netfilter: nf_tables: add flag to indicate set contains expressions

Add a set flag to indicate that the set is used as a state table and
contains expressions for evaluation. This operation is mutually
exclusive with the mapping operation, so sets specifying both are
rejected. The lookup expression also rejects binding to state tables
since it only deals with loopup and map operations.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index f9c5af22a6af3d7cf7d3372497a5a6e77359864d..48942381d02f589316d80c66aa8490cb22e24bec 100644 (file)
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -238,6 +238,7 @@ enum nft_rule_compat_attributes {
  * @NFT_SET_INTERVAL: set contains intervals
  * @NFT_SET_MAP: set is used as a dictionary
  * @NFT_SET_TIMEOUT: set uses timeouts
+ * @NFT_SET_EVAL: set contains expressions for evaluation
  */
 enum nft_set_flags {
        NFT_SET_ANONYMOUS               = 0x1,
@@ -245,6 +246,7 @@ enum nft_set_flags {
        NFT_SET_INTERVAL                = 0x4,
        NFT_SET_MAP                     = 0x8,
        NFT_SET_TIMEOUT                 = 0x10,
+       NFT_SET_EVAL                    = 0x20,
 };
 
 /**

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 8830811550ec5c970a15e3b730c4f186912724ac..78af83bc9c8e8dbfcead6e151247a127602ac107 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2661,9 +2661,13 @@ static int nf_tables_newset(struct sock *nlsk, struct sk_buff *skb,
        if (nla[NFTA_SET_FLAGS] != NULL) {
                flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
                if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
-                             NFT_SET_INTERVAL | NFT_SET_MAP |
-                             NFT_SET_TIMEOUT))
+                             NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
+                             NFT_SET_MAP | NFT_SET_EVAL))
                        return -EINVAL;
+               /* Only one of both operations is supported */
+               if ((flags & (NFT_SET_MAP | NFT_SET_EVAL)) ==
+                            (NFT_SET_MAP | NFT_SET_EVAL))
+                       return -EOPNOTSUPP;
        }
 
        dtype = 0;

diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c
index ba1466209f2ab7b26607a9746771d0a4ad8a9209..b3c31ef8015d2517f594dc60a027c52aac8d41fe 100644 (file)
--- a/net/netfilter/nft_lookup.c
+++ b/net/netfilter/nft_lookup.c
@@ -71,6 +71,9 @@ static int nft_lookup_init(const struct nft_ctx *ctx,
                        return PTR_ERR(set);
        }
 
+       if (set->flags & NFT_SET_EVAL)
+               return -EOPNOTSUPP;
+
        priv->sreg = nft_parse_register(tb[NFTA_LOOKUP_SREG]);
        err = nft_validate_register_load(priv->sreg, set->klen);
        if (err < 0)