Commit ef516e86 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: reintroduce the NFT_SET_CONCAT flag 



Stefano originally proposed to introduce this flag, users hit EOPNOTSUPP
in new binaries with old kernels when defining a set with ranges in
a concatenation.

Fixes: f3a2181e ("netfilter: nf_tables: Support for sets with multiple ranged fields")
Reviewed-by: default avatarStefano Brivio <sbrivio@redhat.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent d9583cdf

include/uapi/linux/netfilter/nf_tables.h

+2 −0
Original line number Diff line number Diff line
@@ -276,6 +276,7 @@ enum nft_rule_compat_attributes { 
 * @NFT_SET_TIMEOUT: set uses timeouts

 * @NFT_SET_EVAL: set can be updated from the evaluation path

 * @NFT_SET_OBJECT: set contains stateful objects

 * @NFT_SET_CONCAT: set contains a concatenation

 */

enum nft_set_flags {

	NFT_SET_ANONYMOUS		= 0x1,
@@ -285,6 +286,7 @@ enum nft_set_flags { 
	NFT_SET_TIMEOUT			= 0x10,

	NFT_SET_EVAL			= 0x20,

	NFT_SET_OBJECT			= 0x40,

	NFT_SET_CONCAT			= 0x80,

};



/**

net/netfilter/nf_tables_api.c

+1 −1
Original line number Diff line number Diff line
@@ -3962,7 +3962,7 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, 
		if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |

			      NFT_SET_INTERVAL | NFT_SET_TIMEOUT |

			      NFT_SET_MAP | NFT_SET_EVAL |

			      NFT_SET_OBJECT))

			      NFT_SET_OBJECT | NFT_SET_CONCAT))

			return -EOPNOTSUPP;

		/* Only one of these operations is supported */

		if ((flags & (NFT_SET_MAP | NFT_SET_OBJECT)) ==

CRA Git | Maintained and supported by SUSTech CRA and CCSE