From a7fc936804084145e2a6374e23744defdc948e09 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Wed, 11 Mar 2020 15:30:12 +0100 Subject: netfilter: nf_tables: add nft_set_elem_expr_alloc() Add helper function to create stateful expression. Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nft_dynset.c | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-) (limited to 'net/netfilter/nft_dynset.c') diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c index 683785225a3e..e106cf1c5b8b 100644 --- a/net/netfilter/nft_dynset.c +++ b/net/netfilter/nft_dynset.c @@ -206,21 +206,10 @@ static int nft_dynset_init(const struct nft_ctx *ctx, if (!(set->flags & NFT_SET_EVAL)) return -EINVAL; - priv->expr = nft_expr_init(ctx, tb[NFTA_DYNSET_EXPR]); + priv->expr = nft_set_elem_expr_alloc(ctx, set, + tb[NFTA_DYNSET_EXPR]); if (IS_ERR(priv->expr)) return PTR_ERR(priv->expr); - - err = -EOPNOTSUPP; - if (!(priv->expr->ops->type->flags & NFT_EXPR_STATEFUL)) - goto err1; - - if (priv->expr->ops->type->flags & NFT_EXPR_GC) { - if (set->flags & NFT_SET_TIMEOUT) - goto err1; - if (!set->ops->gc_init) - goto err1; - set->ops->gc_init(set); - } } nft_set_ext_prepare(&priv->tmpl); -- cgit From 76adfafecab5e4aae460e9781720b20d115bb096 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Wed, 11 Mar 2020 15:30:15 +0100 Subject: netfilter: nf_tables: add nft_set_elem_update_expr() helper function This helper function runs the eval path of the stateful expression of an existing set element. Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nft_dynset.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) (limited to 'net/netfilter/nft_dynset.c') diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c index e106cf1c5b8b..46ab28ec4b53 100644 --- a/net/netfilter/nft_dynset.c +++ b/net/netfilter/nft_dynset.c @@ -81,7 +81,6 @@ void nft_dynset_eval(const struct nft_expr *expr, const struct nft_dynset *priv = nft_expr_priv(expr); struct nft_set *set = priv->set; const struct nft_set_ext *ext; - const struct nft_expr *sexpr; u64 timeout; if (priv->op == NFT_DYNSET_OP_DELETE) { @@ -91,18 +90,13 @@ void nft_dynset_eval(const struct nft_expr *expr, if (set->ops->update(set, ®s->data[priv->sreg_key], nft_dynset_new, expr, regs, &ext)) { - sexpr = NULL; - if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR)) - sexpr = nft_set_ext_expr(ext); - if (priv->op == NFT_DYNSET_OP_UPDATE && nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) { timeout = priv->timeout ? : set->timeout; *nft_set_ext_expiration(ext) = get_jiffies_64() + timeout; } - if (sexpr != NULL) - sexpr->ops->eval(sexpr, regs, pkt); + nft_set_elem_update_expr(ext, regs, pkt); if (priv->invert) regs->verdict.code = NFT_BREAK; -- cgit From c604cc691c10cb23ce7fb4ea2c9beb703d321790 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Tue, 17 Mar 2020 14:13:44 +0100 Subject: netfilter: nf_tables: move nft_expr_clone() to nf_tables_api.c Move the nft_expr_clone() helper function to the core. Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nft_dynset.c | 17 ----------------- 1 file changed, 17 deletions(-) (limited to 'net/netfilter/nft_dynset.c') diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c index 46ab28ec4b53..d1b64c8de585 100644 --- a/net/netfilter/nft_dynset.c +++ b/net/netfilter/nft_dynset.c @@ -24,23 +24,6 @@ struct nft_dynset { struct nft_set_binding binding; }; -static int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src) -{ - int err; - - if (src->ops->clone) { - dst->ops = src->ops; - err = src->ops->clone(dst, src); - if (err < 0) - return err; - } else { - memcpy(dst, src, src->ops->size); - } - - __module_get(src->ops->type->owner); - return 0; -} - static void *nft_dynset_new(struct nft_set *set, const struct nft_expr *expr, struct nft_regs *regs) { -- cgit From 8548bde9890fd0316f49d3c6937573c18261f68f Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Fri, 27 Mar 2020 17:43:05 +0100 Subject: netfilter: nft_dynset: validate set expression definition If the global set expression definition mismatches the dynset expression, then bail out. Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nft_dynset.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'net/netfilter/nft_dynset.c') diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c index d1b64c8de585..64ca13a1885b 100644 --- a/net/netfilter/nft_dynset.c +++ b/net/netfilter/nft_dynset.c @@ -187,6 +187,11 @@ static int nft_dynset_init(const struct nft_ctx *ctx, tb[NFTA_DYNSET_EXPR]); if (IS_ERR(priv->expr)) return PTR_ERR(priv->expr); + + if (set->expr && set->expr->ops != priv->expr->ops) { + err = -EOPNOTSUPP; + goto err_expr_free; + } } nft_set_ext_prepare(&priv->tmpl); @@ -205,7 +210,7 @@ static int nft_dynset_init(const struct nft_ctx *ctx, err = nf_tables_bind_set(ctx, set, &priv->binding); if (err < 0) - goto err1; + goto err_expr_free; if (set->size == 0) set->size = 0xffff; @@ -213,7 +218,7 @@ static int nft_dynset_init(const struct nft_ctx *ctx, priv->set = set; return 0; -err1: +err_expr_free: if (priv->expr != NULL) nft_expr_destroy(ctx, priv->expr); return err; -- cgit