Re: What is 'dynamic' set flag supposed to mean?

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Sep 19, 2019 at 12:03:29PM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > > I can't remove the if () because that would make it possible to lookup
> > > for meter-type sets.
> > 
> > Why is this a problem?
> 
> I was worried about this exposing expr pointers in the nft registers but
> that won't happen (lookup expr doesn't care, only dynset will check for
> attached expression coming from set).

See reply at the bottom of this email regarding ignoring the attached
expression.

> I will send a patch to zap this check.
> However, that still is a problem because that means "dynamic" can't
> be used in kernels < 5.4 .

I think this qualifies as a fix, it will be a two-liner, we could
send it to -stable?

> > I think we can just check instead from nft_lookup if there is an
> > extension in this then, instead of checking for the NFT_SET_EVAL flag
> > to fix this. Hence, you can make lookups on dynamic sets, but not on
> > dynamic sets with extensions.
> 
> What do you mean?

I was thinking about the counter per set element case, this is
something we don't support and IIRC ipset does. After this fix, we can
probably make a patch to check if the NFT_SET_EXT_EXPR exists, so we
can add counter per element matching a lookup. We also need a way to
say that this set has an expression counter when definiting the set.
At some point we might need to support for stateful objects per set
element too so users can also dump-and-reset an specific element
counter.