[PATCH nft 1/3] rule: adjust set expression size accordingly with intervals

[PATCH nft 1/3] rule: adjust set expression size accordingly with intervals

[Pablo Neira Ayuso]

For implicit sets, we have to call set_to_intervals() before we add the
set so we have the net size in elements.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/rule.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/src/rule.c b/src/rule.c
index 5923bf64101e..0d9e393ab26f 100644
--- a/src/rule.c
+++ b/src/rule.c
@@ -914,10 +914,6 @@ static int do_add_chain(struct netlink_ctx *ctx, const struct handle *h,
 static int __do_add_setelems(struct netlink_ctx *ctx, const struct handle *h,
 			     struct set *set, struct expr *expr, bool excl)
 {
-	if (set->flags & NFT_SET_INTERVAL &&
-	    set_to_intervals(ctx->msgs, set, expr, true) < 0)
-		return -1;
-
 	expr->set_flags |= set->flags;
 	if (netlink_add_setelems(ctx, h, expr, excl) < 0)
 		return -1;
@@ -934,18 +930,27 @@ static int do_add_setelems(struct netlink_ctx *ctx, const struct handle *h,
 	table = table_lookup(h);
 	set = set_lookup(table, h->set);
 
+	if (set->flags & NFT_SET_INTERVAL &&
+	    set_to_intervals(ctx->msgs, set, init, true) < 0)
+		return -1;
+
 	return __do_add_setelems(ctx, h, set, init, excl);
 }
 
 static int do_add_set(struct netlink_ctx *ctx, const struct handle *h,
 		      struct set *set, bool excl)
 {
+	if (set->init != NULL) {
+		if (set->flags & NFT_SET_INTERVAL &&
+		    set_to_intervals(ctx->msgs, set, set->init, true) < 0)
+			return -1;
+	}
 	if (netlink_add_set(ctx, h, set, excl) < 0)
 		return -1;
-	if (set->init != NULL)
+	if (set->init != NULL) {
 		return __do_add_setelems(ctx, &set->handle, set, set->init,
 					 false);
-
+	}
 	return 0;
 }
 
-- 
2.1.4

[PATCH nft 2/3] segtree: reset element size counter before adding intervals to set

[Pablo Neira Ayuso]

Otherwise we get double the real size in terms of set elements during
the interval expansion to individual elements.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/segtree.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/segtree.c b/src/segtree.c
index 8df82a801ae4..15e8849cd684 100644
--- a/src/segtree.c
+++ b/src/segtree.c
@@ -552,6 +552,7 @@ int set_to_intervals(struct list_head *errs, struct set *set,
 		return -1;
 	segtree_linearize(&list, set, init, &tree, add);
 
+	init->size = 0;
 	list_for_each_entry_safe(ei, next, &list, list) {
 		if (segtree_debug()) {
 			pr_gmp_debug("list: [%.*Zx %.*Zx]\n",
@@ -566,6 +567,7 @@ int set_to_intervals(struct list_head *errs, struct set *set,
 		expr_print(init);
 		pr_gmp_debug("\n");
 	}
+
 	return 0;
 }
 
-- 
2.1.4

[PATCH nft 3/3] netlink: add size description for constant sets

[Pablo Neira Ayuso]

The kernel side can make better decisions with this information when
selecting the right backend, so add this information to the set netlink
message.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/netlink.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/netlink.c b/src/netlink.c
index 59e8918d2ba0..28821903f18c 100644
--- a/src/netlink.c
+++ b/src/netlink.c
@@ -1293,6 +1293,8 @@ static int netlink_add_set_batch(struct netlink_ctx *ctx,
 		if (set->desc.size != 0)
 			nftnl_set_set_u32(nls, NFTNL_SET_DESC_SIZE,
 					  set->desc.size);
+	} else if (set->init) {
+		nftnl_set_set_u32(nls, NFTNL_SET_DESC_SIZE, set->init->size);
 	}
 
 	udbuf = nftnl_udata_buf_alloc(NFT_USERDATA_MAXLEN);
-- 
2.1.4