UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

netfilter: nf_tables: skip set types that do not support for expressions 

The bitmap set does not support for expressions, skip it from the
estimation step.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso 2020-03-27 17:43:06 +01:00
parent 8548bde989
commit d56aab2625
3 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/net/netfilter/nf_tables.h
View File

@ -266,6 +266,7 @@ struct nft_set_iter {
* @size: number of set elements * @size: number of set elements
* @field_len: length of each field in concatenation, bytes * @field_len: length of each field in concatenation, bytes
* @field_count: number of concatenated fields in element * @field_count: number of concatenated fields in element
* @expr: set must support for expressions
*/ */
struct nft_set_desc { struct nft_set_desc {
unsigned int klen; unsigned int klen;
@ -273,6 +274,7 @@ struct nft_set_desc {
unsigned int size; unsigned int size;
u8 field_len[NFT_REG32_COUNT]; u8 field_len[NFT_REG32_COUNT];
u8 field_count; u8 field_count;
bool expr;
}; };
/** /**

3
net/netfilter/nf_tables_api.c
View File

@ -4032,6 +4032,9 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
return err; return err;
} }
if (nla[NFTA_SET_EXPR])
desc.expr = true;
table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask); table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask);
if (IS_ERR(table)) { if (IS_ERR(table)) {
NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]); NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);

2
net/netfilter/nft_set_bitmap.c
View File

@ -286,6 +286,8 @@ static bool nft_bitmap_estimate(const struct nft_set_desc *desc, u32 features,
/* Make sure bitmaps we don't get bitmaps larger than 16 Kbytes. */ /* Make sure bitmaps we don't get bitmaps larger than 16 Kbytes. */
if (desc->klen > 2) if (desc->klen > 2)
return false; return false;
else if (desc->expr)
return false;
est->size = nft_bitmap_total_size(desc->klen); est->size = nft_bitmap_total_size(desc->klen);
est->lookup = NFT_SET_CLASS_O_1; est->lookup = NFT_SET_CLASS_O_1;