On Thu, May 12, 2022 at 02:30:02PM +0200, Phil Sutter wrote:
> Allow dumping some info bits about expressions to user space.
>
> Signed-off-by: Phil Sutter <phil@xxxxxx>
> ---
> include/net/netfilter/nf_tables.h | 1 +
> include/uapi/linux/netfilter/nf_tables.h | 1 +
> net/netfilter/nf_tables_api.c | 4 ++++
> 3 files changed, 6 insertions(+)
>
> diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
> index 20af9d3557b9d..78db54737de00 100644
> --- a/include/net/netfilter/nf_tables.h
> +++ b/include/net/netfilter/nf_tables.h
> @@ -346,6 +346,7 @@ struct nft_set_estimate {
> */
> struct nft_expr {
> const struct nft_expr_ops *ops;
> + u32 flags;
Could you add a new structure? Add struct nft_expr_dp and use it from
nft_rule_dp, so it is only the control plan representation that stores
this flag.
It will be a bit more work, but I think it is worth to keep the size
of the datapath representation as small as possible.
> unsigned char data[]
> __attribute__((aligned(__alignof__(u64))));
> };
> diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
> index 466fd3f4447c2..36bf019322a44 100644
> --- a/include/uapi/linux/netfilter/nf_tables.h
> +++ b/include/uapi/linux/netfilter/nf_tables.h
> @@ -518,6 +518,7 @@ enum nft_expr_attributes {
> NFTA_EXPR_UNSPEC,
> NFTA_EXPR_NAME,
> NFTA_EXPR_DATA,
> + NFTA_EXPR_FLAGS,
> __NFTA_EXPR_MAX
> };
> #define NFTA_EXPR_MAX (__NFTA_EXPR_MAX - 1)
> diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> index f3ad02a399f8a..fddc557983119 100644
> --- a/net/netfilter/nf_tables_api.c
> +++ b/net/netfilter/nf_tables_api.c
> @@ -2731,6 +2731,7 @@ static const struct nft_expr_type *nft_expr_type_get(struct net *net,
> static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
> [NFTA_EXPR_NAME] = { .type = NLA_STRING,
> .len = NFT_MODULE_AUTOLOAD_LIMIT },
> + [NFTA_EXPR_FLAGS] = { .type = NLA_U32 },
> [NFTA_EXPR_DATA] = { .type = NLA_NESTED },
> };
>
> @@ -2740,6 +2741,9 @@ static int nf_tables_fill_expr_info(struct sk_buff *skb,
> if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
> goto nla_put_failure;
>
> + if (nla_put_u32(skb, NFTA_EXPR_FLAGS, expr->flags))
> + goto nla_put_failure;
> +
> if (expr->ops->dump) {
> struct nlattr *data = nla_nest_start_noflag(skb,
> NFTA_EXPR_DATA);
> --
> 2.34.1
>
