diff options
| author |   Pablo Neira Ayuso <pablo@netfilter.org> | 2020-03-27 17:43:06 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2020-03-30 02:05:39 +0200 |
| commit | d56aab2625f7bee79686566d3f6ad639d694b8cd (patch) | |
| tree | b4f8f2fab69017da7b64d62f0a8c8597e8746c4c /net/netfilter | |
| parent | netfilter: nft_dynset: validate set expression definition (diff) | |
| download | wireguard-linux-d56aab2625f7bee79686566d3f6ad639d694b8cd.tar.xz wireguard-linux-d56aab2625f7bee79686566d3f6ad639d694b8cd.zip | |
netfilter: nf_tables: skip set types that do not support for expressions
The bitmap set does not support for expressions, skip it from the
estimation step.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter')
| -rw-r--r-- | net/netfilter/nf_tables_api.c | 3 | ||||
| -rw-r--r-- | net/netfilter/nft_set_bitmap.c | 2 |
2 files changed, 5 insertions, 0 deletions
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index c1e04ac21392..8a73adfab7ff 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -4032,6 +4032,9 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, return err; } + if (nla[NFTA_SET_EXPR]) + desc.expr = true; + table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask); if (IS_ERR(table)) { NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]); diff --git a/net/netfilter/nft_set_bitmap.c b/net/netfilter/nft_set_bitmap.c index 6829a497b4cc..32f0fc8be3a4 100644 --- a/net/netfilter/nft_set_bitmap.c +++ b/net/netfilter/nft_set_bitmap.c @@ -286,6 +286,8 @@ static bool nft_bitmap_estimate(const struct nft_set_desc *desc, u32 features, /* Make sure bitmaps we don't get bitmaps larger than 16 Kbytes. */ if (desc->klen > 2) return false; + else if (desc->expr) + return false; est->size = nft_bitmap_total_size(desc->klen); est->lookup = NFT_SET_CLASS_O_1; |