From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Florian Westphal <fw@strlen.de>,
Pablo Neira Ayuso <pablo@netfilter.org>,
Sasha Levin <sashal@kernel.org>,
netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.3 18/71] netfilter: nf_tables: allow lookups in dynamic sets
Date: Tue, 1 Oct 2019 12:38:28 -0400 [thread overview]
Message-ID: <20191001163922.14735-18-sashal@kernel.org> (raw)
In-Reply-To: <20191001163922.14735-1-sashal@kernel.org>
From: Florian Westphal <fw@strlen.de>
[ Upstream commit acab713177377d9e0889c46bac7ff0cfb9a90c4d ]
This un-breaks lookups in sets that have the 'dynamic' flag set.
Given this active example configuration:
table filter {
set set1 {
type ipv4_addr
size 64
flags dynamic,timeout
timeout 1m
}
chain input {
type filter hook input priority 0; policy accept;
}
}
... this works:
nft add rule ip filter input add @set1 { ip saddr }
-> whenever rule is triggered, the source ip address is inserted
into the set (if it did not exist).
This won't work:
nft add rule ip filter input ip saddr @set1 counter
Error: Could not process rule: Operation not supported
In other words, we can add entries to the set, but then can't make
matching decision based on that set.
That is just wrong -- all set backends support lookups (else they would
not be very useful).
The failure comes from an explicit rejection in nft_lookup.c.
Looking at the history, it seems like NFT_SET_EVAL used to mean
'set contains expressions' (aka. "is a meter"), for instance something like
nft add rule ip filter input meter example { ip saddr limit rate 10/second }
or
nft add rule ip filter input meter example { ip saddr counter }
The actual meaning of NFT_SET_EVAL however, is
'set can be updated from the packet path'.
'meters' and packet-path insertions into sets, such as
'add @set { ip saddr }' use exactly the same kernel code (nft_dynset.c)
and thus require a set backend that provides the ->update() function.
The only set that provides this also is the only one that has the
NFT_SET_EVAL feature flag.
Removing the wrong check makes the above example work.
While at it, also fix the flag check during set instantiation to
allow supported combinations only.
Fixes: 8aeff920dcc9b3f ("netfilter: nf_tables: add stateful object reference to set elements")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_tables_api.c | 7 +++++--
net/netfilter/nft_lookup.c | 3 ---
2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index d47469f824a10..3b81323fa0171 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3562,8 +3562,11 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
NFT_SET_OBJECT))
return -EINVAL;
/* Only one of these operations is supported */
- if ((flags & (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT)) ==
- (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT))
+ if ((flags & (NFT_SET_MAP | NFT_SET_OBJECT)) ==
+ (NFT_SET_MAP | NFT_SET_OBJECT))
+ return -EOPNOTSUPP;
+ if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) ==
+ (NFT_SET_EVAL | NFT_SET_OBJECT))
return -EOPNOTSUPP;
}
diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c
index c0560bf3c31bd..660bad688e2bc 100644
--- a/net/netfilter/nft_lookup.c
+++ b/net/netfilter/nft_lookup.c
@@ -73,9 +73,6 @@ static int nft_lookup_init(const struct nft_ctx *ctx,
if (IS_ERR(set))
return PTR_ERR(set);
- if (set->flags & NFT_SET_EVAL)
- return -EOPNOTSUPP;
-
priv->sreg = nft_parse_register(tb[NFTA_LOOKUP_SREG]);
err = nft_validate_register_load(priv->sreg, set->klen);
if (err < 0)
--
2.20.1
next prev parent reply other threads:[~2019-10-01 16:39 UTC|newest]
Thread overview: 82+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-01 16:38 [PATCH AUTOSEL 5.3 01/71] drivers: thermal: qcom: tsens: Fix memory leak from qfprom read Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 02/71] ima: always return negative code for error Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 03/71] ima: fix freeing ongoing ahash_request Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 04/71] fs: nfs: Fix possible null-pointer dereferences in encode_attrs() Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 05/71] xprtrdma: Toggle XPRT_CONGESTED in xprtrdma's slot methods Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 06/71] xprtrdma: Send Queue size grows after a reconnect Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 07/71] 9p: Transport error uninitialized Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 08/71] 9p: avoid attaching writeback_fid on mmap with type PRIVATE Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 09/71] 9p/cache.c: Fix memory leak in v9fs_cache_session_get_cookie Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 10/71] xen/pci: reserve MCFG areas earlier Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 11/71] fuse: fix request limit Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 12/71] ceph: fix directories inode i_blkbits initialization Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 13/71] ceph: fetch cap_gen under spinlock in ceph_add_cap Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 14/71] ceph: reconnect connection if session hang in opening state Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 15/71] rbd: fix response length parameter for encoded strings Sasha Levin
2019-10-01 17:15 ` Ilya Dryomov
2019-10-08 21:29 ` Sasha Levin
2019-10-09 3:45 ` Jens Axboe
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 16/71] SUNRPC: RPC level errors should always set task->tk_rpc_status Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 17/71] watchdog: aspeed: Add support for AST2600 Sasha Levin
2019-10-01 16:38 ` Sasha Levin [this message]
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 19/71] drm/amdgpu: Fix KFD-related kernel oops on Hawaii Sasha Levin
2019-10-01 16:38 ` Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 20/71] drm/amdgpu: Check for valid number of registers to read Sasha Levin
2019-10-01 16:38 ` Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 21/71] perf probe: Fix to clear tev->nargs in clear_probe_trace_event() Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 22/71] pNFS: Ensure we do clear the return-on-close layout stateid on fatal errors Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 23/71] SUNRPC: Don't try to parse incomplete RPC messages Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 24/71] net/sched: act_sample: don't push mac header on ip6gre ingress Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 25/71] pwm: stm32-lp: Add check in case requested period cannot be achieved Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 26/71] cdc_ncm: fix divide-by-zero caused by invalid wMaxPacketSize Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 27/71] usbnet: ignore endpoints with " Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 28/71] net/phy: fix DP83865 10 Mbps HDX loopback disable function Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 29/71] net_sched: add max len check for TCA_KIND Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 30/71] selftests/seccomp: fix build on older kernels Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 31/71] x86/purgatory: Disable the stackleak GCC plugin for the purgatory Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 32/71] ntb: point to right memory window index Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 33/71] thermal: Fix use-after-free when unregistering thermal zone device Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 34/71] thermal_hwmon: Sanitize thermal_zone type Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 35/71] iommu/amd: Fix downgrading default page-sizes in alloc_pte() Sasha Levin
2019-10-01 16:38 ` Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 36/71] libnvdimm/region: Initialize bad block for volatile namespaces Sasha Levin
2019-10-01 16:38 ` Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 37/71] net/mlx5e: Fix matching on tunnel addresses type Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 38/71] net/mlx5e: Fix traffic duplication in ethtool steering Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 39/71] KVM: hyperv: Fix Direct Synthetic timers assert an interrupt w/o lapic_in_kernel Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 40/71] libnvdimm: Fix endian conversion issues Sasha Levin
2019-10-01 16:38 ` Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 41/71] fuse: fix memleak in cuse_channel_open Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 42/71] arcnet: provide a buffer big enough to actually receive packets Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 43/71] libnvdimm/nfit_test: Fix acpi_handle redefinition Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 44/71] ppp: Fix memory leak in ppp_write Sasha Levin
2019-10-01 16:38 ` Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 45/71] sched/membarrier: Call sync_core only before usermode for same mm Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 46/71] sched/membarrier: Fix private expedited registration check Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 47/71] sched/core: Fix migration to invalid CPU in __set_cpus_allowed_ptr() Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 48/71] perf build: Add detection of java-11-openjdk-devel package Sasha Levin
2019-10-01 16:38 ` [PATCH AUTOSEL 5.3 49/71] include/trace/events/writeback.h: fix -Wstringop-truncation warnings Sasha Levin
2019-10-01 16:39 ` [PATCH AUTOSEL 5.3 50/71] selftests/bpf: adjust strobemeta loop to satisfy latest clang Sasha Levin
2019-10-01 16:39 ` [PATCH AUTOSEL 5.3 51/71] kernel/elfcore.c: include proper prototypes Sasha Levin
2019-10-01 16:39 ` [PATCH AUTOSEL 5.3 52/71] libbpf: fix false uninitialized variable warning Sasha Levin
2019-10-01 16:39 ` [PATCH AUTOSEL 5.3 53/71] kexec: bail out upon SIGKILL when allocating memory Sasha Levin
2019-10-01 16:39 ` Sasha Levin
2019-10-01 16:39 ` [PATCH AUTOSEL 5.3 54/71] blk-mq: move lockdep_assert_held() into elevator_exit Sasha Levin
2019-10-01 16:39 ` [PATCH AUTOSEL 5.3 55/71] bpf: Fix bpf_event_output re-entry issue Sasha Levin
2019-10-01 16:39 ` [PATCH AUTOSEL 5.3 56/71] macsec: drop skb sk before calling gro_cells_receive Sasha Levin
2019-10-01 16:39 ` [PATCH AUTOSEL 5.3 57/71] net: dsa: microchip: Always set regmap stride to 1 Sasha Levin
2019-10-01 16:39 ` [PATCH AUTOSEL 5.3 58/71] i2c: qcom-geni: Disable DMA processing on the Lenovo Yoga C630 Sasha Levin
2019-10-01 16:39 ` [PATCH AUTOSEL 5.3 59/71] perf unwind: Fix libunwind build failure on i386 systems Sasha Levin
2019-10-01 16:39 ` [PATCH AUTOSEL 5.3 60/71] nfp: flower: fix memory leak in nfp_flower_spawn_vnic_reprs Sasha Levin
2019-10-01 16:39 ` [PATCH AUTOSEL 5.3 61/71] net: stmmac: Fix page pool size Sasha Levin
2019-10-01 16:39 ` [PATCH AUTOSEL 5.3 62/71] net: phy: micrel: add Asym Pause workaround for KSZ9021 Sasha Levin
2019-10-01 16:39 ` [PATCH AUTOSEL 5.3 63/71] mlxsw: spectrum_flower: Fail in case user specifies multiple mirror actions Sasha Levin
2019-10-01 16:39 ` [PATCH AUTOSEL 5.3 64/71] vrf: Do not attempt to create IPv6 mcast rule if IPv6 is disabled Sasha Levin
2019-10-01 16:39 ` [PATCH AUTOSEL 5.3 65/71] nfp: flower: prevent memory leak in nfp_flower_spawn_phy_reprs Sasha Levin
2019-10-01 16:39 ` [PATCH AUTOSEL 5.3 66/71] nfp: abm: fix memory leak in nfp_abm_u32_knode_replace Sasha Levin
2019-10-01 16:39 ` [PATCH AUTOSEL 5.3 67/71] fuse: fix deadlock with aio poll and fuse_iqueue::waitq.lock Sasha Levin
2019-10-01 16:39 ` [PATCH AUTOSEL 5.3 68/71] drm/radeon: Bail earlier when radeon.cik_/si_support=0 is passed Sasha Levin
2019-10-01 16:39 ` Sasha Levin
2019-10-01 16:39 ` [PATCH AUTOSEL 5.3 69/71] usbnet: sanity checking of packet sizes and device mtu Sasha Levin
2019-10-01 16:39 ` [PATCH AUTOSEL 5.3 70/71] sch_netem: fix a divide by zero in tabledist() Sasha Levin
2019-10-01 16:39 ` [PATCH AUTOSEL 5.3 71/71] Btrfs: fix selftests failure due to uninitialized i_mode in test inodes Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191001163922.14735-18-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=coreteam@netfilter.org \
--cc=fw@strlen.de \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.