Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7c6c6e95 authored Apr 11, 2015 by Patrick McHardy Committed by Pablo Neira Ayuso Apr 13, 2015

netfilter: nf_tables: add flag to indicate set contains expressions



Add a set flag to indicate that the set is used as a state table and
contains expressions for evaluation. This operation is mutually
exclusive with the mapping operation, so sets specifying both are
rejected. The lookup expression also rejects binding to state tables
since it only deals with loopup and map operations.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent 151d799a

include/uapi/linux/netfilter/nf_tables.h

+2 −0

Original line number	Diff line number	Diff line
		@@ -238,6 +238,7 @@ enum nft_rule_compat_attributes {
		* @NFT_SET_INTERVAL: set contains intervals
		* @NFT_SET_MAP: set is used as a dictionary
		* @NFT_SET_TIMEOUT: set uses timeouts
		* @NFT_SET_EVAL: set contains expressions for evaluation
		*/
		enum nft_set_flags {
		NFT_SET_ANONYMOUS = 0x1,
		@@ -245,6 +246,7 @@ enum nft_set_flags {
		NFT_SET_INTERVAL = 0x4,
		NFT_SET_MAP = 0x8,
		NFT_SET_TIMEOUT = 0x10,
		NFT_SET_EVAL = 0x20,
		};

		/**

net/netfilter/nf_tables_api.c

+6 −2

Original line number	Diff line number	Diff line
		@@ -2661,9 +2661,13 @@ static int nf_tables_newset(struct sock nlsk, struct sk_buff skb,
		if (nla[NFTA_SET_FLAGS] != NULL) {
		flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
		if (flags & ~(NFT_SET_ANONYMOUS \| NFT_SET_CONSTANT \|
		NFT_SET_INTERVAL \| NFT_SET_MAP \|
		NFT_SET_TIMEOUT))
		NFT_SET_INTERVAL \| NFT_SET_TIMEOUT \|
		NFT_SET_MAP \| NFT_SET_EVAL))
		return -EINVAL;
		/* Only one of both operations is supported */
		if ((flags & (NFT_SET_MAP \| NFT_SET_EVAL)) ==
		(NFT_SET_MAP \| NFT_SET_EVAL))
		return -EOPNOTSUPP;
		}

		dtype = 0;

net/netfilter/nft_lookup.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -71,6 +71,9 @@ static int nft_lookup_init(const struct nft_ctx *ctx,
		return PTR_ERR(set);
		}

		if (set->flags & NFT_SET_EVAL)
		return -EOPNOTSUPP;

		priv->sreg = nft_parse_register(tb[NFTA_LOOKUP_SREG]);
		err = nft_validate_register_load(priv->sreg, set->klen);
		if (err < 0)