call, emit, match: Add support for vectorised operations, nfnetlinkHEADmaster

We want to add and delete rules with iptables(8), and manipulate set
elements with nft(8).

These are the first users we encounter sending multiple netlink
messages in one sendmsg().

To support matching on those, we need to iterate over several
messages, looking for a matching one, or a mismatching one (depending
on quantifiers and match type), but we don't want to implement program
loops because of security design reasons.

We can't implement a generalised instruction that vectorises existing
ones, either, because we need to support universal and existential
quantifiers in fields that are repeated multiple times, once per each
netlink message, with bitwise operations and non-exact matching types.

Add vectorisation support to OP_CMP and OP_BITWISE instead, with a
generic description for a vector (only sequences of netlink messages
with length in nlmsghdr are supported at the moment) so that,
depending on the quantifiers, we'll repeat those operations as many
times as needed. This way, we don't risk any O(n^2) explosion, and we
are bound by O(m * n) instead, with m compare/bitwise operations for
a given expression, and n number of netlink messages.

Add demos for nft and iptables using the new concepts.

Signed-off-by: Stefano Brivio <sbrivio@redhat.com>

1 files changed, 70 insertions, 22 deletions

diff --git a/cooker/calls/net.c b/cooker/calls/net.c
index 94b13cd..0688467 100644
--- a/cooker/calls/net.c
+++ b/cooker/calls/net.c
@@ -65,22 +65,23 @@ static struct num socket_flags[] = {
 };
 
 static struct num protocols[] = {
-	{ "ip",		IPPROTO_IP },
-	{ "icmp",	IPPROTO_ICMP },
-	{ "igmp",	IPPROTO_IGMP },
-	{ "tcp",	IPPROTO_TCP },
-	{ "udp",	IPPROTO_UDP },
-	{ "ipv6",	IPPROTO_IPV6 },
-	{ "gre",	IPPROTO_GRE },
-	{ "esp",	IPPROTO_ESP },
-	{ "ah",		IPPROTO_AH },
-	{ "sctp",	IPPROTO_SCTP },
-	{ "udplite",	IPPROTO_UDPLITE },
-	{ "mpls",	IPPROTO_MPLS },
-	{ "raw",	IPPROTO_RAW },
-	{ "mptcp",	IPPROTO_MPTCP },
+	{ "ip",			IPPROTO_IP },
+	{ "icmp",		IPPROTO_ICMP },
+	{ "igmp",		IPPROTO_IGMP },
+	{ "tcp",		IPPROTO_TCP },
+	{ "udp",		IPPROTO_UDP },
+	{ "ipv6",		IPPROTO_IPV6 },
+	{ "gre",		IPPROTO_GRE },
+	{ "esp",		IPPROTO_ESP },
+	{ "ah",			IPPROTO_AH },
+	{ "sctp",		IPPROTO_SCTP },
+	{ "udplite",		IPPROTO_UDPLITE },
+	{ "mpls",		IPPROTO_MPLS },
+	{ "raw",		IPPROTO_RAW },
+	{ "mptcp",		IPPROTO_MPTCP },
 
-	{ "nl_route",	NETLINK_ROUTE },
+	{ "nl_route",		NETLINK_ROUTE },
+	{ "nl_netfilter",	NETLINK_NETFILTER },
 
 	{ 0 },
 };
@@ -261,7 +262,7 @@ static struct num send_flags[] = {
 static struct arg send_args[] = {
 	{ 0,
 		{
-			"fd",		INT,		0,
+			"fd",		INT,		FD,
 			0,
 			0,
 			{ 0 },
@@ -297,7 +298,7 @@ static struct arg send_args[] = {
 static struct arg sendto_args[] = {
 	{ 0,
 		{
-			"fd",		INT,		0,
+			"fd",		INT,		FD,
 			0,
 			0,
 			{ 0 },
@@ -346,7 +347,7 @@ static struct arg sendto_args[] = {
 	{ 0 }
 };
 
-static struct select sendmsg_name_select = {
+static struct select msg_name_select = {
 	&connect_family, { .d_num = connect_addr_select_family }
 };
 
@@ -355,13 +356,13 @@ static struct field sendmsg_msghdr[] = {
 		"name",		SELECT,		0,
 		offsetof(struct msghdr, msg_name),
 		sizeof(struct sockaddr_storage),
-		{ .d_select = &sendmsg_name_select },
+		{ .d_select = &msg_name_select },
 	},
 	{
 		"namelen",	LONG,		SIZE,
 		offsetof(struct msghdr, msg_namelen),
 		0,
-		{ .d_size = (intptr_t)&sendmsg_name_select },
+		{ .d_size = (intptr_t)&msg_name_select },
 	},
 	{
 		"iov",		STRING,		WBUF | IOV,
@@ -400,7 +401,7 @@ static struct field sendmsg_msghdr[] = {
 static struct arg sendmsg_args[] = {
 	{ 0,
 		{
-			"fd",		INT,		0,
+			"fd",		INT,		FD,
 			0,
 			0,
 			{ 0 },
@@ -425,6 +426,53 @@ static struct arg sendmsg_args[] = {
 	{ 0 }
 };
 
+static struct field recvmsg_msghdr[] = {
+	{
+		"name",		SELECT,		0,
+		offsetof(struct msghdr, msg_name),
+		sizeof(struct sockaddr_storage),
+		{ .d_select = &msg_name_select },
+	},
+	{
+		"namelen",	LONG,		SIZE,
+		offsetof(struct msghdr, msg_namelen),
+		0,
+		{ .d_size = (intptr_t)&msg_name_select },
+	},
+	{
+		"iov",		STRING,		RBUF | IOV,
+		offsetof(struct msghdr, msg_iov),
+		BUFSIZ,
+		{ .d_iovlen = offsetof(struct msghdr, msg_iovlen) -
+			      offsetof(struct msghdr, msg_iov) },
+	},
+	{
+		"iovlen",	LONG,		0,
+		offsetof(struct msghdr, msg_iovlen),
+		0,
+		{ 0 },
+	},
+	{
+		"control",	STRING,		0,
+		offsetof(struct msghdr, msg_control),
+		BUFSIZ,
+		{ 0 },
+	},
+	{
+		"controllen",	LONG,		SIZE,
+		offsetof(struct msghdr, msg_controllen),
+		0,
+		{ 0 },
+	},
+	{
+		"flags",	INT,		0,
+		offsetof(struct msghdr, msg_flags),
+		0,
+		{ 0 },
+	},
+	{ 0 }
+};
+
 static struct arg recvmsg_args[] = {
 	{ 0,
 		{
@@ -439,7 +487,7 @@ static struct arg recvmsg_args[] = {
 			"msg",		STRUCT,		0,
 			0,
 			sizeof(struct msghdr),
-			{ .d_struct = sendmsg_msghdr },
+			{ .d_struct = recvmsg_msghdr },
 		},
 	},
 	{ 2,