Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 151d799a authored by Patrick McHardy's avatar Patrick McHardy Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: mark stateful expressions 



Add a flag to mark stateful expressions.

This is used for dynamic expression instanstiation to limit the usable
expressions. Strictly speaking only the dynset expression can not be
used in order to avoid recursion, but since dynamically instantiating
non-stateful expressions will simply create an identical copy, which
behaves no differently than the original, this limits to expressions
where it actually makes sense to dynamically instantiate them.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent f25ad2e9

include/net/netfilter/nf_tables.h

+4 −0
Original line number Diff line number Diff line
@@ -583,6 +583,7 @@ static inline void nft_set_gc_batch_add(struct nft_set_gc_batch *gcb, 
 *	@policy: netlink attribute policy

 *	@maxattr: highest netlink attribute number

 *	@family: address family for AF-specific types

 *	@flags: expression type flags

 */

struct nft_expr_type {

	const struct nft_expr_ops	*(*select_ops)(const struct nft_ctx *,
@@ -594,8 +595,11 @@ struct nft_expr_type { 
	const struct nla_policy		*policy;

	unsigned int			maxattr;

	u8				family;

	u8				flags;

};



#define NFT_EXPR_STATEFUL		0x1



/**

 *	struct nft_expr_ops - nf_tables expression operations

 *

net/netfilter/nft_counter.c

+1 −0
Original line number Diff line number Diff line
@@ -92,6 +92,7 @@ static struct nft_expr_type nft_counter_type __read_mostly = { 
	.ops		= &nft_counter_ops,

	.policy		= nft_counter_policy,

	.maxattr	= NFTA_COUNTER_MAX,

	.flags		= NFT_EXPR_STATEFUL,

	.owner		= THIS_MODULE,

};

net/netfilter/nft_limit.c

+1 −0
Original line number Diff line number Diff line
@@ -98,6 +98,7 @@ static struct nft_expr_type nft_limit_type __read_mostly = { 
	.ops		= &nft_limit_ops,

	.policy		= nft_limit_policy,

	.maxattr	= NFTA_LIMIT_MAX,

	.flags		= NFT_EXPR_STATEFUL,

	.owner		= THIS_MODULE,

};