Bug 1795224

Upstream commits to backport:

commit 9b94127950f9848bc5a1505ae65ca3045ff68a16
Author: Stefano Brivio <sbrivio>
Date:   Thu Jan 30 01:16:55 2020 +0100

    include: resync nf_tables.h cache copy
    
    Get this header in sync with nf-next as of merge commit
    b3a608222336 (5.6-rc1-ish).
    
    Signed-off-by: Stefano Brivio <sbrivio>
    Signed-off-by: Pablo Neira Ayuso <pablo>

commit 6156ba34018dddd59cb6737cfd5a69a0cbc5eaa4
Author: Stefano Brivio <sbrivio>
Date:   Thu Jan 30 01:16:56 2020 +0100

    src: Add support for NFTNL_SET_DESC_CONCAT
    
    To support arbitrary range concatenations, the kernel needs to know
    how long each field in the concatenation is. The new libnftnl
    NFTNL_SET_DESC_CONCAT set attribute describes this as an array of
    lengths, in bytes, of concatenated fields.
    
    While evaluating concatenated expressions, export the datatype size
    into the new field_len array, and hand the data over via libnftnl.
    
    Similarly, when data is passed back from libnftnl, parse it into
    the set description.
    
    When set data is cloned, we now need to copy the additional fields
    in set_clone(), too.
    
    This change depends on the libnftnl patch with title:
      set: Add support for NFTA_SET_DESC_CONCAT attributes
    
    v4: No changes
    v3: Rework to use set description data instead of a stand-alone
        attribute
    v2: No changes
    
    Signed-off-by: Stefano Brivio <sbrivio>
    Signed-off-by: Pablo Neira Ayuso <pablo>

commit 8ac2f3b2fca38b6533043b0678730c10ba4dc5ef
Author: Stefano Brivio <sbrivio>
Date:   Thu Jan 30 01:16:57 2020 +0100

    src: Add support for concatenated set ranges
    
    After exporting field lengths via NFTNL_SET_DESC_CONCAT attributes,
    we now need to adjust parsing of user input and generation of
    netlink key data to complete support for concatenation of set
    ranges.
    
    Instead of using separate elements for start and end of a range,
    denoting the end element by the NFT_SET_ELEM_INTERVAL_END flag,
    as it's currently done for ranges without concatenation, we'll use
    the new attribute NFTNL_SET_ELEM_KEY_END as suggested by Pablo. It
    behaves in the same way as NFTNL_SET_ELEM_KEY, but it indicates
    that the included key represents the upper bound of a range.
    
    For example, "packets with an IPv4 address between 192.0.2.0 and
    192.0.2.42, with destination port between 22 and 25", needs to be
    expressed as a single element with two keys:
    
      NFTA_SET_ELEM_KEY:            192.0.2.0 . 22
      NFTA_SET_ELEM_KEY_END:        192.0.2.42 . 25
    
    To achieve this, we need to:
    
    - adjust the lexer rules to allow multiton expressions as elements
      of a concatenation. As wildcards are not allowed (semantics would
      be ambiguous), exclude wildcards expressions from the set of
      possible multiton expressions, and allow them directly where
      needed. Concatenations now admit prefixes and ranges
    
    - generate, for each element in a range concatenation, a second key
      attribute, that includes the upper bound for the range
    
    - also expand prefixes and non-ranged values in the concatenation
      to ranges: given a set with interval and concatenation support,
      the kernel has no way to tell which elements are ranged, so they
      all need to be. For example, 192.0.2.0 . 192.0.2.9 : 1024 is
      sent as:
    
      NFTA_SET_ELEM_KEY:            192.0.2.0 . 1024
      NFTA_SET_ELEM_KEY_END:        192.0.2.9 . 1024
    
    - aggregate ranges when elements received by the kernel represent
      concatenated ranges, see concat_range_aggregate()
    
    - perform a few minor adjustments where interval expressions
      are already handled: we have intervals in these sets, but
      the set specification isn't just an interval, so we can't
      just aggregate and deaggregate interval ranges linearly
    
    v4: No changes
    v3:
     - rework to use a separate key for closing element of range instead of
       a separate element with EXPR_F_INTERVAL_END set (Pablo Neira Ayuso)
    v2:
     - reworked netlink_gen_concat_data(), moved loop body to a new function,
       netlink_gen_concat_data_expr() (Phil Sutter)
     - dropped repeated pattern in bison file, replaced by a new helper,
       compound_expr_alloc_or_add() (Phil Sutter)
     - added set_is_nonconcat_range() helper (Phil Sutter)
     - in expr_evaluate_set(), we need to set NFT_SET_SUBKEY also on empty
       sets where the set in the context already has the flag
     - dropped additional 'end' parameter from netlink_gen_data(),
       temporarily set EXPR_F_INTERVAL_END on expressions and use that from
       netlink_gen_concat_data() to figure out we need to add the 'end'
       element (Phil Sutter)
     - replace range_mask_len() by a simplified version, as we don't need
       to actually store the composing masks of a range (Phil Sutter)
    
    Signed-off-by: Stefano Brivio <sbrivio>
    Signed-off-by: Pablo Neira Ayuso <pablo>

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2020:1774