078AbgA3AQx (ORCPT ); Wed, 29 Jan 2020 19:16:53 -0500 Received: from us-smtp-2.mimecast.com ([207.211.31.81]:40388 "EHLO us-smtp-delivery-1.mimecast.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726939AbgA3AQx (ORCPT ); Wed, 29 Jan 2020 19:16:53 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1580343413; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=gXfAaZHilrCXtImDCfojZJDMhwAs3PeLHE/kbbhddGY=; b=Fmp1q/94jW5LqK/y2H8mQy4SdST1xUzfjHO2yhWLBJJe0CAFrInzcMKUHYEguNpTFw0EY0 7VI6FAT4v9OK0lS82u0r4oKeABC/UzHbEQAB8AvSmQywmiYhOMhLrBjE6RQZ7A6xssPW9b N46Oa5IQBs4M6Y2DUNlgYgGmSzRPU30= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-87-7bVkcRZbPpal2wlyAm0Euw-1; Wed, 29 Jan 2020 19:16:48 -0500 X-MC-Unique: 7bVkcRZbPpal2wlyAm0Euw-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 19551800D53; Thu, 30 Jan 2020 00:16:47 +0000 (UTC) Received: from epycfail.redhat.com (ovpn-200-43.brq.redhat.com [10.40.200.43]) by smtp.corp.redhat.com (Postfix) with ESMTP id 206A0166B0; Thu, 30 Jan 2020 00:16:44 +0000 (UTC) From: Stefano Brivio To: Pablo Neira Ayuso , netfilter-devel@vger.kernel.org Cc: Florian Westphal , =?utf-8?q?Kadlecsik_J=C3=B3zsef?= , Eric Garver , Phil Sutter Subject: [PATCH libnftnl v4 3/3] set_elem: Introduce support for NFTNL_SET_ELEM_KEY_END Date: Thu, 30 Jan 2020 01:16:34 +0100 Message-Id: In-Reply-To: References: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org The new set element attribute maps to the netlink attribute NFTA_SET_ELEM_KEY_END in the same way as NFTNL_SET_ELEM_KEY maps to NFTA_SET_ELEM_KEY, and represents the key data used to express the upper bound of a range, in concatenations. Suggested-by: Pablo Neira Ayuso Signed-off-by: Stefano Brivio --- v4: No changes v3: New patch include/libnftnl/set.h | 1 + include/set_elem.h | 1 + src/set_elem.c | 24 ++++++++++++++++++++++++ 3 files changed, 26 insertions(+) diff --git a/include/libnftnl/set.h b/include/libnftnl/set.h index bbbf58ded99a..6843adfa0c1e 100644 --- a/include/libnftnl/set.h +++ b/include/libnftnl/set.h @@ -105,6 +105,7 @@ enum { NFTNL_SET_ELEM_USERDATA, NFTNL_SET_ELEM_EXPR, NFTNL_SET_ELEM_OBJREF, + NFTNL_SET_ELEM_KEY_END, __NFTNL_SET_ELEM_MAX }; #define NFTNL_SET_ELEM_MAX (__NFTNL_SET_ELEM_MAX - 1) diff --git a/include/set_elem.h b/include/set_elem.h index cc4d52943272..52f185aa11be 100644 --- a/include/set_elem.h +++ b/include/set_elem.h @@ -8,6 +8,7 @@ struct nftnl_set_elem { uint32_t set_elem_flags; uint32_t flags; union nftnl_data_reg key; + union nftnl_data_reg key_end; union nftnl_data_reg data; struct nftnl_expr *expr; uint64_t timeout; diff --git a/src/set_elem.c b/src/set_elem.c index d3ce807d838c..22031938ebbc 100644 --- a/src/set_elem.c +++ b/src/set_elem.c @@ -75,6 +75,7 @@ void nftnl_set_elem_unset(struct nftnl_set_elem *s, uint16_t attr) break; case NFTNL_SET_ELEM_FLAGS: case NFTNL_SET_ELEM_KEY: /* NFTA_SET_ELEM_KEY */ + case NFTNL_SET_ELEM_KEY_END: /* NFTA_SET_ELEM_KEY_END */ case NFTNL_SET_ELEM_VERDICT: /* NFTA_SET_ELEM_DATA */ case NFTNL_SET_ELEM_DATA: /* NFTA_SET_ELEM_DATA */ case NFTNL_SET_ELEM_TIMEOUT: /* NFTA_SET_ELEM_TIMEOUT */ @@ -118,6 +119,10 @@ int nftnl_set_elem_set(struct nftnl_set_elem *s, uint16_t attr, memcpy(&s->key.val, data, data_len); s->key.len = data_len; break; + case NFTNL_SET_ELEM_KEY_END: /* NFTA_SET_ELEM_KEY_END */ + memcpy(&s->key_end.val, data, data_len); + s->key_end.len = data_len; + break; case NFTNL_SET_ELEM_VERDICT: /* NFTA_SET_ELEM_DATA */ memcpy(&s->data.verdict, data, sizeof(s->data.verdict)); break; @@ -193,6 +198,9 @@ const void *nftnl_set_elem_get(struct nftnl_set_elem *s, uint16_t attr, uint32_t case NFTNL_SET_ELEM_KEY: /* NFTA_SET_ELEM_KEY */ *data_len = s->key.len; return &s->key.val; + case NFTNL_SET_ELEM_KEY_END: /* NFTA_SET_ELEM_KEY_END */ + *data_len = s->key_end.len; + return &s->key_end.val; case NFTNL_SET_ELEM_VERDICT: /* NFTA_SET_ELEM_DATA */ *data_len = sizeof(s->data.verdict); return &s->data.verdict; @@ -287,6 +295,14 @@ void nftnl_set_elem_nlmsg_build_payload(struct nlmsghdr *nlh, mnl_attr_put(nlh, NFTA_DATA_VALUE, e->key.len, e->key.val); mnl_attr_nest_end(nlh, nest1); } + if (e->flags & (1 << NFTNL_SET_ELEM_KEY_END)) { + struct nlattr *nest1; + + nest1 = mnl_attr_nest_start(nlh, NFTA_SET_ELEM_KEY_END); + mnl_attr_put(nlh, NFTA_DATA_VALUE, e->key_end.len, + e->key_end.val); + mnl_attr_nest_end(nlh, nest1); + } if (e->flags & (1 << NFTNL_SET_ELEM_VERDICT)) { struct nlattr *nest1, *nest2; @@ -373,6 +389,7 @@ static int nftnl_set_elem_parse_attr_cb(const struct nlattr *attr, void *data) abi_breakage(); break; case NFTA_SET_ELEM_KEY: + case NFTA_SET_ELEM_KEY_END: case NFTA_SET_ELEM_DATA: case NFTA_SET_ELEM_EXPR: if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0) @@ -421,6 +438,13 @@ static int nftnl_set_elems_parse2(struct nftnl_set *s, const struct nlattr *nest goto out_set_elem; e->flags |= (1 << NFTNL_SET_ELEM_KEY); } + if (tb[NFTA_SET_ELEM_KEY_END]) { + ret = nftnl_parse_data(&e->key_end, tb[NFTA_SET_ELEM_KEY_END], + &type); + if (ret < 0) + goto out_set_elem; + e->flags |= (1 << NFTNL_SET_ELEM_KEY_END); + } if (tb[NFTA_SET_ELEM_DATA]) { ret = nftnl_parse_data(&e->data, tb[NFTA_SET_ELEM_DATA], &type); if (ret < 0)