Blame SOURCES/0004-monitor-Fix-output-for-ranges-in-anonymous-sets.patch

f1d1c0
From 2e7cb6c2d46d9b8b91ff4b5d6797b7544c23ba44 Mon Sep 17 00:00:00 2001
f1d1c0
From: Phil Sutter <psutter@redhat.com>
f1d1c0
Date: Mon, 13 Jan 2020 16:58:57 +0100
f1d1c0
Subject: [PATCH] monitor: Fix output for ranges in anonymous sets
f1d1c0
f1d1c0
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1774742
f1d1c0
Upstream Status: nftables commit ddbacd70d061e
f1d1c0
f1d1c0
commit ddbacd70d061eb1b6808f501969809bfb5d03001
f1d1c0
Author: Phil Sutter <phil@nwl.cc>
f1d1c0
Date:   Mon Jan 13 14:53:24 2020 +0100
f1d1c0
f1d1c0
    monitor: Fix output for ranges in anonymous sets
f1d1c0
f1d1c0
    Previous fix for named interval sets was simply wrong: Instead of
f1d1c0
    limiting decomposing to anonymous interval sets, it effectively disabled
f1d1c0
    it entirely.
f1d1c0
f1d1c0
    Since code needs to check for both interval and anonymous bits
f1d1c0
    separately, introduce set_is_interval() helper to keep the code
f1d1c0
    readable.
f1d1c0
f1d1c0
    Also extend test case to assert ranges in anonymous sets are correctly
f1d1c0
    printed by echo or monitor modes. Without this fix, range boundaries are
f1d1c0
    printed as individual set elements.
f1d1c0
f1d1c0
    Fixes: 5d57fa3e99bb9 ("monitor: Do not decompose non-anonymous sets")
f1d1c0
    Signed-off-by: Phil Sutter <phil@nwl.cc>
f1d1c0
    Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
f1d1c0
---
f1d1c0
 include/rule.h                         | 5 +++++
f1d1c0
 src/monitor.c                          | 2 +-
f1d1c0
 tests/monitor/testcases/set-interval.t | 5 +++++
f1d1c0
 3 files changed, 11 insertions(+), 1 deletion(-)
f1d1c0
f1d1c0
diff --git a/include/rule.h b/include/rule.h
f1d1c0
index 0b2eba3..47eb29f 100644
f1d1c0
--- a/include/rule.h
f1d1c0
+++ b/include/rule.h
f1d1c0
@@ -363,6 +363,11 @@ static inline bool set_is_meter(uint32_t set_flags)
f1d1c0
 	return set_is_anonymous(set_flags) && (set_flags & NFT_SET_EVAL);
f1d1c0
 }
f1d1c0
 
f1d1c0
+static inline bool set_is_interval(uint32_t set_flags)
f1d1c0
+{
f1d1c0
+	return set_flags & NFT_SET_INTERVAL;
f1d1c0
+}
f1d1c0
+
f1d1c0
 #include <statement.h>
f1d1c0
 
f1d1c0
 struct counter {
f1d1c0
diff --git a/src/monitor.c b/src/monitor.c
f1d1c0
index 0da9858..fb803cf 100644
f1d1c0
--- a/src/monitor.c
f1d1c0
+++ b/src/monitor.c
f1d1c0
@@ -500,7 +500,7 @@ static int netlink_events_obj_cb(const struct nlmsghdr *nlh, int type,
f1d1c0
 
f1d1c0
 static void rule_map_decompose_cb(struct set *s, void *data)
f1d1c0
 {
f1d1c0
-	if (s->flags & (NFT_SET_INTERVAL & NFT_SET_ANONYMOUS))
f1d1c0
+	if (set_is_interval(s->flags) && set_is_anonymous(s->flags))
f1d1c0
 		interval_map_decompose(s->init);
f1d1c0
 }
f1d1c0
 
f1d1c0
diff --git a/tests/monitor/testcases/set-interval.t b/tests/monitor/testcases/set-interval.t
f1d1c0
index 59930c5..1fbcfe2 100644
f1d1c0
--- a/tests/monitor/testcases/set-interval.t
f1d1c0
+++ b/tests/monitor/testcases/set-interval.t
f1d1c0
@@ -18,3 +18,8 @@ J {"add": {"element": {"family": "ip", "table": "t", "name": "s", "elem": {"set"
f1d1c0
 I add rule ip t c tcp dport @s
f1d1c0
 O -
f1d1c0
 J {"add": {"rule": {"family": "ip", "table": "t", "chain": "c", "handle": 0, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "tcp", "field": "dport"}}, "right": "@s"}}]}}}
f1d1c0
+
f1d1c0
+# test anonymous interval sets as well
f1d1c0
+I add rule ip t c tcp dport { 20, 30-40 }
f1d1c0
+O -
f1d1c0
+J {"add": {"rule": {"family": "ip", "table": "t", "chain": "c", "handle": 0, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "tcp", "field": "dport"}}, "right": {"set": [20, {"range": [30, 40]}]}}}]}}}
f1d1c0
-- 
f1d1c0
1.8.3.1
f1d1c0