Commit c7a72e3f authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: add nft_set_lookup() 



This new function consolidates set lookup via either name or ID by
introducing a new nft_set_lookup() function. Replace existing spots
where we can use this too.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent c56e3956

include/net/netfilter/nf_tables.h

+5 −4
Original line number Diff line number Diff line
@@ -385,10 +385,11 @@ static inline struct nft_set *nft_set_container_of(const void *priv) 
	return (void *)priv - offsetof(struct nft_set, data);

}



struct nft_set *nf_tables_set_lookup(const struct nft_table *table,

				     const struct nlattr *nla, u8 genmask);

struct nft_set *nf_tables_set_lookup_byid(const struct net *net,

					  const struct nlattr *nla, u8 genmask);

struct nft_set *nft_set_lookup(const struct net *net,

			       const struct nft_table *table,

			       const struct nlattr *nla_set_name,

			       const struct nlattr *nla_set_id,

			       u8 genmask);



static inline unsigned long nft_set_gc_interval(const struct nft_set *set)

{

net/netfilter/nf_tables_api.c

+24 −7
Original line number Diff line number Diff line
@@ -2534,7 +2534,7 @@ static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net, 
	return 0;

}



struct nft_set *nf_tables_set_lookup(const struct nft_table *table,

static struct nft_set *nf_tables_set_lookup(const struct nft_table *table,

					    const struct nlattr *nla, u8 genmask)

{

	struct nft_set *set;
@@ -2549,9 +2549,8 @@ struct nft_set *nf_tables_set_lookup(const struct nft_table *table, 
	}

	return ERR_PTR(-ENOENT);

}

EXPORT_SYMBOL_GPL(nf_tables_set_lookup);



struct nft_set *nf_tables_set_lookup_byid(const struct net *net,

static struct nft_set *nf_tables_set_lookup_byid(const struct net *net,

						 const struct nlattr *nla,

						 u8 genmask)

{
@@ -2568,7 +2567,25 @@ struct nft_set *nf_tables_set_lookup_byid(const struct net *net, 
	}

	return ERR_PTR(-ENOENT);

}

EXPORT_SYMBOL_GPL(nf_tables_set_lookup_byid);



struct nft_set *nft_set_lookup(const struct net *net,

			       const struct nft_table *table,

			       const struct nlattr *nla_set_name,

			       const struct nlattr *nla_set_id,

			       u8 genmask)

{

	struct nft_set *set;



	set = nf_tables_set_lookup(table, nla_set_name, genmask);

	if (IS_ERR(set)) {

		if (!nla_set_id)

			return set;



		set = nf_tables_set_lookup_byid(net, nla_set_id, genmask);

	}

	return set;

}

EXPORT_SYMBOL_GPL(nft_set_lookup);



static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,

				    const char *name)

net/netfilter/nft_dynset.c

+4 −10
Original line number Diff line number Diff line
@@ -133,16 +133,10 @@ static int nft_dynset_init(const struct nft_ctx *ctx, 
			priv->invert = true;

	}



	set = nf_tables_set_lookup(ctx->table, tb[NFTA_DYNSET_SET_NAME],

				   genmask);

	if (IS_ERR(set)) {

		if (tb[NFTA_DYNSET_SET_ID])

			set = nf_tables_set_lookup_byid(ctx->net,

							tb[NFTA_DYNSET_SET_ID],

							genmask);

	set = nft_set_lookup(ctx->net, ctx->table, tb[NFTA_DYNSET_SET_NAME],

			     tb[NFTA_DYNSET_SET_ID], genmask);

	if (IS_ERR(set))

		return PTR_ERR(set);

	}



	if (set->ops->update == NULL)

		return -EOPNOTSUPP;

net/netfilter/nft_lookup.c

+4 −10
Original line number Diff line number Diff line
@@ -71,16 +71,10 @@ static int nft_lookup_init(const struct nft_ctx *ctx, 
	    tb[NFTA_LOOKUP_SREG] == NULL)

		return -EINVAL;



	set = nf_tables_set_lookup(ctx->table, tb[NFTA_LOOKUP_SET], genmask);

	if (IS_ERR(set)) {

		if (tb[NFTA_LOOKUP_SET_ID]) {

			set = nf_tables_set_lookup_byid(ctx->net,

							tb[NFTA_LOOKUP_SET_ID],

							genmask);

		}

	set = nft_set_lookup(ctx->net, ctx->table, tb[NFTA_LOOKUP_SET],

			     tb[NFTA_LOOKUP_SET_ID], genmask);

	if (IS_ERR(set))

		return PTR_ERR(set);

	}



	if (set->flags & NFT_SET_EVAL)

		return -EOPNOTSUPP;

net/netfilter/nft_objref.c

+4 −10
Original line number Diff line number Diff line
@@ -116,16 +116,10 @@ static int nft_objref_map_init(const struct nft_ctx *ctx, 
	struct nft_set *set;

	int err;



	set = nf_tables_set_lookup(ctx->table, tb[NFTA_OBJREF_SET_NAME], genmask);

	if (IS_ERR(set)) {

		if (tb[NFTA_OBJREF_SET_ID]) {

			set = nf_tables_set_lookup_byid(ctx->net,

							tb[NFTA_OBJREF_SET_ID],

							genmask);

		}

	set = nft_set_lookup(ctx->net, ctx->table, tb[NFTA_OBJREF_SET_NAME],

			     tb[NFTA_OBJREF_SET_ID], genmask);

	if (IS_ERR(set))

		return PTR_ERR(set);

	}



	if (!(set->flags & NFT_SET_OBJECT))

		return -EINVAL;