From: Florian Westphal <fw@strlen.de>
To: <netfilter-devel@vger.kernel.org>
Subject: [PATCH nft v2 00/10] add typeof keyword
Date: Fri, 13 Dec 2019 17:03:34 +0100 [thread overview]
Message-ID: <20191213160345.30057-1-fw@strlen.de> (raw)
This patch series adds the typeof keyword.
The only dependency is a small change to libnftnl to add two new
UDATA_SET_TYPEOF enum values.
named set can be configured as follows:
set os {
typeof osf name
elements = { "Linux", "Windows" }
}
or
nft add set ip filter allowed "{ typeof ip daddr . tcp dport; }"
... which is the same as the "old" 'type ipv4_addr . inet_service".
The type is stored in the kernel via the udata set infrastructure,
on listing -- if a udata type is present -- nft will validate that this
type matches the set key length.
Note that while 'typeof' can be used with concatenations, they
only work as aliases for known types -- its currently not possible
to use integer/string types via the 'typeof' keyword.
Doing so requires a bit more work to dissect the correct key
geometry on netlink dumps, we can also not fallback in this case,
i.e. if the typeof udata is not there/invalid, we would be
unable to reconstruct the needed subkey size information.
Florian Westphal (10):
parser: add a helper for concat expression handling
libnftnl: split nft_ctx_new/free
src: store expr, not dtype to track data in sets
src: parser: add syntax to provide size of variable-sized data types
src: add "typeof" print support
mnl: round up the map data size too
src: netlink: remove assertion
evaluate: print a hint about 'type,width' syntax on 0 keylen
doc: mention 'typeof' as alternative to 'type' keyword
tests: add typeof test cases
Pablo Neira Ayuso (1):
parser: add typeof keyword for declarations
23 files changed, 582 insertions(+), 154 deletions(-)
create mode 100644 tests/shell/testcases/maps/dumps/typeof_maps_0.nft
create mode 100755 tests/shell/testcases/maps/typeof_maps_0
create mode 100644 tests/shell/testcases/sets/dumps/typeof_sets_0.nft
create mode 100755 tests/shell/testcases/sets/typeof_sets_0
next reply other threads:[~2019-12-13 20:38 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-13 16:03 Florian Westphal [this message]
2019-12-13 16:03 ` [PATCH nft v2 01/11] parser: add a helper for concat expression handling Florian Westphal
2019-12-13 16:03 ` [PATCH nft v2 02/11] libnftnl: split nft_ctx_new/free Florian Westphal
2019-12-13 16:03 ` [PATCH nft v2 03/11] src: store expr, not dtype to track data in sets Florian Westphal
2019-12-13 16:03 ` [PATCH nft v2 04/11] src: parser: add syntax to provide size of variable-sized data types Florian Westphal
2019-12-13 16:03 ` [PATCH nft v2 05/11] parser: add typeof keyword for declarations Florian Westphal
2019-12-13 16:03 ` [PATCH nft v2 06/11] src: add "typeof" print support Florian Westphal
2019-12-13 16:03 ` [PATCH nft v2 07/11] mnl: round up the map data size too Florian Westphal
2019-12-13 16:03 ` [PATCH nft v2 08/11] src: netlink: remove assertion Florian Westphal
2019-12-13 16:03 ` [PATCH nft v2 09/11] evaluate: print a hint about 'type,width' syntax on 0 keylen Florian Westphal
2019-12-13 16:03 ` [PATCH nft v2 10/11] doc: mention 'typeof' as alternative to 'type' keyword Florian Westphal
2019-12-13 16:03 ` [PATCH nft v2 11/11] tests: add typeof test cases Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191213160345.30057-1-fw@strlen.de \
--to=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox