From patchwork Mon Apr 13 19:48:02 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefano Brivio X-Patchwork-Id: 1269930 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=HhkJgU9m; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 491K160Tctz9sSX for ; Tue, 14 Apr 2020 05:48:26 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388138AbgDMTsY (ORCPT ); Mon, 13 Apr 2020 15:48:24 -0400 Received: from us-smtp-2.mimecast.com ([207.211.31.81]:56124 "EHLO us-smtp-delivery-1.mimecast.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S2388133AbgDMTsT (ORCPT ); Mon, 13 Apr 2020 15:48:19 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1586807299; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=B7S6jfH2bXGnLm93hbRooNCsniyK1VHRpamB8kgQtNk=; b=HhkJgU9mhUoIOjpwkFRzeZl/7jxjAJdWT2lmwlDwDO0tUObmdO6iYEGnGd2DOKtxQXhd21 05/BPg7LptZBnmZkf9+seihsXDPpECbet22X6+kk0+ZMqGmQxb6TyrVxS4YD/wIGwzoa1P luXioqBzJOqnCHBFmqmOBH+BWvD5WhA= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-155-5pV-29BsN2yxxbpf81w1pg-1; Mon, 13 Apr 2020 15:48:16 -0400 X-MC-Unique: 5pV-29BsN2yxxbpf81w1pg-1 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 5694718B5F97; Mon, 13 Apr 2020 19:48:15 +0000 (UTC) Received: from epycfail.redhat.com (unknown [10.36.110.14]) by smtp.corp.redhat.com (Postfix) with ESMTP id 728DF9F999; Mon, 13 Apr 2020 19:48:14 +0000 (UTC) From: Stefano Brivio To: Pablo Neira Ayuso Cc: netfilter-devel@vger.kernel.org Subject: [PATCH nft 1/2] include: Resync nf_tables.h cache copy Date: Mon, 13 Apr 2020 21:48:02 +0200 Message-Id: <89cc1df6bae539f00756b7ae049db185a096d4a8.1586806931.git.sbrivio@redhat.com> In-Reply-To: References: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Get this header in sync with nf.git as of commit ef516e8625dd. Signed-off-by: Stefano Brivio --- include/linux/netfilter/nf_tables.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h index 30f2a87270dc..4565456c0ef4 100644 --- a/include/linux/netfilter/nf_tables.h +++ b/include/linux/netfilter/nf_tables.h @@ -276,6 +276,7 @@ enum nft_rule_compat_attributes { * @NFT_SET_TIMEOUT: set uses timeouts * @NFT_SET_EVAL: set can be updated from the evaluation path * @NFT_SET_OBJECT: set contains stateful objects + * @NFT_SET_CONCAT: set contains a concatenation */ enum nft_set_flags { NFT_SET_ANONYMOUS = 0x1, @@ -285,6 +286,7 @@ enum nft_set_flags { NFT_SET_TIMEOUT = 0x10, NFT_SET_EVAL = 0x20, NFT_SET_OBJECT = 0x40, + NFT_SET_CONCAT = 0x80, }; /** From patchwork Mon Apr 13 19:48:03 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefano Brivio X-Patchwork-Id: 1269931 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=JolhGMPX; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 491K184z8Mz9sP7 for ; Tue, 14 Apr 2020 05:48:28 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388139AbgDMTs0 (ORCPT ); Mon, 13 Apr 2020 15:48:26 -0400 Received: from us-smtp-1.mimecast.com ([205.139.110.61]:29131 "EHLO us-smtp-delivery-1.mimecast.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S2388135AbgDMTsW (ORCPT ); Mon, 13 Apr 2020 15:48:22 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1586807301; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=6LhhNRCmojD26RDFAMabxwkvxiOVsuKouxlm7IswvCA=; b=JolhGMPXW6OPu60klT+va9aCoBN3bzy4+5iysH+8RlDFO6kmZz3FEFQpju7CKbvR2cG3Sw dILuTq2pec0EMLCDcfCgApMgDJSxFZ8oxojp5xc70RrxzadEpQz3Rajl/mTUbN60oYoal1 nXM5LsSeWHSPibLS8dtczQqUr3Fi+T0= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-426-UlGUOzccOu-XDayesDkOeQ-1; Mon, 13 Apr 2020 15:48:17 -0400 X-MC-Unique: UlGUOzccOu-XDayesDkOeQ-1 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 06D418017F3; Mon, 13 Apr 2020 19:48:17 +0000 (UTC) Received: from epycfail.redhat.com (unknown [10.36.110.14]) by smtp.corp.redhat.com (Postfix) with ESMTP id C478D96FB1; Mon, 13 Apr 2020 19:48:15 +0000 (UTC) From: Stefano Brivio To: Pablo Neira Ayuso Cc: netfilter-devel@vger.kernel.org Subject: [PATCH nft 2/2] src: Set NFT_SET_CONCAT flag for sets with concatenated ranges Date: Mon, 13 Apr 2020 21:48:03 +0200 Message-Id: <12dd79d1d0ff6697fcc609056808abef4b53311a.1586806931.git.sbrivio@redhat.com> In-Reply-To: References: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Pablo reports that nft, after commit 8ac2f3b2fca3 ("src: Add support for concatenated set ranges"), crashes with older kernels (< 5.6) without support for concatenated set ranges: those sets will be sent to the kernel, which adds them without notion of the fact that different concatenated fields are actually included, and nft crashes while trying to list this kind of malformed concatenation. Use the NFT_SET_CONCAT flag introduced by kernel commit ef516e8625dd ("netfilter: nf_tables: reintroduce the NFT_SET_CONCAT flag") when sets including concatenated ranges are sent to the kernel, so that older kernels (with no knowledge of this flag itself) will refuse set creation. Note that, in expr_evaluate_set(), we have to check for the presence of the flag, also on empty sets that might carry it in context data, and actually set it in the actual set flags. Reported-by: Pablo Neira Ayuso Signed-off-by: Stefano Brivio --- src/evaluate.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/evaluate.c b/src/evaluate.c index fcc79386b325..91901921155f 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1382,10 +1382,16 @@ static int expr_evaluate_set(struct eval_ctx *ctx, struct expr **expr) set->size += i->size - 1; set->set_flags |= i->set_flags; expr_free(i); - } else if (!expr_is_singleton(i)) + } else if (!expr_is_singleton(i)) { set->set_flags |= NFT_SET_INTERVAL; + if (i->key->etype == EXPR_CONCAT) + set->set_flags |= NFT_SET_CONCAT; + } } + if (ctx->set && ctx->set->flags & (NFT_SET_CONCAT)) + set->set_flags |= NFT_SET_CONCAT; + set->set_flags |= NFT_SET_CONSTANT; datatype_set(set, ctx->ectx.dtype); @@ -3463,6 +3469,7 @@ static int set_evaluate(struct eval_ctx *ctx, struct set *set) memcpy(&set->desc.field_len, &set->key->field_len, sizeof(set->desc.field_len)); set->desc.field_count = set->key->field_count; + set->flags |= NFT_SET_CONCAT; } if (set_is_datamap(set->flags)) {