mbox series

[nft,RFC,PoC,0/2] typeof support for set / map

Message ID 20190730141620.2129-1-pablo@netfilter.org
Headers show
Series typeof support for set / map | expand

Message

Pablo Neira Ayuso July 30, 2019, 2:16 p.m. UTC 
Hi,

One topic that keeps coming back and forth is support for using integers
from the set / map definitions, see:

https://patchwork.ozlabs.org/patch/1089728/

The following example shows how PoC/RFC patchset works:

# cat test.nft
table filter {
            set blacklist {
                    typeof ip saddr
            }

            chain input {
                    ip saddr @blacklist counter drop
            }
    }
# nft -f test.nft
# nft list ruleset
table ip filter {
        set blacklist {
                typeof ip saddr
        }

        chain input {
                ip saddr @blacklist counter packets 0 bytes 0 drop
        }
}

This patchset provides a proof-of-concept, it's a quick hack, I dislike
to deliver things in a raw shape like this, but anyway...

Support for concatenations and object maps are missing. The
representation of the expression into the TLV still needs to be defined
(it could be a structure whose first field specifies the expression
type and an union with the specific fields for this expression,
encapsulated in the TLV).

Pablo Neira Ayuso (2):
  parser: add typeof keyword for declarations
  src: restore typeof datatype when listing set definition

 include/rule.h     |  3 +++
 src/mnl.c          | 27 +++++++++++++++++++++++++++
 src/netlink.c      |  9 ++++++++-
 src/parser_bison.y | 20 ++++++++++++++++++++
 src/rule.c         |  9 +++++++--
 src/scanner.l      |  1 +
 6 files changed, 66 insertions(+), 3 deletions(-)