Commit d56aab26 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: skip set types that do not support for expressions 



The bitmap set does not support for expressions, skip it from the
estimation step.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 8548bde9

include/net/netfilter/nf_tables.h

+2 −0
Original line number Diff line number Diff line
@@ -266,6 +266,7 @@ struct nft_set_iter { 
 *	@size: number of set elements

 *	@field_len: length of each field in concatenation, bytes

 *	@field_count: number of concatenated fields in element

 *	@expr: set must support for expressions

 */

struct nft_set_desc {

	unsigned int		klen;
@@ -273,6 +274,7 @@ struct nft_set_desc { 
	unsigned int		size;

	u8			field_len[NFT_REG32_COUNT];

	u8			field_count;

	bool			expr;

};



/**

net/netfilter/nf_tables_api.c

+3 −0
Original line number Diff line number Diff line
@@ -4032,6 +4032,9 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, 
			return err;

	}



	if (nla[NFTA_SET_EXPR])

		desc.expr = true;



	table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask);

	if (IS_ERR(table)) {

		NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);

net/netfilter/nft_set_bitmap.c

+2 −0
Original line number Diff line number Diff line
@@ -286,6 +286,8 @@ static bool nft_bitmap_estimate(const struct nft_set_desc *desc, u32 features, 
	/* Make sure bitmaps we don't get bitmaps larger than 16 Kbytes. */

	if (desc->klen > 2)

		return false;

	else if (desc->expr)

		return false;



	est->size   = nft_bitmap_total_size(desc->klen);

	est->lookup = NFT_SET_CLASS_O_1;

CRA Git | Maintained and supported by SUSTech CRA and CCSE