Introduce a new configuration option for this expression, which allows users to invert the logic of set lookups. In _init() we will now return EINVAL if NFT_LOOKUP_F_INV is in anyway related to a map lookup. The code in the _eval() function has been untangled and updated to sopport the XOR of options, as we should consider 4 cases: * lookup false, invert false -> NFT_BREAK * lookup false, invert true -> return w/o NFT_BREAK * lookup true, invert false -> return w/o NFT_BREAK * lookup true, invert true -> NFT_BREAK
Showing the changes to include/uapi (1 of 2 files). Show all
Unified · Split
| @@ -546,6 +546,10 @@ enum nft_cmp_attributes { · 545 unmodified lines | |||
| 546 | }; | 546 | }; |
| 547 | #define NFTA_CMP_MAX (__NFTA_CMP_MAX - 1) | 547 | #define NFTA_CMP_MAX (__NFTA_CMP_MAX - 1) |
| 548 | 548 | ||
| 549 | enum nft_lookup_flags { | ||
| 550 | NFT_LOOKUP_F_INV = (1 << 0), | ||
| 551 | }; | ||
| 552 | |||
| 549 | /** | 553 | /** |
| 550 | * enum nft_lookup_attributes - nf_tables set lookup expression netlink attributes | 554 | * enum nft_lookup_attributes - nf_tables set lookup expression netlink attributes |
| 551 | * | 555 | * |
| @@ -553,6 +557,7 @@ enum nft_cmp_attributes { · 1 unmodified line | |||
| 553 | * @NFTA_LOOKUP_SREG: source register of the data to look for (NLA_U32: nft_registers) | 557 | * @NFTA_LOOKUP_SREG: source register of the data to look for (NLA_U32: nft_registers) |
| 554 | * @NFTA_LOOKUP_DREG: destination register (NLA_U32: nft_registers) | 558 | * @NFTA_LOOKUP_DREG: destination register (NLA_U32: nft_registers) |
| 555 | * @NFTA_LOOKUP_SET_ID: uniquely identifies a set in a transaction (NLA_U32) | 559 | * @NFTA_LOOKUP_SET_ID: uniquely identifies a set in a transaction (NLA_U32) |
| 560 | * @NFTA_LOOKUP_FLAGS: flags (NLA_U32: enum nft_lookup_flags) | ||
| 556 | */ | 561 | */ |
| 557 | enum nft_lookup_attributes { | 562 | enum nft_lookup_attributes { |
| 558 | NFTA_LOOKUP_UNSPEC, | 563 | NFTA_LOOKUP_UNSPEC, |
| @@ -560,6 +565,7 @@ enum nft_lookup_attributes { · 1 unmodified line | |||
| 560 | NFTA_LOOKUP_SREG, | 565 | NFTA_LOOKUP_SREG, |
| 561 | NFTA_LOOKUP_DREG, | 566 | NFTA_LOOKUP_DREG, |
| 562 | NFTA_LOOKUP_SET_ID, | 567 | NFTA_LOOKUP_SET_ID, |
| 568 | NFTA_LOOKUP_FLAGS, | ||
| 563 | __NFTA_LOOKUP_MAX | 569 | __NFTA_LOOKUP_MAX |
| 564 | }; | 570 | }; |
| 565 | #define NFTA_LOOKUP_MAX (__NFTA_LOOKUP_MAX - 1) | 571 | #define NFTA_LOOKUP_MAX (__NFTA_LOOKUP_MAX - 1) |