@@ -67,6 +67,17 @@ struct queue_stmt {
extern struct stmt *queue_stmt_alloc(const struct location *loc);
+#include <ct.h>
+struct ct_stmt {
+ enum nft_ct_keys key;
+ const struct ct_template *tmpl;
+ struct expr *expr;
+};
+
+extern struct stmt *ct_stmt_alloc(const struct location *loc,
+ enum nft_ct_keys key,
+ struct expr *expr);
+
/**
* enum stmt_types - statement types
*
@@ -80,6 +91,7 @@ extern struct stmt *queue_stmt_alloc(const struct location *loc);
* @STMT_REJECT: REJECT statement
* @STMT_NAT: NAT statement
* @STMT_QUEUE: QUEUE statement
+ * @STMT_CT: conntrack statement
*/
enum stmt_types {
STMT_INVALID,
@@ -92,6 +104,7 @@ enum stmt_types {
STMT_REJECT,
STMT_NAT,
STMT_QUEUE,
+ STMT_CT,
};
/**
@@ -138,6 +151,7 @@ struct stmt {
struct reject_stmt reject;
struct nat_stmt nat;
struct queue_stmt queue;
+ struct ct_stmt ct;
};
};
@@ -24,6 +24,7 @@
#include <datatype.h>
#include <ct.h>
#include <utils.h>
+#include <statement.h>
static const struct symbol_table ct_state_tbl = {
.symbols = {
@@ -157,6 +158,30 @@ struct expr *ct_expr_alloc(const struct location *loc, enum nft_ct_keys key)
return expr;
}
+static void ct_stmt_print(const struct stmt *stmt)
+{
+ printf("ct %s set ", ct_templates[stmt->ct.key].token);
+ expr_print(stmt->ct.expr);
+}
+
+static const struct stmt_ops ct_stmt_ops = {
+ .type = STMT_CT,
+ .name = "ct",
+ .print = ct_stmt_print,
+};
+
+struct stmt *ct_stmt_alloc(const struct location *loc, enum nft_ct_keys key,
+ struct expr *expr)
+{
+ struct stmt *stmt;
+
+ stmt = stmt_alloc(loc, &ct_stmt_ops);
+ stmt->ct.key = key;
+ stmt->ct.tmpl = &ct_templates[key];
+ stmt->ct.expr = expr;
+ return stmt;
+}
+
static void __init ct_init(void)
{
datatype_register(&ct_state_type);
@@ -1149,6 +1149,15 @@ static int stmt_evaluate_nat(struct eval_ctx *ctx, struct stmt *stmt)
return 0;
}
+static int stmt_evaluate_ct(struct eval_ctx *ctx, struct stmt *stmt)
+{
+ expr_set_context(&ctx->ectx, stmt->ct.tmpl->dtype,
+ stmt->ct.tmpl->len);
+ if (expr_evaluate(ctx, &stmt->ct.expr) < 0)
+ return -1;
+ return 0;
+}
+
static int stmt_evaluate(struct eval_ctx *ctx, struct stmt *stmt)
{
#ifdef DEBUG
@@ -1176,6 +1185,8 @@ static int stmt_evaluate(struct eval_ctx *ctx, struct stmt *stmt)
return stmt_evaluate_nat(ctx, stmt);
case STMT_QUEUE:
return 0;
+ case STMT_CT:
+ return stmt_evaluate_ct(ctx, stmt);
default:
BUG("unknown statement type %s\n", stmt->ops->name);
}
@@ -365,9 +365,26 @@ static void netlink_parse_meta(struct netlink_parse_ctx *ctx,
netlink_parse_meta_sreg(ctx, loc, nle);
}
-static void netlink_parse_ct(struct netlink_parse_ctx *ctx,
- const struct location *loc,
- const struct nft_rule_expr *nle)
+static void netlink_parse_ct_sreg(struct netlink_parse_ctx *ctx,
+ const struct location *loc,
+ const struct nft_rule_expr *nle)
+{
+ struct stmt *stmt;
+ struct expr *expr;
+
+ expr = netlink_get_register(ctx, loc,
+ nft_rule_expr_get_u32(nle, NFT_EXPR_CT_SREG));
+ stmt = ct_stmt_alloc(loc,
+ nft_rule_expr_get_u32(nle, NFT_EXPR_CT_KEY),
+ expr);
+ expr_set_type(expr, stmt->ct.tmpl->dtype, stmt->ct.tmpl->byteorder);
+
+ list_add_tail(&stmt->list, &ctx->rule->stmts);
+}
+
+static void netlink_parse_ct_dreg(struct netlink_parse_ctx *ctx,
+ const struct location *loc,
+ const struct nft_rule_expr *nle)
{
struct expr *expr;
@@ -377,6 +394,16 @@ static void netlink_parse_ct(struct netlink_parse_ctx *ctx,
expr);
}
+static void netlink_parse_ct(struct netlink_parse_ctx *ctx,
+ const struct location *loc,
+ const struct nft_rule_expr *nle)
+{
+ if (nft_rule_expr_is_set(nle, NFT_EXPR_CT_DREG))
+ netlink_parse_ct_dreg(ctx, loc, nle);
+ else
+ netlink_parse_ct_sreg(ctx, loc, nle);
+}
+
static void netlink_parse_counter(struct netlink_parse_ctx *ctx,
const struct location *loc,
const struct nft_rule_expr *nle)
@@ -832,6 +859,10 @@ static void rule_parse_postprocess(struct netlink_parse_ctx *ctx, struct rule *r
if (stmt->meta.expr != NULL)
expr_postprocess(&rctx, stmt, &stmt->meta.expr);
break;
+ case STMT_CT:
+ if (stmt->ct.expr != NULL)
+ expr_postprocess(&rctx, stmt, &stmt->ct.expr);
+ break;
case STMT_NAT:
if (stmt->nat.addr != NULL)
expr_postprocess(&rctx, stmt, &stmt->nat.addr);
@@ -656,6 +656,22 @@ static void netlink_gen_queue_stmt(struct netlink_linearize_ctx *ctx,
nft_rule_add_expr(ctx->nlr, nle);
}
+static void netlink_gen_ct_stmt(struct netlink_linearize_ctx *ctx,
+ const struct stmt *stmt)
+{
+ struct nft_rule_expr *nle;
+ enum nft_registers sreg;
+
+ sreg = get_register(ctx);
+ netlink_gen_expr(ctx, stmt->ct.expr, sreg);
+ release_register(ctx);
+
+ nle = alloc_nft_expr("ct");
+ nft_rule_expr_set_u32(nle, NFT_EXPR_CT_SREG, sreg);
+ nft_rule_expr_set_u32(nle, NFT_EXPR_CT_KEY, stmt->ct.key);
+ nft_rule_add_expr(ctx->nlr, nle);
+}
+
static void netlink_gen_stmt(struct netlink_linearize_ctx *ctx,
const struct stmt *stmt)
{
@@ -678,6 +694,8 @@ static void netlink_gen_stmt(struct netlink_linearize_ctx *ctx,
return netlink_gen_nat_stmt(ctx, stmt);
case STMT_QUEUE:
return netlink_gen_queue_stmt(ctx, stmt);
+ case STMT_CT:
+ return netlink_gen_ct_stmt(ctx, stmt);
default:
BUG("unknown statement type %s\n", stmt->ops->name);
}
@@ -372,6 +372,8 @@ static void location_update(struct location *loc, struct location *rhs, int n)
%destructor { stmt_free($$); } stmt match_stmt verdict_stmt
%type <stmt> counter_stmt counter_stmt_alloc
%destructor { stmt_free($$); } counter_stmt counter_stmt_alloc
+%type <stmt> ct_stmt
+%destructor { stmt_free($$); } ct_stmt
%type <stmt> meta_stmt
%destructor { stmt_free($$); } meta_stmt
%type <stmt> log_stmt log_stmt_alloc
@@ -937,6 +939,7 @@ stmt : verdict_stmt
| reject_stmt
| nat_stmt
| queue_stmt
+ | ct_stmt
;
verdict_stmt : verdict_expr
@@ -1416,6 +1419,12 @@ ct_key : STATE { $$ = NFT_CT_STATE; }
| PROTO_DST { $$ = NFT_CT_PROTO_DST; }
;
+ct_stmt : CT ct_key SET expr
+ {
+ $$ = ct_stmt_alloc(&@$, $2, $4);
+ }
+ ;
+
payload_expr : payload_raw_expr
| eth_hdr_expr
| vlan_hdr_expr