projects / openwrt / staging / wigyori.git / blob
? search:


888a767160f7ed2744dac617f7003a9d5b419682
[openwrt/staging/wigyori.git] / package / network / utils / nftables / patches / 201-src-add-support-to-add-flowtables.patch
1 From: Pablo Neira Ayuso <pablo@netfilter.org>
2 Date: Thu, 18 Jan 2018 08:43:23 +0100
3 Subject: [PATCH] src: add support to add flowtables
4
5 This patch allows you to create flowtable:
6
7 # nft add table x
8 # nft add flowtable x m { hook ingress priority 10\; devices = { eth0, wlan0 }\; }
9
10 You have to specify hook and priority. So far, only the ingress hook is
11 supported. The priority represents where this flowtable is placed in the
12 ingress hook, which is registered to the devices that the user
13 specifies.
14
15 You can also use the 'create' command instead to bail out in case that
16 there is an existing flowtable with this name.
17
18 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
19 ---
20
21 --- a/include/expression.h
22 +++ b/include/expression.h
23 @@ -407,6 +407,8 @@ extern struct expr *prefix_expr_alloc(co
24 extern struct expr *range_expr_alloc(const struct location *loc,
25 struct expr *low, struct expr *high);
26
27 +extern struct expr *compound_expr_alloc(const struct location *loc,
28 + const struct expr_ops *ops);
29 extern void compound_expr_add(struct expr *compound, struct expr *expr);
30 extern void compound_expr_remove(struct expr *compound, struct expr *expr);
31 extern void list_expr_sort(struct list_head *head);
32 --- a/include/mnl.h
33 +++ b/include/mnl.h
34 @@ -92,6 +92,10 @@ int mnl_nft_obj_batch_del(struct nftnl_o
35 struct nftnl_flowtable_list *
36 mnl_nft_flowtable_dump(struct netlink_ctx *ctx, int family, const char *table);
37
38 +int mnl_nft_flowtable_batch_add(struct nftnl_flowtable *flo,
39 + struct nftnl_batch *batch, unsigned int flags,
40 + uint32_t seqnum);
41 +
42 struct nftnl_ruleset *mnl_nft_ruleset_dump(struct netlink_ctx *ctx,
43 uint32_t family);
44 int mnl_nft_event_listener(struct mnl_socket *nf_sock, unsigned int debug_mask,
45 --- a/include/netlink.h
46 +++ b/include/netlink.h
47 @@ -7,6 +7,7 @@
48 #include <libnftnl/expr.h>
49 #include <libnftnl/set.h>
50 #include <libnftnl/object.h>
51 +#include <libnftnl/flowtable.h>
52
53 #include <linux/netlink.h>
54 #include <linux/netfilter/nf_tables.h>
55 @@ -182,6 +183,9 @@ extern int netlink_delete_obj(struct net
56 extern int netlink_list_flowtables(struct netlink_ctx *ctx,
57 const struct handle *h,
58 const struct location *loc);
59 +extern int netlink_add_flowtable(struct netlink_ctx *ctx,
60 + const struct handle *h, struct flowtable *ft,
61 + uint32_t flags);
62
63 extern void netlink_dump_chain(const struct nftnl_chain *nlc,
64 struct netlink_ctx *ctx);
65 --- a/include/rule.h
66 +++ b/include/rule.h
67 @@ -322,10 +322,13 @@ uint32_t obj_type_to_cmd(uint32_t type);
68 struct flowtable {
69 struct list_head list;
70 struct handle handle;
71 + struct scope scope;
72 struct location location;
73 + const char * hookstr;
74 unsigned int hooknum;
75 int priority;
76 const char **dev_array;
77 + struct expr *dev_expr;
78 int dev_array_len;
79 unsigned int refcnt;
80 };
81 @@ -383,6 +386,8 @@ enum cmd_ops {
82 * @CMD_OBJ_CHAIN: chain
83 * @CMD_OBJ_CHAINS: multiple chains
84 * @CMD_OBJ_TABLE: table
85 + * @CMD_OBJ_FLOWTABLE: flowtable
86 + * @CMD_OBJ_FLOWTABLES: flowtables
87 * @CMD_OBJ_RULESET: ruleset
88 * @CMD_OBJ_EXPR: expression
89 * @CMD_OBJ_MONITOR: monitor
90 @@ -422,6 +427,7 @@ enum cmd_obj {
91 CMD_OBJ_CT_HELPERS,
92 CMD_OBJ_LIMIT,
93 CMD_OBJ_LIMITS,
94 + CMD_OBJ_FLOWTABLE,
95 CMD_OBJ_FLOWTABLES,
96 };
97
98 @@ -481,6 +487,7 @@ struct cmd {
99 struct rule *rule;
100 struct chain *chain;
101 struct table *table;
102 + struct flowtable *flowtable;
103 struct monitor *monitor;
104 struct markup *markup;
105 struct obj *object;
106 --- a/src/evaluate.c
107 +++ b/src/evaluate.c
108 @@ -2897,6 +2897,24 @@ static int set_evaluate(struct eval_ctx
109 return 0;
110 }
111
112 +static uint32_t str2hooknum(uint32_t family, const char *hook);
113 +
114 +static int flowtable_evaluate(struct eval_ctx *ctx, struct flowtable *ft)
115 +{
116 + struct table *table;
117 +
118 + table = table_lookup_global(ctx);
119 + if (table == NULL)
120 + return cmd_error(ctx, "Could not process rule: Table '%s' does not exist",
121 + ctx->cmd->handle.table);
122 +
123 + ft->hooknum = str2hooknum(NFPROTO_NETDEV, ft->hookstr);
124 + if (ft->hooknum == NF_INET_NUMHOOKS)
125 + return chain_error(ctx, ft, "invalid hook %s", ft->hookstr);
126 +
127 + return 0;
128 +}
129 +
130 static int rule_evaluate(struct eval_ctx *ctx, struct rule *rule)
131 {
132 struct stmt *stmt, *tstmt = NULL;
133 @@ -3069,6 +3087,14 @@ static int cmd_evaluate_add(struct eval_
134 return chain_evaluate(ctx, cmd->chain);
135 case CMD_OBJ_TABLE:
136 return table_evaluate(ctx, cmd->table);
137 + case CMD_OBJ_FLOWTABLE:
138 + ret = cache_update(ctx->nf_sock, ctx->cache, cmd->op,
139 + ctx->msgs, ctx->debug_mask & NFT_DEBUG_NETLINK, ctx->octx);
140 + if (ret < 0)
141 + return ret;
142 +
143 + handle_merge(&cmd->flowtable->handle, &cmd->handle);
144 + return flowtable_evaluate(ctx, cmd->flowtable);
145 case CMD_OBJ_COUNTER:
146 case CMD_OBJ_QUOTA:
147 case CMD_OBJ_CT_HELPER:
148 --- a/src/expression.c
149 +++ b/src/expression.c
150 @@ -663,8 +663,8 @@ struct expr *range_expr_alloc(const stru
151 return expr;
152 }
153
154 -static struct expr *compound_expr_alloc(const struct location *loc,
155 - const struct expr_ops *ops)
156 +struct expr *compound_expr_alloc(const struct location *loc,
157 + const struct expr_ops *ops)
158 {
159 struct expr *expr;
160
161 --- a/src/mnl.c
162 +++ b/src/mnl.c
163 @@ -1011,6 +1011,22 @@ err:
164 return NULL;
165 }
166
167 +int mnl_nft_flowtable_batch_add(struct nftnl_flowtable *flo,
168 + struct nftnl_batch *batch, unsigned int flags,
169 + uint32_t seqnum)
170 +{
171 + struct nlmsghdr *nlh;
172 +
173 + nlh = nftnl_nlmsg_build_hdr(nftnl_batch_buffer(batch),
174 + NFT_MSG_NEWFLOWTABLE,
175 + nftnl_flowtable_get_u32(flo, NFTNL_FLOWTABLE_FAMILY),
176 + NLM_F_CREATE | flags, seqnum);
177 + nftnl_flowtable_nlmsg_build_payload(nlh, flo);
178 + mnl_nft_batch_continue(batch);
179 +
180 + return 0;
181 +}
182 +
183 /*
184 * ruleset
185 */
186 --- a/src/netlink.c
187 +++ b/src/netlink.c
188 @@ -1773,6 +1773,64 @@ static struct obj *netlink_delinearize_o
189 return obj;
190 }
191
192 +static struct nftnl_flowtable *alloc_nftnl_flowtable(const struct handle *h,
193 + const struct flowtable *ft)
194 +{
195 + struct nftnl_flowtable *flo;
196 +
197 + flo = nftnl_flowtable_alloc();
198 + if (flo == NULL)
199 + memory_allocation_error();
200 +
201 + nftnl_flowtable_set_u32(flo, NFTNL_FLOWTABLE_FAMILY, h->family);
202 + nftnl_flowtable_set_str(flo, NFTNL_FLOWTABLE_TABLE, h->table);
203 + if (h->flowtable != NULL)
204 + nftnl_flowtable_set_str(flo, NFTNL_FLOWTABLE_NAME, h->flowtable);
205 +
206 + return flo;
207 +}
208 +
209 +static void netlink_dump_flowtable(struct nftnl_flowtable *flo,
210 + struct netlink_ctx *ctx)
211 +{
212 + FILE *fp = ctx->octx->output_fp;
213 +
214 + if (!(ctx->debug_mask & NFT_DEBUG_NETLINK) || !fp)
215 + return;
216 +
217 + nftnl_flowtable_fprintf(fp, flo, 0, 0);
218 + fprintf(fp, "\n");
219 +}
220 +
221 +int netlink_add_flowtable(struct netlink_ctx *ctx, const struct handle *h,
222 + struct flowtable *ft, uint32_t flags)
223 +{
224 + struct nftnl_flowtable *flo;
225 + const char *dev_array[8];
226 + struct expr *expr;
227 + int i = 0, err;
228 +
229 + flo = alloc_nftnl_flowtable(h, ft);
230 + nftnl_flowtable_set_u32(flo, NFTNL_FLOWTABLE_HOOKNUM, ft->hooknum);
231 + nftnl_flowtable_set_u32(flo, NFTNL_FLOWTABLE_PRIO, ft->priority);
232 +
233 + list_for_each_entry(expr, &ft->dev_expr->expressions, list)
234 + dev_array[i++] = expr->identifier;
235 +
236 + dev_array[i] = NULL;
237 + nftnl_flowtable_set_array(flo, NFTNL_FLOWTABLE_DEVICES, dev_array);
238 +
239 + netlink_dump_flowtable(flo, ctx);
240 +
241 + err = mnl_nft_flowtable_batch_add(flo, ctx->batch, flags, ctx->seqnum);
242 + if (err < 0)
243 + netlink_io_error(ctx, &ft->location, "Could not add flowtable: %s",
244 + strerror(errno));
245 + nftnl_flowtable_free(flo);
246 +
247 + return err;
248 +}
249 +
250 static int list_obj_cb(struct nftnl_obj *nls, void *arg)
251 {
252 struct netlink_ctx *ctx = arg;
253 --- a/src/parser_bison.y
254 +++ b/src/parser_bison.y
255 @@ -145,6 +145,7 @@ int nft_lex(void *, void *, void *);
256 struct expr *expr;
257 struct set *set;
258 struct obj *obj;
259 + struct flowtable *flowtable;
260 struct counter *counter;
261 struct quota *quota;
262 struct ct *ct;
263 @@ -189,6 +190,7 @@ int nft_lex(void *, void *, void *);
264
265 %token HOOK "hook"
266 %token DEVICE "device"
267 +%token DEVICES "devices"
268 %token TABLE "table"
269 %token TABLES "tables"
270 %token CHAIN "chain"
271 @@ -200,6 +202,7 @@ int nft_lex(void *, void *, void *);
272 %token ELEMENT "element"
273 %token MAP "map"
274 %token MAPS "maps"
275 +%token FLOWTABLE "flowtable"
276 %token HANDLE "handle"
277 %token RULESET "ruleset"
278 %token TRACE "trace"
279 @@ -500,9 +503,9 @@ int nft_lex(void *, void *, void *);
280 %type <cmd> base_cmd add_cmd replace_cmd create_cmd insert_cmd delete_cmd list_cmd reset_cmd flush_cmd rename_cmd export_cmd monitor_cmd describe_cmd import_cmd
281 %destructor { cmd_free($$); } base_cmd add_cmd replace_cmd create_cmd insert_cmd delete_cmd list_cmd reset_cmd flush_cmd rename_cmd export_cmd monitor_cmd describe_cmd import_cmd
282
283 -%type <handle> table_spec chain_spec chain_identifier ruleid_spec handle_spec position_spec rule_position ruleset_spec
284 -%destructor { handle_free(&$$); } table_spec chain_spec chain_identifier ruleid_spec handle_spec position_spec rule_position ruleset_spec
285 -%type <handle> set_spec set_identifier obj_spec obj_identifier
286 +%type <handle> table_spec chain_spec flowtable_spec chain_identifier ruleid_spec handle_spec position_spec rule_position ruleset_spec
287 +%destructor { handle_free(&$$); } table_spec chain_spec flowtable_spec chain_identifier ruleid_spec handle_spec position_spec rule_position ruleset_spec
288 +%type <handle> set_spec set_identifier flowtable_identifier obj_spec obj_identifier
289 %destructor { handle_free(&$$); } set_spec set_identifier obj_spec obj_identifier
290 %type <val> family_spec family_spec_explicit chain_policy prio_spec
291
292 @@ -526,6 +529,9 @@ int nft_lex(void *, void *, void *);
293 %type <set> map_block_alloc map_block
294 %destructor { set_free($$); } map_block_alloc
295
296 +%type <flowtable> flowtable_block_alloc flowtable_block
297 +%destructor { flowtable_free($$); } flowtable_block_alloc
298 +
299 %type <obj> obj_block_alloc counter_block quota_block ct_helper_block limit_block
300 %destructor { obj_free($$); } obj_block_alloc
301
302 @@ -606,8 +612,8 @@ int nft_lex(void *, void *, void *);
303 %type <expr> verdict_map_expr verdict_map_list_expr verdict_map_list_member_expr
304 %destructor { expr_free($$); } verdict_map_expr verdict_map_list_expr verdict_map_list_member_expr
305
306 -%type <expr> set_expr set_block_expr set_list_expr set_list_member_expr
307 -%destructor { expr_free($$); } set_expr set_block_expr set_list_expr set_list_member_expr
308 +%type <expr> set_expr set_block_expr set_list_expr set_list_member_expr flowtable_expr flowtable_list_expr flowtable_expr_member
309 +%destructor { expr_free($$); } set_expr set_block_expr set_list_expr set_list_member_expr flowtable_expr flowtable_list_expr flowtable_expr_member
310 %type <expr> set_elem_expr set_elem_expr_alloc set_lhs_expr set_rhs_expr
311 %destructor { expr_free($$); } set_elem_expr set_elem_expr_alloc set_lhs_expr set_rhs_expr
312 %type <expr> set_elem_expr_stmt set_elem_expr_stmt_alloc
313 @@ -872,6 +878,13 @@ add_cmd : TABLE table_spec
314 {
315 $$ = cmd_alloc(CMD_ADD, CMD_OBJ_SETELEM, &$2, &@$, $3);
316 }
317 + | FLOWTABLE flowtable_spec flowtable_block_alloc
318 + '{' flowtable_block '}'
319 + {
320 + $5->location = @5;
321 + handle_merge(&$3->handle, &$2);
322 + $$ = cmd_alloc(CMD_ADD, CMD_OBJ_FLOWTABLE, &$2, &@$, $5);
323 + }
324 | COUNTER obj_spec
325 {
326 struct obj *obj;
327 @@ -947,6 +960,13 @@ create_cmd : TABLE table_spec
328 {
329 $$ = cmd_alloc(CMD_CREATE, CMD_OBJ_SETELEM, &$2, &@$, $3);
330 }
331 + | FLOWTABLE flowtable_spec flowtable_block_alloc
332 + '{' flowtable_block '}'
333 + {
334 + $5->location = @5;
335 + handle_merge(&$3->handle, &$2);
336 + $$ = cmd_alloc(CMD_CREATE, CMD_OBJ_FLOWTABLE, &$2, &@$, $5);
337 + }
338 | COUNTER obj_spec
339 {
340 struct obj *obj;
341 @@ -1317,6 +1337,17 @@ table_block : /* empty */ { $$ = $<tabl
342 list_add_tail(&$4->list, &$1->sets);
343 $$ = $1;
344 }
345 +
346 + | table_block FLOWTABLE flowtable_identifier
347 + flowtable_block_alloc '{' flowtable_block '}'
348 + stmt_separator
349 + {
350 + $4->location = @3;
351 + handle_merge(&$4->handle, &$3);
352 + handle_free(&$3);
353 + list_add_tail(&$4->list, &$1->flowtables);
354 + $$ = $1;
355 + }
356 | table_block COUNTER obj_identifier
357 obj_block_alloc '{' counter_block '}'
358 stmt_separator
359 @@ -1512,6 +1543,62 @@ set_policy_spec : PERFORMANCE { $$ = NF
360 | MEMORY { $$ = NFT_SET_POL_MEMORY; }
361 ;
362
363 +flowtable_block_alloc : /* empty */
364 + {
365 + $$ = flowtable_alloc(NULL);
366 + }
367 + ;
368 +
369 +flowtable_block : /* empty */ { $$ = $<flowtable>-1; }
370 + | flowtable_block common_block
371 + | flowtable_block stmt_separator
372 + | flowtable_block HOOK STRING PRIORITY prio_spec stmt_separator
373 + {
374 + $$->hookstr = chain_hookname_lookup($3);
375 + if ($$->hookstr == NULL) {
376 + erec_queue(error(&@3, "unknown chain hook %s", $3),
377 + state->msgs);
378 + xfree($3);
379 + YYERROR;
380 + }
381 + xfree($3);
382 +
383 + $$->priority = $5;
384 + }
385 + | flowtable_block DEVICES '=' flowtable_expr stmt_separator
386 + {
387 + $$->dev_expr = $4;
388 + }
389 + ;
390 +
391 +flowtable_expr : '{' flowtable_list_expr '}'
392 + {
393 + $2->location = @$;
394 + $$ = $2;
395 + }
396 + ;
397 +
398 +flowtable_list_expr : flowtable_expr_member
399 + {
400 + $$ = compound_expr_alloc(&@$, NULL);
401 + compound_expr_add($$, $1);
402 + }
403 + | flowtable_list_expr COMMA flowtable_expr_member
404 + {
405 + compound_expr_add($1, $3);
406 + $$ = $1;
407 + }
408 + | flowtable_list_expr COMMA opt_newline
409 + ;
410 +
411 +flowtable_expr_member : STRING
412 + {
413 + $$ = symbol_expr_alloc(&@$, SYMBOL_VALUE,
414 + current_scope(state),
415 + $1);
416 + }
417 + ;
418 +
419 data_type_atom_expr : type_identifier
420 {
421 const struct datatype *dtype = datatype_lookup_byname($1);
422 @@ -1720,6 +1807,21 @@ set_identifier : identifier
423 }
424 ;
425
426 +
427 +flowtable_spec : table_spec identifier
428 + {
429 + $$ = $1;
430 + $$.flowtable = $2;
431 + }
432 + ;
433 +
434 +flowtable_identifier : identifier
435 + {
436 + memset(&$$, 0, sizeof($$));
437 + $$.flowtable = $1;
438 + }
439 + ;
440 +
441 obj_spec : table_spec identifier
442 {
443 $$ = $1;
444 --- a/src/rule.c
445 +++ b/src/rule.c
446 @@ -45,6 +45,8 @@ void handle_merge(struct handle *dst, co
447 dst->chain = xstrdup(src->chain);
448 if (dst->set == NULL && src->set != NULL)
449 dst->set = xstrdup(src->set);
450 + if (dst->flowtable == NULL && src->flowtable != NULL)
451 + dst->flowtable = xstrdup(src->flowtable);
452 if (dst->obj == NULL && src->obj != NULL)
453 dst->obj = xstrdup(src->obj);
454 if (dst->handle.id == 0)
455 @@ -857,6 +859,7 @@ struct cmd *cmd_alloc(enum cmd_ops op, e
456 void nft_cmd_expand(struct cmd *cmd)
457 {
458 struct list_head new_cmds;
459 + struct flowtable *ft;
460 struct table *table;
461 struct chain *chain;
462 struct rule *rule;
463 @@ -896,6 +899,14 @@ void nft_cmd_expand(struct cmd *cmd)
464 &set->location, set_get(set));
465 list_add_tail(&new->list, &new_cmds);
466 }
467 + list_for_each_entry(ft, &table->flowtables, list) {
468 + handle_merge(&ft->handle, &table->handle);
469 + memset(&h, 0, sizeof(h));
470 + handle_merge(&h, &ft->handle);
471 + new = cmd_alloc(CMD_ADD, CMD_OBJ_FLOWTABLE, &h,
472 + &ft->location, flowtable_get(ft));
473 + list_add_tail(&new->list, &new_cmds);
474 + }
475 list_for_each_entry(chain, &table->chains, list) {
476 list_for_each_entry(rule, &chain->rules, list) {
477 memset(&h, 0, sizeof(h));
478 @@ -982,6 +993,9 @@ void cmd_free(struct cmd *cmd)
479 case CMD_OBJ_LIMIT:
480 obj_free(cmd->object);
481 break;
482 + case CMD_OBJ_FLOWTABLE:
483 + flowtable_free(cmd->flowtable);
484 + break;
485 default:
486 BUG("invalid command object type %u\n", cmd->obj);
487 }
488 @@ -1071,6 +1085,9 @@ static int do_command_add(struct netlink
489 case CMD_OBJ_CT_HELPER:
490 case CMD_OBJ_LIMIT:
491 return netlink_add_obj(ctx, &cmd->handle, cmd->object, flags);
492 + case CMD_OBJ_FLOWTABLE:
493 + return netlink_add_flowtable(ctx, &cmd->handle, cmd->flowtable,
494 + flags);
495 default:
496 BUG("invalid command object type %u\n", cmd->obj);
497 }
498 --- a/src/scanner.l
499 +++ b/src/scanner.l
500 @@ -238,6 +238,7 @@ addrstring ({macaddr}|{ip4addr}|{ip6addr
501
502 "hook" { return HOOK; }
503 "device" { return DEVICE; }
504 +"devices" { return DEVICES; }
505 "table" { return TABLE; }
506 "tables" { return TABLES; }
507 "chain" { return CHAIN; }
508 @@ -249,6 +250,7 @@ addrstring ({macaddr}|{ip4addr}|{ip6addr
509 "element" { return ELEMENT; }
510 "map" { return MAP; }
511 "maps" { return MAPS; }
512 +"flowtable" { return FLOWTABLE; }
513 "handle" { return HANDLE; }
514 "ruleset" { return RULESET; }
515 "trace" { return TRACE; }
Staging tree of Zoltan Herpai