Skip to content
  1. Jan 27, 2020
    • Stefano Brivio's avatar
      netfilter: nf_tables: Support for sets with multiple ranged fields · f3a2181e
      Stefano Brivio authored
      
      
      Introduce a new nested netlink attribute, NFTA_SET_DESC_CONCAT, used
      to specify the length of each field in a set concatenation.
      
      This allows set implementations to support concatenation of multiple
      ranged items, as they can divide the input key into matching data for
      every single field. Such set implementations would be selected as
      they specify support for NFT_SET_INTERVAL and allow desc->field_count
      to be greater than one. Explicitly disallow this for nft_set_rbtree.
      
      In order to specify the interval for a set entry, userspace would
      include in NFTA_SET_DESC_CONCAT attributes field lengths, and pass
      range endpoints as two separate keys, represented by attributes
      NFTA_SET_ELEM_KEY and NFTA_SET_ELEM_KEY_END.
      
      While at it, export the number of 32-bit registers available for
      packet matching, as nftables will need this to know the maximum
      number of field lengths that can be specified.
      
      For example, "packets with an IPv4 address between 192.0.2.0 and
      192.0.2.42, with destination port between 22 and 25", can be
      expressed as two concatenated elements:
      
        NFTA_SET_ELEM_KEY:            192.0.2.0 . 22
        NFTA_SET_ELEM_KEY_END:        192.0.2.42 . 25
      
      and NFTA_SET_DESC_CONCAT attribute would contain:
      
        NFTA_LIST_ELEM
          NFTA_SET_FIELD_LEN:		4
        NFTA_LIST_ELEM
          NFTA_SET_FIELD_LEN:		2
      
      v4: No changes
      v3: Complete rework, NFTA_SET_DESC_CONCAT instead of NFTA_SET_SUBKEY
      v2: No changes
      
      Signed-off-by: default avatarStefano Brivio <sbrivio@redhat.com>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      f3a2181e
    • Pablo Neira Ayuso's avatar
      netfilter: nf_tables: add NFTA_SET_ELEM_KEY_END attribute · 7b225d0b
      Pablo Neira Ayuso authored
      
      
      Add NFTA_SET_ELEM_KEY_END attribute to convey the closing element of the
      interval between kernel and userspace.
      
      This patch also adds the NFT_SET_EXT_KEY_END extension to store the
      closing element value in this interval.
      
      v4: No changes
      v3: New patch
      
      [sbrivio: refactor error paths and labels; add corresponding
        nft_set_ext_type for new key; rebase]
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      7b225d0b
    • Pablo Neira Ayuso's avatar
      netfilter: nf_tables: add nft_setelem_parse_key() · 20a1452c
      Pablo Neira Ayuso authored
      
      
      Add helper function to parse the set element key netlink attribute.
      
      v4: No changes
      v3: New patch
      
      [sbrivio: refactor error paths and labels; use NFT_DATA_VALUE_MAXLEN
        instead of sizeof(*key) in helper, value can be longer than that;
        rebase]
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      20a1452c
  2. Jan 26, 2020
  3. Jan 25, 2020