Commit 22fe54d5 authored by Patrick McHardy's avatar Patrick McHardy Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: add support for dynamic set updates 



Add a new "dynset" expression for dynamic set updates.

A new set op ->update() is added which, for non existant elements,
invokes an initialization callback and inserts the new element.
For both new or existing elements the extenstion pointer is returned
to the caller to optionally perform timer updates or other actions.

Element removal is not supported so far, however that seems to be a
rather exotic need and can be added later on.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 11113e19

include/net/netfilter/nf_tables.h

+17 −0
Original line number Diff line number Diff line
@@ -196,6 +196,7 @@ struct nft_set_estimate { 
};



struct nft_set_ext;

struct nft_expr;



/**

 *	struct nft_set_ops - nf_tables set operations
@@ -218,6 +219,15 @@ struct nft_set_ops { 
	bool				(*lookup)(const struct nft_set *set,

						  const struct nft_data *key,

						  const struct nft_set_ext **ext);

	bool				(*update)(struct nft_set *set,

						  const struct nft_data *key,

						  void *(*new)(struct nft_set *,

							       const struct nft_expr *,

							       struct nft_data []),

						  const struct nft_expr *expr,

						  struct nft_data data[],

						  const struct nft_set_ext **ext);



	int				(*insert)(const struct nft_set *set,

						  const struct nft_set_elem *elem);

	void				(*activate)(const struct nft_set *set,
@@ -466,6 +476,11 @@ static inline struct nft_set_ext *nft_set_elem_ext(const struct nft_set *set, 
	return elem + set->ops->elemsize;

}



void *nft_set_elem_init(const struct nft_set *set,

			const struct nft_set_ext_tmpl *tmpl,

			const struct nft_data *key,

			const struct nft_data *data,

			u64 timeout, gfp_t gfp);

void nft_set_elem_destroy(const struct nft_set *set, void *elem);



/**
@@ -845,6 +860,8 @@ static inline u8 nft_genmask_cur(const struct net *net) 
	return 1 << ACCESS_ONCE(net->nft.gencursor);

}



#define NFT_GENMASK_ANY		((1 << 0) | (1 << 1))



/*

 * Set element transaction helpers

 */

include/net/netfilter/nf_tables_core.h

+3 −0
Original line number Diff line number Diff line
@@ -31,6 +31,9 @@ void nft_cmp_module_exit(void); 
int nft_lookup_module_init(void);

void nft_lookup_module_exit(void);



int nft_dynset_module_init(void);

void nft_dynset_module_exit(void);



int nft_bitwise_module_init(void);

void nft_bitwise_module_exit(void);

include/uapi/linux/netfilter/nf_tables.h

+27 −0
Original line number Diff line number Diff line
@@ -515,6 +515,33 @@ enum nft_lookup_attributes { 
};

#define NFTA_LOOKUP_MAX		(__NFTA_LOOKUP_MAX - 1)



enum nft_dynset_ops {

	NFT_DYNSET_OP_ADD,

	NFT_DYNSET_OP_UPDATE,

};



/**

 * enum nft_dynset_attributes - dynset expression attributes

 *

 * @NFTA_DYNSET_SET_NAME: name of set the to add data to (NLA_STRING)

 * @NFTA_DYNSET_SET_ID: uniquely identifier of the set in the transaction (NLA_U32)

 * @NFTA_DYNSET_OP: operation (NLA_U32)

 * @NFTA_DYNSET_SREG_KEY: source register of the key (NLA_U32)

 * @NFTA_DYNSET_SREG_DATA: source register of the data (NLA_U32)

 * @NFTA_DYNSET_TIMEOUT: timeout value for the new element (NLA_U64)

 */

enum nft_dynset_attributes {

	NFTA_DYNSET_UNSPEC,

	NFTA_DYNSET_SET_NAME,

	NFTA_DYNSET_SET_ID,

	NFTA_DYNSET_OP,

	NFTA_DYNSET_SREG_KEY,

	NFTA_DYNSET_SREG_DATA,

	NFTA_DYNSET_TIMEOUT,

	__NFTA_DYNSET_MAX,

};

#define NFTA_DYNSET_MAX		(__NFTA_DYNSET_MAX - 1)



/**

 * enum nft_payload_bases - nf_tables payload expression offset bases

 *

net/netfilter/Makefile

+1 −1
Original line number Diff line number Diff line
@@ -70,7 +70,7 @@ obj-$(CONFIG_NETFILTER_SYNPROXY) += nf_synproxy_core.o 


# nf_tables

nf_tables-objs += nf_tables_core.o nf_tables_api.o

nf_tables-objs += nft_immediate.o nft_cmp.o nft_lookup.o

nf_tables-objs += nft_immediate.o nft_cmp.o nft_lookup.o nft_dynset.o

nf_tables-objs += nft_bitwise.o nft_byteorder.o nft_payload.o



obj-$(CONFIG_NF_TABLES)		+= nf_tables.o

net/netfilter/nf_tables_api.c

+5 −5
Original line number Diff line number Diff line
@@ -3183,7 +3183,7 @@ static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx, 
	return trans;

}



static void *nft_set_elem_init(const struct nft_set *set,

void *nft_set_elem_init(const struct nft_set *set,

			const struct nft_set_ext_tmpl *tmpl,

			const struct nft_data *key,

			const struct nft_data *data,

CRA Git | Maintained and supported by SUSTech CRA and CCSE