nf_tables string match support

RFC PATCH New Pablo Neira Ayuso 2 participants 7 messages Jul 29, 2022

Subsystems (2)

Networking netfilter

lore

Share & tools

lore

Pablo Neira Ayuso

author maintainer

2022-07-29 09:31 UTC #0 lore raw

cover nf_tables string match support

Hi,

The following patchset contains nf_tables string match support. This new infrastructure is based on the Aho-Corasick pattern match algorithm, which allows for linear search of a dictionary (a "string set" composed of patterns). The implementation is lockless by performing updates on a cloned copy of the Aho-Corasick "tree" use the existing 2-phase commit protocol to atomically expose the new tree to the packet patch.

I decided to add new netlink API for "string set" rather than reusing the existing set API for simplicity. There is a new Kconfig knob CONFIG_NFT_STRING to enable built-in support into nf_tables to avoid an indirection between nf_tables_api and nft_string given that the Aho-Corasick API (see ac_*() functions) are invoked from the nf_tables netlink frontend.

The implementation of Aho-Corasick comes as a separated file, it is relatively small (~600 LoC), and a dictionary of 370105 English words consumes ~150 Mbytes. Maximum string size at this stage is 128 bytes.

The implementation has been validated from userspace via ASAN and valgrind with testsuites consisting simple tests combined with random feeding the dictionary with words and autogenerated text patched with a matching at a random offset to validate correct matching. The userspace implementation (rather similarly to the one coming in this batch) and the testsuite is not posted in this batch.

This algorithm is described in "Efficient string matching: An aid to bibliographic search" by Alfred V. Aho and Margaret J. Corasick (published in June 1975) at Communications of the ACM 18 (6): 333–340.

There is a few aspect I would like to revisit after this RFC, eg. netlink notifications are not yet supported.

Please, see specific patch descriptions for implementation details.

Comments welcome.

P.S: Patch 2 reports 200 deletions on nf_tables_api.c. For some reason
diff is removing 200 LoC and adding them again after the new netlink string API, there are not real line removals, it is just noise.

Pablo Neira Ayuso (3):
netfilter: add Aho-Corasick string match implementation
netfilter: nf_tables: add string set API
netfilter: nf_tables: add string expression

 include/net/netfilter/ahocorasick.h      |   27 +
 include/net/netfilter/nf_tables.h        |   37 +
 include/net/netfilter/nf_tables_core.h   |    1 +
 include/uapi/linux/netfilter/nf_tables.h |   65 ++
 net/netfilter/Kconfig                    |    7 +
 net/netfilter/Makefile                   |    3 +
 net/netfilter/ahocorasick.c              |  677 ++++++++++++
 net/netfilter/nf_tables_api.c            | 1287 ++++++++++++++++++----
 net/netfilter/nf_tables_core.c           |    1 +
 net/netfilter/nft_string.c               |  254 +++++
 10 files changed, 2158 insertions(+), 201 deletions(-)
 create mode 100644 include/net/netfilter/ahocorasick.h
 create mode 100644 net/netfilter/ahocorasick.c
 create mode 100644 net/netfilter/nft_string.c

Signature · 1 line

2.30.2

Pablo Neira Ayuso

author maintainer

2022-07-29 09:31 UTC #1 lore raw

RFC PATCH 1/3 netfilter: add Aho-Corasick string match implementation

This implementation uses a tree of arrays for constant access time at pattern search time. The tree is composed of two type of state nodes:

- Normal state, that has an array of edge pointers to the next state. The current matching character is used as the array index to access the next state.

- Final state has no edge pointers, it represents the last state for a matching pattern. Final state provides an output field which specifies the number of bytes that have been matched.

Additionally, a normal state might also have a output field. This implementation allows to store two words with the same prefix pattern in the tree, the search algorithm stops at the shortest length pattern match.

Each state also has a fail pointer to backtrack in the tree states in case of mismatching, so this tree is actually a graph that represents a state-machine.

The implementation provides no specific locking mechanism, it is up to the user to protect this data structure from concurrent access. Nftables follows a lockless approach by allowing updates on a clone, then use RCU to replace the stale tree by the updated clone from the commit phase.

An internal stack is used to iterate over the tree nodes to avoid recursive calls, to delete patterns and to walk the tree.

Maximum string size is 128 bytes.

A dictionary of 370105 English words consumes ~150 Mbytes.

Signed-off-by Pablo Neira Ayuso <[email protected]>

---
 include/net/netfilter/ahocorasick.h |  27 ++
 net/netfilter/Kconfig               |   7 +
 net/netfilter/Makefile              |   2 +
 net/netfilter/ahocorasick.c         | 677 ++++++++++++++++++++++++++++
 4 files changed, 713 insertions(+)
 create mode 100644 include/net/netfilter/ahocorasick.h
 create mode 100644 net/netfilter/ahocorasick.c

include/net/netfilter/ahocorasick.h new file +27 -0

new file mode 100644
index 000000000000..2e7795912558
@@ -0,0 +1,27 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+#ifndef _NET_NF_AHOCORASICK_H
+#define _NET_NF_AHOCORASICK_H
+
+#define AC_MAXLEN	128
+
+struct ac_tree;
+
+struct ac_tree *ac_create(void);
+void ac_destroy(struct ac_tree *tree);
+
+int ac_add(struct ac_tree *tree, const char *word, uint32_t len, bool create);
+void ac_del(struct ac_tree *tree, const char *word, uint32_t len);
+int ac_resolve_fail(struct ac_tree *tree);
+
+int ac_find(struct ac_tree *tree, const char *text, size_t text_len);
+bool ac_find_word(struct ac_tree *tree, const char *word, uint32_t len);
+
+struct ac_iter;
+
+struct ac_iter *ac_iter_create(struct ac_tree *tree);
+int ac_iterate(struct ac_iter *iter, int (*cb)(const char *word, void *data), void *data);
+void ac_iter_destroy(struct ac_iter *ctx);
+
+struct ac_tree *ac_clone(struct ac_tree *tree);
+
+#endif

net/netfilter/Kconfig +7 -0

index ddc54b6d18ee..383af17f0399 100644
@@ -662,6 +662,13 @@ config NFT_TPROXY
 	help
 	  This makes transparent proxy support available in nftables.
 
+config NFT_STRING
+	bool "Netfilter nf_tables string expression support"
+	help
+	   The string expression allows you to look for pattern matchings in
+	   packets using an implementation of Aho-Corasick string matching
+	   algorithm.
+
 config NFT_SYNPROXY
 	tristate "Netfilter nf_tables SYNPROXY expression support"
 	depends on NF_CONNTRACK && NETFILTER_ADVANCED

net/netfilter/Makefile +2 -0

index 238b6a620e88..18127c83b88c 100644
@@ -90,6 +90,8 @@ nf_tables-objs += nft_set_pipapo_avx2.o
 endif
 endif
 
+nf_tables-$(CONFIG_NFT_STRING)	+= ahocorasick.o
+
 obj-$(CONFIG_NF_TABLES)		+= nf_tables.o
 obj-$(CONFIG_NFT_COMPAT)	+= nft_compat.o
 obj-$(CONFIG_NFT_CONNLIMIT)	+= nft_connlimit.o

net/netfilter/ahocorasick.c new file +677 -0

677 lines not on this page · raw message

Signature · 1 line

2.30.2

Pablo Neira Ayuso

author maintainer

2022-07-29 09:31 UTC #2 lore raw

RFC PATCH 2/3 netfilter: nf_tables: add string set API

In reply to Pablo Neira Ayuso

This patch adds 6 new netlink commands for the nftables API:

- NFT_MSG_NEWSTRSET, to create a new string set.
- NFT_MSG_DELSTRSET, to delete an existing string set.
- NFT_MSG_GETSTRSET, to fetch the list of existing string sets.
- NFT_MSG_NEWSTRING, to add patterns to a string set.
- NFT_MSG_DELSTRING, to delete patterns to a string set.
- NFT_MSG_GETSTRING, to fetch the patterns in an existing string set.

This API uses the Aho-Corasick implementation coming in the previous patch. String sets stores two versions of the Aho-Corasick tree: the active tree which is currently used to search for patterns and the clone which is used for pending updates.

Tree updates are performed under per-netns nftables mutex, the tree pointer is protected/accessed through RCU. There is a commit_update field that specifies that there is a updated clone to replace the stale tree from the commit step of the 2-phase commit protocol.

Signed-off-by Pablo Neira Ayuso <[email protected]>

---
 include/net/netfilter/nf_tables.h        |   33 +
 include/uapi/linux/netfilter/nf_tables.h |   39 +
 net/netfilter/nf_tables_api.c            | 1286 ++++++++++++++++++----
 3 files changed, 1158 insertions(+), 200 deletions(-)

include/net/netfilter/nf_tables.h +33 -0

index 64cf655c818c..c4e9a969122a 100644
@@ -1158,6 +1158,7 @@ struct nft_table {
 	struct list_head		sets;
 	struct list_head		objects;
 	struct list_head		flowtables;
+	struct list_head		strsets;
 	u64				hgenerator;
 	u64				handle;
 	u32				use;

@@ -1339,6 +1340,31 @@ void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx,
 void nft_register_flowtable_type(struct nf_flowtable_type *type);
 void nft_unregister_flowtable_type(struct nf_flowtable_type *type);
 
+struct ac_tree;
+
+/**
+ *	struct nft_strset - nf_tables string set
+ *
+ *	@list: flow table list node in table list
+ * 	@table: the table the strings is contained in
+ * 	@name: the name of this string collection
+ *	@tree: the aho-corasick tree
+ *	@handle: the string collection handle
+ *	@genmask: generation mask
+ *	@commit_update: data structure needs update on commit
+ *	@use: reference counter
+ */
+struct nft_strset {
+	struct list_head		list;
+	struct nft_table		*table;
+	char				*name;
+	struct ac_tree __rcu		*tree[2];
+	u64				handle;
+	u8				genmask:2,
+					commit_update:1;
+	u32				use;
+};
+
 /**
  *	struct nft_traceinfo - nft tracing information and state
  *

@@ -1607,6 +1633,13 @@ struct nft_trans_flowtable {
 #define nft_trans_flowtable_flags(trans)	\
 	(((struct nft_trans_flowtable *)trans->data)->flags)
 
+struct nft_trans_strset {
+	struct nft_strset		*strset;
+};
+
+#define nft_trans_strset(trans)	\
+	(((struct nft_trans_strset *)trans->data)->strset)
+
 int __init nft_chain_filter_init(void);
 void nft_chain_filter_fini(void);

include/uapi/linux/netfilter/nf_tables.h +39 -0

index 466fd3f4447c..d7a668199611 100644
@@ -124,6 +124,12 @@ enum nf_tables_msg_types {
 	NFT_MSG_NEWFLOWTABLE,
 	NFT_MSG_GETFLOWTABLE,
 	NFT_MSG_DELFLOWTABLE,
+	NFT_MSG_NEWSTRSET,
+	NFT_MSG_DELSTRSET,
+	NFT_MSG_GETSTRSET,
+	NFT_MSG_NEWSTRING,
+	NFT_MSG_DELSTRING,
+	NFT_MSG_GETSTRING,
 	NFT_MSG_MAX,
 };

@@ -1672,6 +1678,39 @@ enum nft_flowtable_hook_attributes {
 };
 #define NFTA_FLOWTABLE_HOOK_MAX	(__NFTA_FLOWTABLE_HOOK_MAX - 1)
 
+/**
+ * enum nft_strset_hook_attributes - nf_tables string set netlink attributes
+ *
+ * @NFTA_STRSET_TABLE: table name (NLA_STRING)
+ * @NFTA_STRSET_NAME: string set name (NLA_STRING)
+ * @NFTA_STRSET_LIST: list of string elements (NLA_NESTED)
+ * @NFTA_STRSET_HANDLE: string set handle (NLA_U64)
+ * @NFTA_STRSET_USE: use reference counter (NLA_U32)
+ */
+enum nft_strset_hook_attributes {
+	NFTA_STRSET_UNSPEC,
+	NFTA_STRSET_TABLE,
+	NFTA_STRSET_NAME,
+	NFTA_STRSET_LIST,
+	NFTA_STRSET_HANDLE,
+	NFTA_STRSET_USE,
+	NFTA_STRSET_PAD,
+	__NFTA_STRSET_MAX
+};
+#define NFTA_STRSET_MAX	(__NFTA_STRSET_MAX - 1)
+
+/**
+ * enum nft_string_hook_attributes - nf_tables string netlink attributes
+ *
+ * @NFTA_STRING: string (NLA_STRING)
+ */
+enum nft_string_hook_attributes {
+	NFTA_STRING_UNSPEC,
+	NFTA_STRING,
+	__NFTA_STRING_MAX
+};
+#define NFTA_STRING_MAX	(__NFTA_STRING_MAX - 1)
+
 /**
  * enum nft_osf_attributes - nftables osf expression netlink attributes
  *

net/netfilter/nf_tables_api.c +1086 ~~-200~~

1,395 lines not on this page · raw message

Signature · 1 line

2.30.2

kernel test robot

build bot

2022-07-29 14:20 UTC #3 lore raw

Re: [PATCH RFC 2/3] netfilter: nf_tables: add string set API

[If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in…

Hi Pablo,

[FYI, it's a private test report for your RFC patch.]
[auto build test ERROR on nf/master]
[also build test ERROR on linus/master v5.19-rc8 next-20220728] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Pablo-Neira-Ayuso/nf_tables-string-match-support/20220729-173258
base:   https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
config: i386-randconfig-a013 (https://download.01.org/0day-ci/archive/20220729/[email protected]/config)
compiler: clang version 15.0.0 (https://github.com/llvm/llvm-project 8dfaecc4c24494337933aff9d9166486ca0949f1)

reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross
# https://github.com/intel-lab-lkp/linux/commit/021bda4d09b7b9be8c40f05b017f885ba3010c02
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Pablo-Neira-Ayuso/nf_tables-string-match-support/20220729-173258 git checkout 021bda4d09b7b9be8c40f05b017f885ba3010c02
# save the config file
mkdir build_dir && cp config build_dir/.config
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=i386 SHELL=/bin/bash

If you fix the issue, kindly add following tag where applicable

Reported-by kernel test robot <[email protected]>

All errors (new ones prefixed by >>, old ones prefixed by <<):

>> ERROR: modpost: "ac_iterate" [net/netfilter/nf_tables.ko] undefined!
>> ERROR: modpost: "ac_iter_destroy" [net/netfilter/nf_tables.ko] undefined!
>> ERROR: modpost: "ac_iter_create" [net/netfilter/nf_tables.ko] undefined!
>> ERROR: modpost: "ac_del" [net/netfilter/nf_tables.ko] undefined!
>> ERROR: modpost: "ac_add" [net/netfilter/nf_tables.ko] undefined!
>> ERROR: modpost: "ac_clone" [net/netfilter/nf_tables.ko] undefined!
>> ERROR: modpost: "ac_create" [net/netfilter/nf_tables.ko] undefined!
>> ERROR: modpost: "ac_resolve_fail" [net/netfilter/nf_tables.ko] undefined!
>> ERROR: modpost: "ac_destroy" [net/netfilter/nf_tables.ko] undefined!

Signature · 2 lines

0-DAY CI Kernel Test Service
https://01.org/lkp

kernel test robot

build bot

2022-07-29 16:52 UTC #4 lore raw

Re: [PATCH RFC 2/3] netfilter: nf_tables: add string set API

In reply to Pablo Neira Ayuso

[If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in…

Hi Pablo,

[FYI, it's a private test report for your RFC patch.]
[auto build test ERROR on nf/master]
[also build test ERROR on nf-next/master linus/master v5.19-rc8 next-20220728] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Pablo-Neira-Ayuso/nf_tables-string-match-support/20220729-173258
base:   https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
config: hexagon-randconfig-r021-20220729 (https://download.01.org/0day-ci/archive/20220730/[email protected]/config)
compiler: clang version 15.0.0 (https://github.com/llvm/llvm-project 8dfaecc4c24494337933aff9d9166486ca0949f1)

If you fix the issue, kindly add following tag where applicable

Reported-by kernel test robot <[email protected]>

All errors (new ones prefixed by >>):

>> ld.lld: error: undefined symbol: ac_destroy
   >>> referenced by nf_tables_api.c:8263 (net/netfilter/nf_tables_api.c:8263)
   >>>               netfilter/nf_tables_api.o:(nft_strset_destroy) in archive net/built-in.a
   >>> referenced by nf_tables_api.c:8263 (net/netfilter/nf_tables_api.c:8263)
   >>>               netfilter/nf_tables_api.o:(nft_strset_destroy) in archive net/built-in.a
   >>> referenced by nf_tables_api.c:8268 (net/netfilter/nf_tables_api.c:8268)
   >>>               netfilter/nf_tables_api.o:(nft_strset_destroy) in archive net/built-in.a
   >>> referenced 9 more times
--
>> ld.lld: error: undefined symbol: ac_resolve_fail
   >>> referenced by nf_tables_api.c:9339 (net/netfilter/nf_tables_api.c:9339)
   >>>               netfilter/nf_tables_api.o:(nf_tables_commit) in archive net/built-in.a
   >>> referenced by nf_tables_api.c:9339 (net/netfilter/nf_tables_api.c:9339)
   >>>               netfilter/nf_tables_api.o:(nf_tables_commit) in archive net/built-in.a
--
>> ld.lld: error: undefined symbol: ac_create
   >>> referenced by nf_tables_api.c:0 (net/netfilter/nf_tables_api.c:0)
   >>>               netfilter/nf_tables_api.o:(nf_tables_newstrset) in archive net/built-in.a
   >>> referenced by nf_tables_api.c:0 (net/netfilter/nf_tables_api.c:0)
   >>>               netfilter/nf_tables_api.o:(nf_tables_newstrset) in archive net/built-in.a
--
>> ld.lld: error: undefined symbol: ac_clone
   >>> referenced by nf_tables_api.c:0 (net/netfilter/nf_tables_api.c:0)
   >>>               netfilter/nf_tables_api.o:(nf_tables_newstr) in archive net/built-in.a
   >>> referenced by nf_tables_api.c:0 (net/netfilter/nf_tables_api.c:0)
   >>>               netfilter/nf_tables_api.o:(nf_tables_newstr) in archive net/built-in.a
   >>> referenced by nf_tables_api.c:0 (net/netfilter/nf_tables_api.c:0)
   >>>               netfilter/nf_tables_api.o:(nf_tables_delstr) in archive net/built-in.a
   >>> referenced 1 more times
--
>> ld.lld: error: undefined symbol: ac_add
   >>> referenced by nf_tables_api.c:8365 (net/netfilter/nf_tables_api.c:8365)
   >>>               netfilter/nf_tables_api.o:(nf_tables_newstr) in archive net/built-in.a
   >>> referenced by nf_tables_api.c:8365 (net/netfilter/nf_tables_api.c:8365)
   >>>               netfilter/nf_tables_api.o:(nf_tables_newstr) in archive net/built-in.a
--
>> ld.lld: error: undefined symbol: ac_del
   >>> referenced by nf_tables_api.c:8474 (net/netfilter/nf_tables_api.c:8474)
   >>>               netfilter/nf_tables_api.o:(nf_tables_delstr) in archive net/built-in.a
   >>> referenced by nf_tables_api.c:8474 (net/netfilter/nf_tables_api.c:8474)
   >>>               netfilter/nf_tables_api.o:(nf_tables_delstr) in archive net/built-in.a
--
>> ld.lld: error: undefined symbol: ac_iter_create
   >>> referenced by nf_tables_api.c:8567 (net/netfilter/nf_tables_api.c:8567)
   >>>               netfilter/nf_tables_api.o:(nf_tables_dump_str_start) in archive net/built-in.a
   >>> referenced by nf_tables_api.c:8567 (net/netfilter/nf_tables_api.c:8567)
   >>>               netfilter/nf_tables_api.o:(nf_tables_dump_str_start) in archive net/built-in.a
--
>> ld.lld: error: undefined symbol: ac_iter_destroy
   >>> referenced by nf_tables_api.c:8575 (net/netfilter/nf_tables_api.c:8575)
   >>>               netfilter/nf_tables_api.o:(nf_tables_dump_str_start) in archive net/built-in.a
   >>> referenced by nf_tables_api.c:8575 (net/netfilter/nf_tables_api.c:8575)
   >>>               netfilter/nf_tables_api.o:(nf_tables_dump_str_start) in archive net/built-in.a
   >>> referenced by nf_tables_api.c:8592 (net/netfilter/nf_tables_api.c:8592)
   >>>               netfilter/nf_tables_api.o:(nf_tables_dump_str_done) in archive net/built-in.a
   >>> referenced 1 more times
--
>> ld.lld: error: undefined symbol: ac_iterate
   >>> referenced by nf_tables_api.c:8650 (net/netfilter/nf_tables_api.c:8650)
   >>>               netfilter/nf_tables_api.o:(nf_tables_dump_str) in archive net/built-in.a
   >>> referenced by nf_tables_api.c:8650 (net/netfilter/nf_tables_api.c:8650)
   >>>               netfilter/nf_tables_api.o:(nf_tables_dump_str) in archive net/built-in.a

Signature · 2 lines

0-DAY CI Kernel Test Service
https://01.org/lkp

Pablo Neira Ayuso

author maintainer

2022-07-29 09:31 UTC #5 lore raw

RFC PATCH 3/3 netfilter: nf_tables: add string expression

In reply to Pablo Neira Ayuso

Add string expression to allow to match patterns on packets. These patterns are specified by an existing string set which uses the Aho-Corasick tree to store patterns.

This expression allows for a packet base offset to be specified: network, transport or inner header offset. On top of this, you can specify an offset range to restrict the pattern search.

This patch uses the existing sequencial read skbuff API to search for matching patterns.

Currently, it only supports for the NFT_STR_F_PRESENT flags which is mandatory to test whether a pattern is matching the payload. This leaves room to extend this expression to support for more new matching modes in the future.

Signed-off-by Pablo Neira Ayuso <[email protected]>

---
 include/net/netfilter/nf_tables.h        |   4 +
 include/net/netfilter/nf_tables_core.h   |   1 +
 include/uapi/linux/netfilter/nf_tables.h |  26 +++
 net/netfilter/Makefile                   |   1 +
 net/netfilter/nf_tables_api.c            |   7 +-
 net/netfilter/nf_tables_core.c           |   1 +
 net/netfilter/nft_string.c               | 254 +++++++++++++++++++++++
 7 files changed, 290 insertions(+), 4 deletions(-)
 create mode 100644 net/netfilter/nft_string.c

include/net/netfilter/nf_tables.h +4 -0

index c4e9a969122a..20e12a881246 100644
@@ -1365,6 +1365,10 @@ struct nft_strset {
 	u32				use;
 };
 
+struct nft_strset *nft_strset_lookup(const struct net *net,
+				     struct nft_table *table,
+				     const struct nlattr *nla, u8 genmask);
+
 /**
  *	struct nft_traceinfo - nft tracing information and state
  *

include/net/netfilter/nf_tables_core.h +1 -0

index 0ea7c55cea4d..f5a4bef2afba 100644
@@ -12,6 +12,7 @@ extern struct nft_expr_type nft_lookup_type;
 extern struct nft_expr_type nft_bitwise_type;
 extern struct nft_expr_type nft_byteorder_type;
 extern struct nft_expr_type nft_payload_type;
+extern struct nft_expr_type nft_string_type;
 extern struct nft_expr_type nft_dynset_type;
 extern struct nft_expr_type nft_range_type;
 extern struct nft_expr_type nft_meta_type;

include/uapi/linux/netfilter/nf_tables.h +26 -0

index d7a668199611..8ce2400952c0 100644
@@ -1711,6 +1711,32 @@ enum nft_string_hook_attributes {
 };
 #define NFTA_STRING_MAX	(__NFTA_STRING_MAX - 1)
 
+enum nft_string_flags {
+	NFT_STR_F_PRESENT = (1 << 0),
+};
+
+/**
+ * enum nft_str_hook_attributes - nf_tables string expression netlink attributes
+ *
+ * @NFTA_STR_NAME: string set name (NLA_STRING)
+ * @NFTA_STR_BASE: payload base (NLA_U32: nft_payload_bases)
+ * @NFTA_STR_FROM: offset to start matching from (NLA_U32)
+ * @NFTA_STR_TO: offset to end matching to (NLA_U32)
+ * @NFTA_STR_DREG: destination register (NLA_U32: nft_registers)
+ * @NFTA_STR_FLAGS: flags (NLA_U32)
+ */
+enum nft_str_hook_attributes {
+	NFTA_STR_UNSPEC,
+	NFTA_STR_NAME,
+	NFTA_STR_BASE,
+	NFTA_STR_FROM,
+	NFTA_STR_TO,
+	NFTA_STR_DREG,
+	NFTA_STR_FLAGS,
+	__NFTA_STR_MAX
+};
+#define NFTA_STR_MAX	(__NFTA_STR_MAX - 1)
+
 /**
  * enum nft_osf_attributes - nftables osf expression netlink attributes
  *

net/netfilter/Makefile +1 -0

index 18127c83b88c..47ed19be4ac6 100644
@@ -91,6 +91,7 @@ endif
 endif
 
 nf_tables-$(CONFIG_NFT_STRING)	+= ahocorasick.o
+nf_tables-$(CONFIG_NFT_STRING)	+= nft_string.o
 
 obj-$(CONFIG_NF_TABLES)		+= nf_tables.o
 obj-$(CONFIG_NFT_COMPAT)	+= nft_compat.o

net/netfilter/nf_tables_api.c +3 -4

index 736bdf6b9671..854ee78884aa 100644
@@ -8117,10 +8117,9 @@ static const struct nla_policy nft_strset_policy[NFTA_STRSET_MAX + 1] = {
 	[NFTA_STRSET_HANDLE]	= { .type = NLA_U64 },
 };
 
-static struct nft_strset *nft_strset_lookup(const struct net *net,
-					    struct nft_table *table,
-					    const struct nlattr *nla,
-					    u8 genmask)
+struct nft_strset *nft_strset_lookup(const struct net *net,
+				     struct nft_table *table,
+				     const struct nlattr *nla, u8 genmask)
 {
 	struct nft_strset *strset;

net/netfilter/nf_tables_core.c +1 -0

index 3ddce24ac76d..ffa413378d7a 100644
@@ -336,6 +336,7 @@ static struct nft_expr_type *nft_basic_types[] = {
 	&nft_payload_type,
 	&nft_dynset_type,
 	&nft_range_type,
+	&nft_string_type,
 	&nft_meta_type,
 	&nft_rt_type,
 	&nft_exthdr_type,

net/netfilter/nft_string.c new file +254 -0

254 lines not on this page · raw message

Signature · 1 line

2.30.2

kernel test robot

build bot

2022-07-29 16:32 UTC #6 lore raw

Re: [PATCH RFC 3/3] netfilter: nf_tables: add string expression

[If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in…

Hi Pablo,

url:    https://github.com/intel-lab-lkp/linux/commits/Pablo-Neira-Ayuso/nf_tables-string-match-support/20220729-173258
base:   https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
config: i386-randconfig-a013 (https://download.01.org/0day-ci/archive/20220730/[email protected]/config)
compiler: clang version 15.0.0 (https://github.com/llvm/llvm-project 8dfaecc4c24494337933aff9d9166486ca0949f1)

reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross
# https://github.com/intel-lab-lkp/linux/commit/1149ccc4ca2617ae8ef8b069f592cf77450a96fe
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Pablo-Neira-Ayuso/nf_tables-string-match-support/20220729-173258 git checkout 1149ccc4ca2617ae8ef8b069f592cf77450a96fe
# save the config file
mkdir build_dir && cp config build_dir/.config
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=i386 SHELL=/bin/bash

If you fix the issue, kindly add following tag where applicable

Reported-by kernel test robot <[email protected]>

All errors (new ones prefixed by >>, old ones prefixed by <<):

ERROR: modpost: "ac_iterate" [net/netfilter/nf_tables.ko] undefined!
ERROR: modpost: "ac_iter_destroy" [net/netfilter/nf_tables.ko] undefined!
ERROR: modpost: "ac_iter_create" [net/netfilter/nf_tables.ko] undefined!
ERROR: modpost: "ac_del" [net/netfilter/nf_tables.ko] undefined!
ERROR: modpost: "ac_add" [net/netfilter/nf_tables.ko] undefined!
ERROR: modpost: "ac_clone" [net/netfilter/nf_tables.ko] undefined!
ERROR: modpost: "ac_create" [net/netfilter/nf_tables.ko] undefined!
ERROR: modpost: "ac_resolve_fail" [net/netfilter/nf_tables.ko] undefined!
ERROR: modpost: "ac_destroy" [net/netfilter/nf_tables.ko] undefined!

>> ERROR: modpost: "nft_string_type" [net/netfilter/nf_tables.ko] undefined!

Signature · 2 lines

0-DAY CI Kernel Test Service
https://01.org/lkp