History

netfilter: nftables: add set expression flags

The set flag NFT_SET_EXPR provides a hint to the kernel that userspace supports for multiple expressions per set element. In the same direction, NFT_DYNSET_F_EXPR specifies that dynset expression defines multiple expressions per set element. This allows new userspace software with old kernels to bail out with EOPNOTSUPP. This update is similar to ef516e8625dd ("netfilter: nf_tables: reintroduce the NFT_SET_CONCAT flag"). The NFT_SET_EXPR flag needs to be set on when the NFTA_SET_EXPRESSIONS attribute is specified. The NFT_SET_EXPR flag is not set on with NFTA_SET_EXPR to retain backward compatibility in old userspace binaries.

Pablo Neira Ayuso committed 5 years ago

Commit b4e70d81 parent 95cd4bc3 files · +15 −3Browse files

Showing the changes to include/uapi/linux (1 of 3 files). Show all

Unified · Split

include/uapi/linux/netfilter/nf_tables.h+3−0
@@ -293,6 +293,7 @@ enum nft_rule_compat_attributes { · 292 unmodified lines
293 * @NFT_SET_EVAL: set can be updated from the evaluation path293 * @NFT_SET_EVAL: set can be updated from the evaluation path
294 * @NFT_SET_OBJECT: set contains stateful objects294 * @NFT_SET_OBJECT: set contains stateful objects
295 * @NFT_SET_CONCAT: set contains a concatenation295 * @NFT_SET_CONCAT: set contains a concatenation
296 * @NFT_SET_EXPR: set contains expressions
296 */297 */
297enum nft_set_flags {298enum nft_set_flags {
298 NFT_SET_ANONYMOUS = 0x1,299 NFT_SET_ANONYMOUS = 0x1,
@@ -303,6 +304,7 @@ enum nft_set_flags { · 4 unmodified lines
303 NFT_SET_EVAL = 0x20,304 NFT_SET_EVAL = 0x20,
304 NFT_SET_OBJECT = 0x40,305 NFT_SET_OBJECT = 0x40,
305 NFT_SET_CONCAT = 0x80,306 NFT_SET_CONCAT = 0x80,
307 NFT_SET_EXPR = 0x100,
306};308};
307 309
308/**310/**
@@ -706,6 +708,7 @@ enum nft_dynset_ops { · 397 unmodified lines
706 708
707enum nft_dynset_flags {709enum nft_dynset_flags {
708 NFT_DYNSET_F_INV = (1 << 0),710 NFT_DYNSET_F_INV = (1 << 0),
711 NFT_DYNSET_F_EXPR = (1 << 1),
709};712};
710 713
711/**714/**