Introduce a new configuration option for this expression, which allows users to invert the logic of set lookups. In _init() we will now return EINVAL if NFT_LOOKUP_F_INV is in anyway related to a map lookup. The code in the _eval() function has been untangled and updated to sopport the XOR of options, as we should consider 4 cases: * lookup false, invert false -> NFT_BREAK * lookup false, invert true -> return w/o NFT_BREAK * lookup true, invert false -> return w/o NFT_BREAK * lookup true, invert true -> NFT_BREAK
Showing the changes to include/uapi (1 of 2 files). Show all
Unified · Split
| @@ -546,6 +546,10 @@ enum nft_cmp_attributes { · 545 unmodified lines | ||
| 546 | 546 | }; |
| 547 | 547 | #define NFTA_CMP_MAX (__NFTA_CMP_MAX - 1) |
| 548 | 548 | |
| 549 | +enum nft_lookup_flags { | |
| 550 | + NFT_LOOKUP_F_INV = (1 << 0), | |
| 551 | +}; | |
| 552 | + | |
| 549 | 553 | /** |
| 550 | 554 | * enum nft_lookup_attributes - nf_tables set lookup expression netlink attributes |
| 551 | 555 | * |
| @@ -553,6 +557,7 @@ enum nft_cmp_attributes { · 1 unmodified line | ||
| 553 | 557 | * @NFTA_LOOKUP_SREG: source register of the data to look for (NLA_U32: nft_registers) |
| 554 | 558 | * @NFTA_LOOKUP_DREG: destination register (NLA_U32: nft_registers) |
| 555 | 559 | * @NFTA_LOOKUP_SET_ID: uniquely identifies a set in a transaction (NLA_U32) |
| 560 | + * @NFTA_LOOKUP_FLAGS: flags (NLA_U32: enum nft_lookup_flags) | |
| 556 | 561 | */ |
| 557 | 562 | enum nft_lookup_attributes { |
| 558 | 563 | NFTA_LOOKUP_UNSPEC, |
| @@ -560,6 +565,7 @@ enum nft_lookup_attributes { · 1 unmodified line | ||
| 560 | 565 | NFTA_LOOKUP_SREG, |
| 561 | 566 | NFTA_LOOKUP_DREG, |
| 562 | 567 | NFTA_LOOKUP_SET_ID, |
| 568 | + NFTA_LOOKUP_FLAGS, | |
| 563 | 569 | __NFTA_LOOKUP_MAX |
| 564 | 570 | }; |
| 565 | 571 | #define NFTA_LOOKUP_MAX (__NFTA_LOOKUP_MAX - 1) |