Introduce a new nested netlink attribute, NFTA_SET_DESC_CONCAT, used to specify the length of each field in a set concatenation. This allows set implementations to support concatenation of multiple ranged items, as they can divide the input key into matching data for every single field. Such set implementations would be selected as they specify support for NFT_SET_INTERVAL and allow desc->field_count to be greater than one. Explicitly disallow this for nft_set_rbtree. In order to specify the interval for a set entry, userspace would include in NFTA_SET_DESC_CONCAT attributes field lengths, and pass range endpoints as two separate keys, represented by attributes NFTA_SET_ELEM_KEY and NFTA_SET_ELEM_KEY_END. While at it, export the number of 32-bit registers available for packet matching, as nftables will need this to know the maximum number of field lengths that can be specified. For example, "packets with an IPv4 address between 192.0.2.0 and 192.0.2.42, with destination port between 22 and 25", can be expressed as two concatenated elements: NFTA_SET_ELEM_KEY: 192.0.2.0 . 22 NFTA_SET_ELEM_KEY_END: 192.0.2.42 . 25 and NFTA_SET_DESC_CONCAT attribute would contain: NFTA_LIST_ELEM NFTA_SET_FIELD_LEN: 4 NFTA_LIST_ELEM NFTA_SET_FIELD_LEN: 2 v4: No changes v3: Complete rework, NFTA_SET_DESC_CONCAT instead of NFTA_SET_SUBKEY v2: No changes
Showing the changes to include/uapi/linux (1 of 4 files). Show all
Unified · Split
| @@ -48,6 +48,7 @@ enum nft_registers { · 47 unmodified lines | |||
| 48 | 48 | ||
| 49 | #define NFT_REG_SIZE 16 | 49 | #define NFT_REG_SIZE 16 |
| 50 | #define NFT_REG32_SIZE 4 | 50 | #define NFT_REG32_SIZE 4 |
| 51 | #define NFT_REG32_COUNT (NFT_REG32_15 - NFT_REG32_00 + 1) | ||
| 51 | 52 | ||
| 52 | /** | 53 | /** |
| 53 | * enum nft_verdicts - nf_tables internal verdicts | 54 | * enum nft_verdicts - nf_tables internal verdicts |
| @@ -301,14 +302,28 @@ enum nft_set_policies { · 247 unmodified lines | |||
| 301 | * enum nft_set_desc_attributes - set element description | 302 | * enum nft_set_desc_attributes - set element description |
| 302 | * | 303 | * |
| 303 | * @NFTA_SET_DESC_SIZE: number of elements in set (NLA_U32) | 304 | * @NFTA_SET_DESC_SIZE: number of elements in set (NLA_U32) |
| 305 | * @NFTA_SET_DESC_CONCAT: description of field concatenation (NLA_NESTED) | ||
| 304 | */ | 306 | */ |
| 305 | enum nft_set_desc_attributes { | 307 | enum nft_set_desc_attributes { |
| 306 | NFTA_SET_DESC_UNSPEC, | 308 | NFTA_SET_DESC_UNSPEC, |
| 307 | NFTA_SET_DESC_SIZE, | 309 | NFTA_SET_DESC_SIZE, |
| 310 | NFTA_SET_DESC_CONCAT, | ||
| 308 | __NFTA_SET_DESC_MAX | 311 | __NFTA_SET_DESC_MAX |
| 309 | }; | 312 | }; |
| 310 | #define NFTA_SET_DESC_MAX (__NFTA_SET_DESC_MAX - 1) | 313 | #define NFTA_SET_DESC_MAX (__NFTA_SET_DESC_MAX - 1) |
| 311 | 314 | ||
| 315 | /** | ||
| 316 | * enum nft_set_field_attributes - attributes of concatenated fields | ||
| 317 | * | ||
| 318 | * @NFTA_SET_FIELD_LEN: length of single field, in bits (NLA_U32) | ||
| 319 | */ | ||
| 320 | enum nft_set_field_attributes { | ||
| 321 | NFTA_SET_FIELD_UNSPEC, | ||
| 322 | NFTA_SET_FIELD_LEN, | ||
| 323 | __NFTA_SET_FIELD_MAX | ||
| 324 | }; | ||
| 325 | #define NFTA_SET_FIELD_MAX (__NFTA_SET_FIELD_MAX - 1) | ||
| 326 | |||
| 312 | /** | 327 | /** |
| 313 | * enum nft_set_attributes - nf_tables set netlink attributes | 328 | * enum nft_set_attributes - nf_tables set netlink attributes |
| 314 | * | 329 | * |