diff mbox series

[net,1/3] netfilter: nft_dynset: honor stateful expressions in set definition

Message ID 20210127132512.5472-2-pablo@netfilter.org (mailing list archive)
State Accepted
Commit fca05d4d61e65fa573a3768f9019a42143c03349
Delegated to: Netdev Maintainers
Headers show
Series [net,1/3] netfilter: nft_dynset: honor stateful expressions in set definition | expand

Checks

Context Check Description
netdev/cover_letter success Pull request
netdev/fixes_present success Link
netdev/patch_count success Link
netdev/tree_selection success Clearly marked for net
netdev/subject_prefix success Link
netdev/cc_maintainers warning 3 maintainers not CCed: kadlec@netfilter.org fw@strlen.de coreteam@netfilter.org
netdev/source_inline success Was 0 now: 0
netdev/verify_signedoff success Link
netdev/module_param success Was 0 now: 0
netdev/build_32bit success Errors and warnings before: 105 this patch: 105
netdev/kdoc success Errors and warnings before: 33 this patch: 33
netdev/verify_fixes success Link
netdev/checkpatch success total: 0 errors, 0 warnings, 0 checks, 31 lines checked
netdev/build_allmodconfig_warn success Errors and warnings before: 107 this patch: 107
netdev/header_inline success Link
netdev/stable success Stable not CCed

Commit Message

Pablo Neira Ayuso Jan. 27, 2021, 1:25 p.m. UTC
If the set definition contains stateful expressions, allocate them for
the newly added entries from the packet path.

Fixes: 65038428b2c6 ("netfilter: nf_tables: allow to specify stateful expression in set definition")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 include/net/netfilter/nf_tables.h | 2 ++
 net/netfilter/nf_tables_api.c     | 5 ++---
 net/netfilter/nft_dynset.c        | 6 ++++++
 3 files changed, 10 insertions(+), 3 deletions(-)

Comments

patchwork-bot+netdevbpf@kernel.org Jan. 28, 2021, 2 a.m. UTC | #1
Hello:

This series was applied to netdev/net.git (refs/heads/master):

On Wed, 27 Jan 2021 14:25:10 +0100 you wrote:
> If the set definition contains stateful expressions, allocate them for
> the newly added entries from the packet path.
> 
> Fixes: 65038428b2c6 ("netfilter: nf_tables: allow to specify stateful expression in set definition")
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
>  include/net/netfilter/nf_tables.h | 2 ++
>  net/netfilter/nf_tables_api.c     | 5 ++---
>  net/netfilter/nft_dynset.c        | 6 ++++++
>  3 files changed, 10 insertions(+), 3 deletions(-)

Here is the summary with links:
  - [net,1/3] netfilter: nft_dynset: honor stateful expressions in set definition
    https://git.kernel.org/netdev/net/c/fca05d4d61e6
  - [net,2/3] netfilter: nft_dynset: add timeout extension to template
    https://git.kernel.org/netdev/net/c/0c5b7a501e74
  - [net,3/3] netfilter: nft_dynset: dump expressions when set definition contains no expressions
    https://git.kernel.org/netdev/net/c/ce5379963b28

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
diff mbox series

Patch

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index f4af8362d234..4b6ecf532623 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -721,6 +721,8 @@  void *nft_set_elem_init(const struct nft_set *set,
 			const struct nft_set_ext_tmpl *tmpl,
 			const u32 *key, const u32 *key_end, const u32 *data,
 			u64 timeout, u64 expiration, gfp_t gfp);
+int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set,
+			    struct nft_expr *expr_array[]);
 void nft_set_elem_destroy(const struct nft_set *set, void *elem,
 			  bool destroy_expr);
 
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 15c467f1a9dd..8d3aa97b52e7 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -5235,9 +5235,8 @@  static void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,
 	kfree(elem);
 }
 
-static int nft_set_elem_expr_clone(const struct nft_ctx *ctx,
-				   struct nft_set *set,
-				   struct nft_expr *expr_array[])
+int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set,
+			    struct nft_expr *expr_array[])
 {
 	struct nft_expr *expr;
 	int err, i, k;
diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
index 0b053f75cd60..86204740f6c7 100644
--- a/net/netfilter/nft_dynset.c
+++ b/net/netfilter/nft_dynset.c
@@ -295,6 +295,12 @@  static int nft_dynset_init(const struct nft_ctx *ctx,
 			err = -EOPNOTSUPP;
 			goto err_expr_free;
 		}
+	} else if (set->num_exprs > 0) {
+		err = nft_set_elem_expr_clone(ctx, set, priv->expr_array);
+		if (err < 0)
+			return err;
+
+		priv->num_exprs = set->num_exprs;
 	}
 
 	nft_set_ext_prepare(&priv->tmpl);