Re: [PATCH nf-next v2] netfilter: nf_tables: add math expression support

[Fernando Fernandez Mancera <fmancera@suse.de>]

On 11/3/25 3:31 PM, Fernando Fernandez Mancera wrote:
> Historically, users have requested support for increasing and decreasing
> TTL value in nftables in order to migrate from iptables.
> 
> Following the nftables spirit of flexible and multipurpose expressions,
> this patch introduces "nft_math" expression. This expression allows to
> increase and decrease u32, u16 and u8 values stored in the nftables
> registers.
> 
> The math expression intends to be flexible enough in case it needs to be
> extended in the future, e.g implement bitfields operations. For this
> reason, the length of the data is indicated in bits instead of bytes.
> 
> When loading a u8 or u16 payload into a register we don't know if the
> value is stored at least significant byte or most significant byte. In
> order to handle such cases, introduce a bitmask indicating what is the
> target bit and also use it to handle limits to prevent overflow.
> 
> This implementation comes with a libnftnl patch that allows the user to
> generate the following example bytecodes:
> 
> - Bytecode to increase the TTL of a packet
> 
> table filter inet flags 0 use 1 handle 3
> inet filter input use 1 type filter hook input prio 0 policy accept packets 0 bytes 0 flags 1
> inet filter input 4
>    [ payload load 2b @ network header + 8 => reg 1 ]
>    [ math 8 bits mask 0x000000ff reg 1 + 1 => 1]
>    [ payload write reg 1 => 2b @ network header + 8 csum_type 1 csum_off 10 csum_flags 0x0 ]
> 
> - Bytecode to decrease the TTL of a packet
> 
> table filter inet flags 0 use 1 handle 3
> inet filter input use 1 type filter hook input prio 0 policy accept packets 0 bytes 0 flags 1
> inet filter input 4
>    [ payload load 2b @ network header + 8 => reg 1 ]
>    [ math 8 bits mask 0x000000ff reg 1 - 1 => 1]
>    [ payload write reg 1 => 2b @ network header + 8 csum_type 1 csum_off 10 csum_flags 0x0 ]
> 
> - Bytecode to increase the meta mark of a packet
> 
> table mangle inet flags 0 use 1 handle 6
> inet mangle output use 1 type filter hook output prio 0 policy accept packets 0 bytes 0 flags 1
> inet mangle output 2
>    [ meta load mark => reg 1 ]
>    [ math 32 bits reg 1 + 1 => 1]
>    [ meta set mark with reg 1 ]
> 
> Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
> ---
> v2: dropped the byteorder netlink attribute, added bitmask to handle
> LSB/MSB when dealing with u8 and u16, simplified eval logic. I've kept
> nft_math as module, IMHO it would be too much to make it built-in.
> ---

Ugh, I forgot to run ./scripts/checkpatch.pl against this patch, there 
are several warnings. No need to go over them during review, I fixed 
them already and will be included in a v3 :-)

Thanks,
Fernando.