Re: Implementing Deletion of Set Elements in Rulesets

[Phil Sutter <phil@nwl.cc>]

On Thu, Mar 21, 2019 at 09:45:16AM +0100, Florian Westphal wrote:
> This is about deletion of elements from the packet path in dynamic
> sets, see https://people.netfilter.org/pablo/nf-ideas-2019.txt, 1.4 .

Ah, thanks for the pointer! Obviously I confused dynamic with anonymous
in Karuna's mail.

On Thu, Mar 21, 2019 at 11:57:15AM +0530, Karuna Grewal wrote:
> I'm trying to implement  "deletion of set elements in ruleset". For
> which I wanted to understand the way existing set operations are
> implemented.
> While grepping through the code I have noticed that the implementation
> has some parts in the kernel, libnftnl 's dynset and the userspace's
> netlink_(de)linearize .
> I'm unable to get  a clear view of how the control flow goes from the
> userspace's `evaluate` to the kernel's `nft_dynset.c`  in case of the
> set operations.
> Can someone please share some pointers in this direction?
> Also how does the `set_stmt_alloc` in nftables's statement.c relate to
> the `set_evaluate` in evaluate.c ?

I don't quite see where you're stuck. So here's a bit of generic
code-flow explanation, maybe it helps:

- User calls 'nft' with some command
- Arguments are parsed in scanner.l/parser_bison.y, resulting in a
  struct cmd instance
- Last step of parsing is to call cmd_evaluate() (see
  parser_bison.y:799)
- Assuming the command was:
  'nft add rule ip test testchain update @testset { ip saddr timeout 1m }'
  code flows like this:
  - cmd_evaluate_add()
    - case CMD_OBJ_RULE
      - rule_evaluate()
        - stmt_evaluate()
          - case STMT_SET
            - stmt_evaluate_set()
            - ...
      - rule_postprocess()
	- payload_try_merge() (probably noop in this case)
- If evaluation succeeds (most of it is sanitization checking), command
  is appended to list in state->cmds
- After parsing has finished, code continues in
  nft_run_cmd_from_buffer() of libnftables.c
  - nft_netlink()
    - do_command()
      - do_command_add()
        - case CMD_OBJ_RULE
          - mnl_nft_rule_add() this converts the rule into a netlink
            message which is appended to batch buffer
    - mnl_batch_talk() this submits the batch to kernel

My guess is that you over-estimate evaluation stage. The real work is
done by do_command() as this turns parser output into netlink messages.

I'll skip kernel side for now, hopefully user space is more clear now.
Feel free to follow-up with further questions.

Cheers, Phil