netfilter: nft_dynset: do not reject set updates with NFT_SET_EVAL

NFT_SET_EVAL is signalling the kernel that this sets can be updated from the evaluation path, even if there are no expressions attached to the element. Otherwise, set updates with no expressions fail. Update description to describe the right semantics.

Pablo Neira Ayuso committed 8 years ago

Commit 215a31f1 parent 3fb61ec2 files · +2 −4Browse files

Unified · Split

2 files

include/uapi/linux/netfilter/nf_tables.h +1 −1
net/netfilter/nft_dynset.c +1 −3

include/uapi/linux/netfilter/nf_tables.h+1−1

@@ -266,7 +266,7 @@ enum nft_rule_compat_attributes { · 265 unmodified lines
266	266	* @NFT_SET_INTERVAL: set contains intervals
267	267	* @NFT_SET_MAP: set is used as a dictionary
268	268	* @NFT_SET_TIMEOUT: set uses timeouts
269		− * @NFT_SET_EVAL: set contains expressions for evaluation
	269	+ * @NFT_SET_EVAL: set can be updated from the evaluation path
270	270	* @NFT_SET_OBJECT: set contains stateful objects
271	271	*/
272	272	enum nft_set_flags {

net/netfilter/nft_dynset.c+1−3

@@ -203,9 +203,7 @@ static int nft_dynset_init(const struct nft_ctx *ctx, · 202 unmodified lines
203	203	goto err1;
204	204	set->ops->gc_init(set);
205	205	}
206		−
207		− } else if (set->flags & NFT_SET_EVAL)
208		− return -EINVAL;
	206	+ }
209	207
210	208	nft_set_ext_prepare(&priv->tmpl);
211	209	nft_set_ext_add_length(&priv->tmpl, NFT_SET_EXT_KEY, set->klen);