1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
|
#ifndef NFTABLES_EXPRESSION_H
#define NFTABLES_EXPRESSION_H
#include <stdbool.h>
#include <gmputil.h>
#include <linux/netfilter/nf_tables.h>
#include <nftables.h>
#include <datatype.h>
#include <utils.h>
#include <list.h>
/**
* enum expr_types
*
* @EXPR_INVALID: uninitialized type, should not happen
* @EXPR_VERDICT: nftables verdict expression
* @EXPR_SYMBOL: unparsed symbol
* @EXPR_VALUE: literal numeric or string expression
* @EXPR_PREFIX: prefixed expression
* @EXPR_RANGE: literal range
* @EXPR_PAYLOAD: payload expression
* @EXPR_EXTHDR: exthdr expression
* @EXPR_META: meta expression
* @EXPR_CT: conntrack expression
* @EXPR_CONCAT: concatenation
* @EXPR_LIST: list of expressions
* @EXPR_SET: literal set
* @EXPR_SET_REF: set reference
* @EXPR_SET_ELEM: set element
* @EXPR_MAPPING: a single mapping (key : value)
* @EXPR_MAP: map operation (expr map { EXPR_MAPPING, ... })
* @EXPR_UNARY: byteorder conversion, generated during evaluation
* @EXPR_BINOP: binary operations (bitwise, shifts)
* @EXPR_RELATIONAL: equality and relational expressions
* @EXPR_NUMGEN: number generation expression
* @EXPR_HASH: hash expression
* @EXPR_RT: routing expression
*/
enum expr_types {
EXPR_INVALID,
EXPR_VERDICT,
EXPR_SYMBOL,
EXPR_VALUE,
EXPR_PREFIX,
EXPR_RANGE,
EXPR_PAYLOAD,
EXPR_EXTHDR,
EXPR_META,
EXPR_CT,
EXPR_CONCAT,
EXPR_LIST,
EXPR_SET,
EXPR_SET_REF,
EXPR_SET_ELEM,
EXPR_MAPPING,
EXPR_MAP,
EXPR_UNARY,
EXPR_BINOP,
EXPR_RELATIONAL,
EXPR_NUMGEN,
EXPR_HASH,
EXPR_RT,
EXPR_FIB,
};
enum ops {
OP_INVALID,
OP_IMPLICIT,
/* Unary operations */
OP_HTON,
OP_NTOH,
/* Binary operations */
OP_LSHIFT,
OP_RSHIFT,
OP_AND,
OP_XOR,
OP_OR,
/* Relational operations */
OP_EQ,
OP_NEQ,
OP_LT,
OP_GT,
OP_LTE,
OP_GTE,
/* Range comparison */
OP_RANGE,
/* Flag comparison */
OP_FLAGCMP,
/* Set lookup */
OP_LOOKUP,
__OP_MAX
};
#define OP_MAX (__OP_MAX - 1)
extern const char *expr_op_symbols[];
enum symbol_types {
SYMBOL_VALUE,
SYMBOL_DEFINE,
SYMBOL_SET,
};
/**
* struct expr_ctx - type context for symbol parsing during evaluation
*
* @dtype: expected datatype
* @byteorder: expected byteorder
* @len: expected len
* @maxval: expected maximum value
*/
struct expr_ctx {
const struct datatype *dtype;
enum byteorder byteorder;
unsigned int len;
unsigned int maxval;
};
static inline void __expr_set_context(struct expr_ctx *ctx,
const struct datatype *dtype,
enum byteorder byteorder,
unsigned int len, unsigned int maxval)
{
ctx->dtype = dtype;
ctx->byteorder = byteorder;
ctx->len = len;
ctx->maxval = maxval;
}
static inline void expr_set_context(struct expr_ctx *ctx,
const struct datatype *dtype,
unsigned int len)
{
__expr_set_context(ctx, dtype,
dtype ? dtype->byteorder : BYTEORDER_INVALID,
len, 0);
}
/**
* struct expr_ops
*
* @type: expression type
* @name: expression name for diagnostics
* @clone: function to clone type specific data
* @destroy: destructor, must release inner expressions
* @set_type: function to promote type and byteorder of inner types
* @print: function to print the expression
* @cmp: function to compare two expressions of the same types
* @pctx_update:update protocol context
*/
struct proto_ctx;
struct expr_ops {
enum expr_types type;
const char *name;
void (*clone)(struct expr *new, const struct expr *expr);
void (*destroy)(struct expr *expr);
void (*set_type)(const struct expr *expr,
const struct datatype *dtype,
enum byteorder byteorder);
void (*print)(const struct expr *expr,
struct output_ctx *octx);
bool (*cmp)(const struct expr *e1,
const struct expr *e2);
void (*pctx_update)(struct proto_ctx *ctx,
const struct expr *expr);
};
/**
* enum expr_flags
*
* @EXPR_F_CONSTANT: constant expression
* @EXPR_F_SINGLETON: singleton (implies primary and constant)
* @EXPR_F_PROTOCOL: expressions describes upper layer protocol
* @EXPR_F_INTERVAL_END: set member ends an open interval
* @EXPR_F_BOOLEAN: expression is boolean (set by relational expr on LHS)
*/
enum expr_flags {
EXPR_F_CONSTANT = 0x1,
EXPR_F_SINGLETON = 0x2,
EXPR_F_PROTOCOL = 0x4,
EXPR_F_INTERVAL_END = 0x8,
EXPR_F_BOOLEAN = 0x10,
};
#include <payload.h>
#include <exthdr.h>
#include <fib.h>
#include <numgen.h>
#include <meta.h>
#include <rt.h>
#include <hash.h>
#include <ct.h>
/**
* struct expr
*
* @list: list node
* @location: location from parser
* @refcnt: reference count
* @flags: mask of enum expr_flags
* @dtype: data type of expression
* @byteorder: byteorder of expression
* @len: length of expression
* @ops: expression ops
* @op: operation for unary, binary and relational expressions
* @union: type specific data
*/
struct expr {
struct list_head list;
struct location location;
unsigned int refcnt;
unsigned int flags;
const struct datatype *dtype;
enum byteorder byteorder;
unsigned int len;
const struct expr_ops *ops;
enum ops op;
union {
struct {
/* EXPR_SYMBOL */
const struct scope *scope;
const char *identifier;
enum symbol_types symtype;
};
struct {
/* EXPR_VERDICT */
int verdict;
const char *chain;
};
struct {
/* EXPR_VALUE */
mpz_t value;
};
struct {
/* EXPR_PREFIX */
struct expr *prefix;
unsigned int prefix_len;
};
struct {
/* EXPR_CONCAT, EXPR_LIST, EXPR_SET */
struct list_head expressions;
unsigned int size;
uint32_t set_flags;
};
struct {
/* EXPR_SET_REF */
struct set *set;
};
struct {
/* EXPR_SET_ELEM */
struct expr *key;
uint64_t timeout;
uint64_t expiration;
const char *comment;
struct stmt *stmt;
uint32_t elem_flags;
};
struct {
/* EXPR_UNARY */
struct expr *arg;
};
struct {
/* EXPR_RANGE, EXPR_BINOP, EXPR_MAPPING, EXPR_RELATIONAL */
struct expr *left;
struct expr *right;
};
struct {
/* EXPR_MAP */
struct expr *map;
struct expr *mappings;
};
struct {
/* EXPR_PAYLOAD */
const struct proto_desc *desc;
const struct proto_hdr_template *tmpl;
enum proto_bases base;
unsigned int offset;
} payload;
struct {
/* EXPR_EXTHDR */
const struct exthdr_desc *desc;
const struct proto_hdr_template *tmpl;
unsigned int offset;
enum nft_exthdr_op op;
unsigned int flags;
} exthdr;
struct {
/* EXPR_META */
enum nft_meta_keys key;
enum proto_bases base;
} meta;
struct {
/* EXPR_RT */
enum nft_rt_keys key;
} rt;
struct {
/* EXPR_CT */
enum nft_ct_keys key;
enum proto_bases base;
int8_t direction;
uint8_t nfproto;
} ct;
struct {
/* EXPR_NUMGEN */
enum nft_ng_types type;
uint32_t mod;
uint32_t offset;
} numgen;
struct {
/* EXPR_HASH */
struct expr *expr;
uint32_t mod;
bool seed_set;
uint32_t seed;
uint32_t offset;
enum nft_hash_types type;
} hash;
struct {
/* EXPR_FIB */
uint32_t flags;
uint32_t result;
} fib;
};
};
extern struct expr *expr_alloc(const struct location *loc,
const struct expr_ops *ops,
const struct datatype *dtype,
enum byteorder byteorder, unsigned int len);
extern struct expr *expr_clone(const struct expr *expr);
extern struct expr *expr_get(struct expr *expr);
extern void expr_free(struct expr *expr);
extern void expr_print(const struct expr *expr, struct output_ctx *octx);
extern bool expr_cmp(const struct expr *e1, const struct expr *e2);
extern void expr_describe(const struct expr *expr, struct output_ctx *octx);
extern const struct datatype *expr_basetype(const struct expr *expr);
extern void expr_set_type(struct expr *expr, const struct datatype *dtype,
enum byteorder byteorder);
struct eval_ctx;
extern int expr_binary_error(struct list_head *msgs,
const struct expr *e1, const struct expr *e2,
const char *fmt, ...) __gmp_fmtstring(4, 5);
#define expr_error(msgs, expr, fmt, args...) \
expr_binary_error(msgs, expr, NULL, fmt, ## args)
static inline bool expr_is_constant(const struct expr *expr)
{
return expr->flags & EXPR_F_CONSTANT ? true : false;
}
static inline bool expr_is_singleton(const struct expr *expr)
{
return expr->flags & EXPR_F_SINGLETON ? true : false;
}
extern struct expr *unary_expr_alloc(const struct location *loc,
enum ops op, struct expr *arg);
extern struct expr *binop_expr_alloc(const struct location *loc, enum ops op,
struct expr *left, struct expr *right);
extern struct expr *relational_expr_alloc(const struct location *loc, enum ops op,
struct expr *left, struct expr *right);
extern void relational_expr_pctx_update(struct proto_ctx *ctx,
const struct expr *expr);
extern struct expr *verdict_expr_alloc(const struct location *loc,
int verdict, const char *chain);
extern struct expr *symbol_expr_alloc(const struct location *loc,
enum symbol_types type, struct scope *scope,
const char *identifier);
static inline void symbol_expr_set_type(struct expr *expr,
const struct datatype *dtype)
{
if (expr->ops->type == EXPR_SYMBOL)
expr->dtype = dtype;
}
extern struct expr *constant_expr_alloc(const struct location *loc,
const struct datatype *dtype,
enum byteorder byteorder,
unsigned int len, const void *data);
extern struct expr *constant_expr_join(const struct expr *e1,
const struct expr *e2);
extern struct expr *constant_expr_splice(struct expr *expr, unsigned int len);
extern struct expr *flag_expr_alloc(const struct location *loc,
const struct datatype *dtype,
enum byteorder byteorder,
unsigned int len, unsigned long n);
extern struct expr *bitmask_expr_to_binops(struct expr *expr);
extern struct expr *prefix_expr_alloc(const struct location *loc,
struct expr *expr,
unsigned int prefix_len);
extern struct expr *range_expr_alloc(const struct location *loc,
struct expr *low, struct expr *high);
extern void compound_expr_add(struct expr *compound, struct expr *expr);
extern void compound_expr_remove(struct expr *compound, struct expr *expr);
extern void list_expr_sort(struct list_head *head);
extern struct expr *concat_expr_alloc(const struct location *loc);
extern struct expr *list_expr_alloc(const struct location *loc);
extern struct expr *set_expr_alloc(const struct location *loc,
const struct set *set);
extern int set_to_intervals(struct list_head *msgs, struct set *set,
struct expr *init, bool add,
unsigned int debug_mask, bool merge);
extern void interval_map_decompose(struct expr *set);
extern struct expr *mapping_expr_alloc(const struct location *loc,
struct expr *from, struct expr *to);
extern struct expr *map_expr_alloc(const struct location *loc,
struct expr *arg, struct expr *list);
extern struct expr *set_ref_expr_alloc(const struct location *loc,
struct set *set);
extern struct expr *set_elem_expr_alloc(const struct location *loc,
struct expr *key);
extern void range_expr_value_low(mpz_t rop, const struct expr *expr);
extern void range_expr_value_high(mpz_t rop, const struct expr *expr);
#endif /* NFTABLES_EXPRESSION_H */
|