From c5ecdbf752ce0505a6696489d6df03b88cb56b0a Mon Sep 17 00:00:00 2001 From: Laura Garcia Liebana Date: Thu, 15 Mar 2018 09:23:21 +0100 Subject: src: support of dynamic map addition and update of elements The support of dynamic adds and updates are only available for sets and meters. This patch gives such abilities to maps as well. This patch is useful in cases where dynamic population of maps are required, for example, to maintain a persistence during some period of time. Example: table ip nftlb { map persistencia { type ipv4_addr : mark timeout 1h elements = { 192.168.1.132 expires 59m55s : 0x00000064, 192.168.56.101 expires 59m24s : 0x00000065 } } chain pre { type nat hook prerouting priority 0; policy accept; map update \ { @nh,96,32 : numgen inc mod 2 offset 100 } @persistencia } } An example of the netlink generated sequence: nft --debug=netlink add rule ip nftlb pre map add \ { ip saddr : numgen inc mod 2 offset 100 } @persistencia ip nftlb pre [ payload load 4b @ network header + 12 => reg 1 ] [ numgen reg 2 = inc mod 2 offset 100 ] [ dynset add reg_key 1 set persistencia sreg_data 2 ] Signed-off-by: Laura Garcia Liebana Signed-off-by: Pablo Neira Ayuso --- src/statement.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) (limited to 'src/statement.c') diff --git a/src/statement.c b/src/statement.c index 701337d7..61ba643b 100644 --- a/src/statement.c +++ b/src/statement.c @@ -639,6 +639,34 @@ struct stmt *set_stmt_alloc(const struct location *loc) return stmt_alloc(loc, &set_stmt_ops); } +static void map_stmt_print(const struct stmt *stmt, struct output_ctx *octx) +{ + nft_print(octx, "%s map { ", set_stmt_op_names[stmt->map.op]); + expr_print(stmt->map.map->map->key, octx); + nft_print(octx, " : "); + expr_print(stmt->map.map->mappings, octx); + nft_print(octx, " } "); + expr_print(stmt->map.set, octx); +} + +static void map_stmt_destroy(struct stmt *stmt) +{ + expr_free(stmt->map.map); + expr_free(stmt->map.set); +} + +static const struct stmt_ops map_stmt_ops = { + .type = STMT_MAP, + .name = "map", + .print = map_stmt_print, + .destroy = map_stmt_destroy, +}; + +struct stmt *map_stmt_alloc(const struct location *loc) +{ + return stmt_alloc(loc, &map_stmt_ops); +} + static void dup_stmt_print(const struct stmt *stmt, struct output_ctx *octx) { nft_print(octx, "dup"); -- cgit v1.2.3