lkml.org 
[lkml]   [2019]   [Oct]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.3 103/148] netfilter: nf_tables: allow lookups in dynamic sets
    Date
    From: Florian Westphal <fw@strlen.de>

    [ Upstream commit acab713177377d9e0889c46bac7ff0cfb9a90c4d ]

    This un-breaks lookups in sets that have the 'dynamic' flag set.
    Given this active example configuration:

    table filter {
    set set1 {
    type ipv4_addr
    size 64
    flags dynamic,timeout
    timeout 1m
    }

    chain input {
    type filter hook input priority 0; policy accept;
    }
    }

    ... this works:
    nft add rule ip filter input add @set1 { ip saddr }

    -> whenever rule is triggered, the source ip address is inserted
    into the set (if it did not exist).

    This won't work:
    nft add rule ip filter input ip saddr @set1 counter
    Error: Could not process rule: Operation not supported

    In other words, we can add entries to the set, but then can't make
    matching decision based on that set.

    That is just wrong -- all set backends support lookups (else they would
    not be very useful).
    The failure comes from an explicit rejection in nft_lookup.c.

    Looking at the history, it seems like NFT_SET_EVAL used to mean
    'set contains expressions' (aka. "is a meter"), for instance something like

    nft add rule ip filter input meter example { ip saddr limit rate 10/second }
    or
    nft add rule ip filter input meter example { ip saddr counter }

    The actual meaning of NFT_SET_EVAL however, is
    'set can be updated from the packet path'.

    'meters' and packet-path insertions into sets, such as
    'add @set { ip saddr }' use exactly the same kernel code (nft_dynset.c)
    and thus require a set backend that provides the ->update() function.

    The only set that provides this also is the only one that has the
    NFT_SET_EVAL feature flag.

    Removing the wrong check makes the above example work.
    While at it, also fix the flag check during set instantiation to
    allow supported combinations only.

    Fixes: 8aeff920dcc9b3f ("netfilter: nf_tables: add stateful object reference to set elements")
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/netfilter/nf_tables_api.c | 7 +++++--
    net/netfilter/nft_lookup.c | 3 ---
    2 files changed, 5 insertions(+), 5 deletions(-)

    diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
    index d47469f824a10..3b81323fa0171 100644
    --- a/net/netfilter/nf_tables_api.c
    +++ b/net/netfilter/nf_tables_api.c
    @@ -3562,8 +3562,11 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
    NFT_SET_OBJECT))
    return -EINVAL;
    /* Only one of these operations is supported */
    - if ((flags & (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT)) ==
    - (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT))
    + if ((flags & (NFT_SET_MAP | NFT_SET_OBJECT)) ==
    + (NFT_SET_MAP | NFT_SET_OBJECT))
    + return -EOPNOTSUPP;
    + if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) ==
    + (NFT_SET_EVAL | NFT_SET_OBJECT))
    return -EOPNOTSUPP;
    }

    diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c
    index c0560bf3c31bd..660bad688e2bc 100644
    --- a/net/netfilter/nft_lookup.c
    +++ b/net/netfilter/nft_lookup.c
    @@ -73,9 +73,6 @@ static int nft_lookup_init(const struct nft_ctx *ctx,
    if (IS_ERR(set))
    return PTR_ERR(set);

    - if (set->flags & NFT_SET_EVAL)
    - return -EOPNOTSUPP;
    -
    priv->sreg = nft_parse_register(tb[NFTA_LOOKUP_SREG]);
    err = nft_validate_register_load(priv->sreg, set->klen);
    if (err < 0)
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-10-10 11:01    [W:4.171 / U:0.352 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site