netfilter: nf_tables: support for set flushing

This patch adds support for set flushing, that consists of walking over
the set elements if the NFTA_SET_ELEM_LIST_ELEMENTS attribute is set.
This patch requires the following changes:

1) Add set->ops->deactivate_one() operation: This allows us to
   deactivate an element from the set element walk path, given we can
   skip the lookup that happens in ->deactivate().

2) Add a new nft_trans_alloc_gfp() function since we need to allocate
   transactions using GFP_ATOMIC given the set walk path happens with
   held rcu_read_lock.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 5 insertions, 1 deletions

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 85f0f03f1e87..924325c46aab 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -259,7 +259,8 @@ struct nft_expr;
  *      @lookup: look up an element within the set
  *      @insert: insert new element into set
  *      @activate: activate new element in the next generation
- *      @deactivate: deactivate element in the next generation
+ *      @deactivate: lookup for element and deactivate it in the next generation
+ *      @deactivate_one: deactivate element in the next generation
  *      @remove: remove element from set
  *      @walk: iterate over all set elemeennts
  *      @privsize: function to return size of set private data
@@ -294,6 +295,9 @@ struct nft_set_ops {
         void *                          (*deactivate)(const struct net *net,
                                                       const struct nft_set *set,
                                                       const struct nft_set_elem *elem);
+        bool                            (*deactivate_one)(const struct net *net,
+                                                          const struct nft_set *set,
+                                                          void *priv);
         void                            (*remove)(const struct nft_set *set,
                                                   const struct nft_set_elem *elem);
         void                            (*walk)(const struct nft_ctx *ctx,