Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d0a8d877 authored by Ander Juaristi's avatar Ander Juaristi Committed by Pablo Neira Ayuso
Browse files

netfilter: nft_dynset: support for element deletion 



This patch implements the delete operation from the ruleset.

It implements a new delete() function in nft_set_rhash. It is simpler
to use than the already existing remove(), because it only takes the set
and the key as arguments, whereas remove() expects a full
nft_set_elem structure.

Signed-off-by: default avatarAnder Juaristi <a@juaristi.eus>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 65af4a10

include/net/netfilter/nf_tables.h

+9 −1
Original line number Diff line number Diff line
@@ -302,17 +302,23 @@ struct nft_expr; 
 *	struct nft_set_ops - nf_tables set operations

 *

 *	@lookup: look up an element within the set

 *	@update: update an element if exists, add it if doesn't exist

 *	@delete: delete an element

 *	@insert: insert new element into set

 *	@activate: activate new element in the next generation

 *	@deactivate: lookup for element and deactivate it in the next generation

 *	@flush: deactivate element in the next generation

 *	@remove: remove element from set

 *	@walk: iterate over all set elemeennts

 *	@walk: iterate over all set elements

 *	@get: get set elements

 *	@privsize: function to return size of set private data

 *	@init: initialize private data of new set instance

 *	@destroy: destroy private data of set instance

 *	@elemsize: element private size

 *

 *	Operations lookup, update and delete have simpler interfaces, are faster

 *	and currently only used in the packet path. All the rest are slower,

 *	control plane functions.

 */

struct nft_set_ops {

	bool				(*lookup)(const struct net *net,
@@ -327,6 +333,8 @@ struct nft_set_ops { 
						  const struct nft_expr *expr,

						  struct nft_regs *regs,

						  const struct nft_set_ext **ext);

	bool				(*delete)(const struct nft_set *set,

						  const u32 *key);



	int				(*insert)(const struct net *net,

						  const struct nft_set *set,

include/uapi/linux/netfilter/nf_tables.h

+1 −0
Original line number Diff line number Diff line
@@ -636,6 +636,7 @@ enum nft_lookup_attributes { 
enum nft_dynset_ops {

	NFT_DYNSET_OP_ADD,

	NFT_DYNSET_OP_UPDATE,

	NFT_DYNSET_OP_DELETE,

};



enum nft_dynset_flags {

net/netfilter/nft_dynset.c

+6 −0
Original line number Diff line number Diff line
@@ -84,6 +84,11 @@ void nft_dynset_eval(const struct nft_expr *expr, 
	const struct nft_expr *sexpr;

	u64 timeout;



	if (priv->op == NFT_DYNSET_OP_DELETE) {

		set->ops->delete(set, &regs->data[priv->sreg_key]);

		return;

	}



	if (set->ops->update(set, &regs->data[priv->sreg_key], nft_dynset_new,

			     expr, regs, &ext)) {

		sexpr = NULL;
@@ -161,6 +166,7 @@ static int nft_dynset_init(const struct nft_ctx *ctx, 
	priv->op = ntohl(nla_get_be32(tb[NFTA_DYNSET_OP]));

	switch (priv->op) {

	case NFT_DYNSET_OP_ADD:

	case NFT_DYNSET_OP_DELETE:

		break;

	case NFT_DYNSET_OP_UPDATE:

		if (!(set->flags & NFT_SET_TIMEOUT))

net/netfilter/nft_set_hash.c

+19 −0
Original line number Diff line number Diff line
@@ -234,6 +234,24 @@ static void nft_rhash_remove(const struct net *net, 
	rhashtable_remove_fast(&priv->ht, &he->node, nft_rhash_params);

}



static bool nft_rhash_delete(const struct nft_set *set,

			     const u32 *key)

{

	struct nft_rhash *priv = nft_set_priv(set);

	struct nft_rhash_cmp_arg arg = {

		.genmask = NFT_GENMASK_ANY,

		.set = set,

		.key = key,

	};

	struct nft_rhash_elem *he;



	he = rhashtable_lookup(&priv->ht, &arg, nft_rhash_params);

	if (he == NULL)

		return false;



	return rhashtable_remove_fast(&priv->ht, &he->node, nft_rhash_params) == 0;

}



static void nft_rhash_walk(const struct nft_ctx *ctx, struct nft_set *set,

			   struct nft_set_iter *iter)

{
@@ -662,6 +680,7 @@ struct nft_set_type nft_set_rhash_type __read_mostly = { 
		.remove		= nft_rhash_remove,

		.lookup		= nft_rhash_lookup,

		.update		= nft_rhash_update,

		.delete		= nft_rhash_delete,

		.walk		= nft_rhash_walk,

		.get		= nft_rhash_get,

	},