From patchwork Thu Nov 21 17:10:04 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefano Brivio X-Patchwork-Id: 1199067 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.b="iWf1otm3"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 47JmK72z2Jz9sPc for ; Fri, 22 Nov 2019 04:10:19 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726869AbfKURKT (ORCPT ); Thu, 21 Nov 2019 12:10:19 -0500 Received: from us-smtp-2.mimecast.com ([207.211.31.81]:25896 "EHLO us-smtp-1.mimecast.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726568AbfKURKT (ORCPT ); Thu, 21 Nov 2019 12:10:19 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1574356218; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=WLukT7Ok0Gi/urrq5Wqmmz1znhQClWx37I/4Kei/f9o=; b=iWf1otm3mwK8yIiHGoxijKxQWXpnYp1FWSwBJtOWFIUJmtP/8jhLa+4Tyg4Ptm0+pmX0/9 KsdiMg6izkyWubV0j3W7XquvV9BGh6unoUPRPy8zzbmADiV1Ph/CKdch5FygA+3/MO84QP Y9CjX33w6/uoe4yxmGwvEOYASuDI2Rk= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-17-oDgkSmRxMQGOqD8p3znN_A-1; Thu, 21 Nov 2019 12:10:14 -0500 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 24D0F1005514; Thu, 21 Nov 2019 17:10:13 +0000 (UTC) Received: from epycfail.redhat.com (ovpn-112-24.ams2.redhat.com [10.36.112.24]) by smtp.corp.redhat.com (Postfix) with ESMTP id D528D6E3F9; Thu, 21 Nov 2019 17:10:10 +0000 (UTC) From: Stefano Brivio To: Pablo Neira Ayuso , netfilter-devel@vger.kernel.org Cc: Florian Westphal , =?utf-8?q?Kadlecsik_J=C3=B3zsef?= , Eric Garver , Phil Sutter Subject: [PATCH nft v2 1/3] src: Add support for and export NFT_SET_SUBKEY attributes Date: Thu, 21 Nov 2019 18:10:04 +0100 Message-Id: <3982a275e0a29b00b742d5b5322163cae8e6c046.1574353687.git.sbrivio@redhat.com> In-Reply-To: References: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-MC-Unique: oDgkSmRxMQGOqD8p3znN_A-1 X-Mimecast-Spam-Score: 0 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org To support arbitrary range concatenations, the kernel needs to know how long each field in the concatenation is. While evaluating concatenated expressions, export the datatype size, in bits, into the new subkey_len array, and hand the data over via libnftnl. Note that, while the subkey length is expressed in bits, and the kernel attribute is 32-bit long to make UAPI more future-proof, we just reserve 8 bits for it, at the moment, and still store this data in bits. As we don't have subkeys exceeding 128 bits in length, this should be fine, at least for a while, but it can be easily changed later on to use the full 32 bits allowed by the netlink attribute. This change depends on the UAPI kernel patch with title: netfilter: nf_tables: Support for subkeys, set with multiple ranged fields Signed-off-by: Stefano Brivio Acked-by: Phil Sutter --- v2: No changes include/expression.h | 1 + include/rule.h | 1 + src/evaluate.c | 12 ++++++++---- src/mnl.c | 4 ++++ 4 files changed, 14 insertions(+), 4 deletions(-) diff --git a/include/expression.h b/include/expression.h index 717b67550381..b6d5adb2d981 100644 --- a/include/expression.h +++ b/include/expression.h @@ -256,6 +256,7 @@ struct expr { struct list_head expressions; unsigned int size; uint32_t set_flags; + uint8_t subkey_len[NFT_REG32_COUNT]; }; struct { /* EXPR_SET_REF */ diff --git a/include/rule.h b/include/rule.h index 0b2eba37934b..a263947da8fd 100644 --- a/include/rule.h +++ b/include/rule.h @@ -308,6 +308,7 @@ struct set { struct expr *rg_cache; uint32_t policy; bool automerge; + uint8_t subkey_len[NFT_REG32_COUNT]; struct { uint32_t size; } desc; diff --git a/src/evaluate.c b/src/evaluate.c index e54eaf1a7110..e1ecf4de243a 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1211,7 +1211,7 @@ static int expr_evaluate_concat(struct eval_ctx *ctx, struct expr **expr, { const struct datatype *dtype = ctx->ectx.dtype, *tmp; uint32_t type = dtype ? dtype->type : 0, ntype = 0; - int off = dtype ? dtype->subtypes : 0; + int off = dtype ? dtype->subtypes : 0, subkey_idx = 0; unsigned int flags = EXPR_F_CONSTANT | EXPR_F_SINGLETON; struct expr *i, *next; @@ -1240,6 +1240,8 @@ static int expr_evaluate_concat(struct eval_ctx *ctx, struct expr **expr, i->dtype->name); ntype = concat_subtype_add(ntype, i->dtype->type); + + (*expr)->subkey_len[subkey_idx++] = i->dtype->size; } (*expr)->flags |= flags; @@ -3301,9 +3303,11 @@ static int set_evaluate(struct eval_ctx *ctx, struct set *set) "specified in %s definition", set->key->dtype->name, type); } - if (set->flags & NFT_SET_INTERVAL && - set->key->etype == EXPR_CONCAT) - return set_error(ctx, set, "concatenated types not supported in interval sets"); + if (set->flags & NFT_SET_INTERVAL && set->key->etype == EXPR_CONCAT) { + memcpy(&set->subkey_len, &set->key->subkey_len, + sizeof(set->subkey_len)); + set->flags |= NFT_SET_SUBKEY; + } if (set_is_datamap(set->flags)) { if (set->datatype == NULL) diff --git a/src/mnl.c b/src/mnl.c index aa5b0b4652e8..24480badaecc 100644 --- a/src/mnl.c +++ b/src/mnl.c @@ -881,6 +881,10 @@ int mnl_nft_set_add(struct netlink_ctx *ctx, const struct cmd *cmd, set->automerge)) memory_allocation_error(); + if (set->flags & NFT_SET_SUBKEY) + nftnl_set_set_data(nls, NFTNL_SET_SUBKEY, &set->subkey_len, + sizeof(set->subkey_len)); + nftnl_set_set_data(nls, NFTNL_SET_USERDATA, nftnl_udata_buf_data(udbuf), nftnl_udata_buf_len(udbuf)); nftnl_udata_buf_free(udbuf);