netfilter: nf_tables: skip set types that do not support for expressions

The bitmap set does not support for expressions, skip it from the
estimation step.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 642bc3ef81aaf8a9d583f0667f2a587d16b0b2a4..6eb627b3c99b6f8cbd10a2af131489a26e83e579 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -266,6 +266,7 @@ struct nft_set_iter {
  *     @size: number of set elements
  *     @field_len: length of each field in concatenation, bytes
  *     @field_count: number of concatenated fields in element
+ *     @expr: set must support for expressions
  */
 struct nft_set_desc {
        unsigned int            klen;
@@ -273,6 +274,7 @@ struct nft_set_desc {
        unsigned int            size;
        u8                      field_len[NFT_REG32_COUNT];
        u8                      field_count;
+       bool                    expr;
 };
 
 /**

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index c1e04ac213921967a3445f60e2d6097f680282f8..8a73adfab7ff5811626ce3888eb07cf05d4eef5f 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4032,6 +4032,9 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
                        return err;
        }
 
+       if (nla[NFTA_SET_EXPR])
+               desc.expr = true;
+
        table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask);
        if (IS_ERR(table)) {
                NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);

diff --git a/net/netfilter/nft_set_bitmap.c b/net/netfilter/nft_set_bitmap.c
index 6829a497b4ccb1a45d877dbb0f78b3d4ad900280..32f0fc8be3a4c475f85595bf1fadba92afa600ea 100644 (file)
--- a/net/netfilter/nft_set_bitmap.c
+++ b/net/netfilter/nft_set_bitmap.c
@@ -286,6 +286,8 @@ static bool nft_bitmap_estimate(const struct nft_set_desc *desc, u32 features,
        /* Make sure bitmaps we don't get bitmaps larger than 16 Kbytes. */
        if (desc->klen > 2)
                return false;
+       else if (desc->expr)
+               return false;
 
        est->size   = nft_bitmap_total_size(desc->klen);
        est->lookup = NFT_SET_CLASS_O_1;