dilim/moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2026-08-04 23:21:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

d/libn/i/nftables: define dynamic maps, sets

Browse Source 
Add support for defining nftables maps and sets with size and timeout
specified, which are required values for maps and sets that are updated
from the packet path.

Signed-off-by: Cory Snider <csnider@mirantis.com>
This commit is contained in:
Cory Snider
2026-06-26 11:37:16 -04:00
parent 4845c1f59a
commit 7d4bb80d87
6 changed files with 53 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
daemon/libnetwork/internal/nftables/incremental_update.nft.gotmpl
View File

@@ -22,11 +22,15 @@ table {{$family}} {{$tableName}} {
{{range .Maps}}map {{.Name}} {
{{.ElementTypeExpr}}
{{if len .Flags}}flags{{range .Flags}} {{.}}{{end}}{{end}}
{{if .Size}}size {{.Size}}{{end}}
{{if .Timeout}}timeout {{.Timeout.Milliseconds}}ms{{end}}
}
{{end}}
{{range .Sets}}set {{.Name}} {
{{.ElementTypeExpr}}
{{if len .Flags}}flags{{range .Flags}} {{.}}{{end}}{{end}}
{{if .Size}}size {{.Size}}{{end}}
{{if .Timeout}}timeout {{.Timeout.Milliseconds}}ms{{end}}
}
{{end}}
{{range .Chains}}{{if .MustFlush}}chain {{.Name}} {

13
daemon/libnetwork/internal/nftables/nftables_linux.go
View File

@@ -56,6 +56,7 @@ import (
"strings"
"sync"
"text/template"
"time"
"github.com/containerd/log"
)
@@ -761,6 +762,8 @@ type nftMap struct {
Name string
ElementTypeExpr string
Flags []string
Size int
Timeout time.Duration
Elements map[string]mapValue
AddedElements map[string]mapValue
DeletedElements map[string]string
@@ -773,6 +776,8 @@ type Map struct {
Name string
ElementType MapTyper
Flags []string
Size int
Timeout time.Duration
}
func (m Map) create(ctx context.Context, t *table) (bool, error) {
@@ -790,6 +795,8 @@ func (m Map) create(ctx context.Context, t *table) (bool, error) {
Name: m.Name,
ElementTypeExpr: m.ElementType.mapType(),
Flags: slices.Clone(m.Flags),
Size: m.Size,
Timeout: m.Timeout,
Elements: map[string]mapValue{},
AddedElements: map[string]mapValue{},
DeletedElements: map[string]string{},
@@ -910,6 +917,8 @@ type set struct {
Name string
ElementTypeExpr string
Flags []string
Size int
Timeout time.Duration
Elements map[string]setElementOptions
AddedElements map[string]setElementOptions
DeletedElements map[string]struct{}
@@ -922,6 +931,8 @@ type Set struct {
Name string
ElementType SetTyper
Flags []string
Size int
Timeout time.Duration
}
// See https://wiki.nftables.org/wiki-nftables/index.php/Sets#Named_sets
@@ -941,6 +952,8 @@ func (sd Set) create(ctx context.Context, t *table) (bool, error) {
Elements: map[string]setElementOptions{},
ElementTypeExpr: sd.ElementType.setType(),
Flags: slices.Clone(sd.Flags),
Size: sd.Size,
Timeout: sd.Timeout,
AddedElements: map[string]setElementOptions{},
DeletedElements: map[string]struct{}{},
MustFlush: true,

4
daemon/libnetwork/internal/nftables/nftables_linux_test.go
View File

@@ -4,6 +4,7 @@ import (
"context"
"os"
"testing"
"time"
"github.com/moby/moby/v2/internal/testutil/netnsutils"
"gotest.tools/v3/assert"
@@ -264,6 +265,9 @@ func TestReload(t *testing.T) {
tm.Create(Set{Name: setName, ElementType: IPv4Addr, Flags: []string{"interval"}})
tm.Create(SetElement{SetName: setName, Element: "192.0.2.0/24", Comment: "}bar{"})
tm.Create(Map{Name: "dynamic_map", ElementType: IPv4Addr.MapTo(EtherAddr), Flags: []string{"dynamic"}, Size: 1024, Timeout: 2*time.Minute + 30*time.Second + 500*time.Millisecond + 654*time.Microsecond})
tm.Create(Set{Name: "dynamic_set", ElementType: IPv4Addr, Flags: []string{"dynamic"}, Size: 4096, Timeout: 5*time.Minute + 10*time.Second + 250*time.Millisecond + 123*time.Microsecond})
applyAndCheck(t, t.Name()+"/created.golden", tbl, tm)
// Delete the underlying nftables table.

4
daemon/libnetwork/internal/nftables/reload.nft.gotmpl
View File

@@ -13,6 +13,8 @@ table {{$family}} {{$tableName}} {
{{range .Maps}}map {{.Name}} {
{{.ElementTypeExpr}}
{{if len .Flags}}flags{{range .Flags}} {{.}}{{end}}{{end}}
{{if .Size}}size {{.Size}}{{end}}
{{if .Timeout}}timeout {{.Timeout.Milliseconds}}ms{{end}}
{{if .Elements}}elements = {
{{range $k,$v := .Elements}}{{$k}}{{if $v.Comment}} comment "{{$v.Comment}}"{{end}} : {{$v.Value}},
{{end -}}
@@ -22,6 +24,8 @@ table {{$family}} {{$tableName}} {
{{range .Sets}}set {{.Name}} {
{{.ElementTypeExpr}}
{{if len .Flags}}flags{{range .Flags}} {{.}}{{end}}{{end}}
{{if .Size}}size {{.Size}}{{end}}
{{if .Timeout}}timeout {{.Timeout.Milliseconds}}ms{{end}}
{{if .Elements}}elements = {
{{range $k,$v := .Elements}}{{$k}}{{if $v.Comment}} comment "{{$v.Comment}}"{{end}},
{{end -}}

14
daemon/libnetwork/internal/nftables/testdata/TestReload/created.golden generated vendored
View File

@@ -1,10 +1,24 @@
table ip this_is_a_table {
map dynamic_map {
type ipv4_addr : ether_addr
size 1024
flags dynamic,timeout
timeout 2m30s500ms
}
map this_is_a_vmap {
type ifname : verdict
elements = { "eth0" : return,
"eth1" comment "{foo}" : return }
}
set dynamic_set {
type ipv4_addr
size 4096
flags dynamic,timeout
timeout 5m10s250ms
}
set this_is_a_set {
type ipv4_addr
flags interval

14
daemon/libnetwork/internal/nftables/testdata/TestReload/recovered.golden generated vendored
View File

@@ -1,10 +1,24 @@
table ip this_is_a_table {
map dynamic_map {
type ipv4_addr : ether_addr
size 1024
flags dynamic,timeout
timeout 2m30s500ms
}
map this_is_a_vmap {
type ifname : verdict
elements = { "eth0" : return,
"eth1" comment "{foo}" : return }
}
set dynamic_set {
type ipv4_addr
size 4096
flags dynamic,timeout
timeout 5m10s250ms
}
set this_is_a_set {
type ipv4_addr
flags interval