netfilter: nft_dynset: do not reject set updates with NFT_SET_EVAL

NFT_SET_EVAL is signalling the kernel that this sets can be updated from the evaluation path, even if there are no expressions attached to the element. Otherwise, set updates with no expressions fail. Update description to describe the right semantics.

Pablo Neira Ayuso committed 8 years ago

Commit 215a31f1 parent 3fb61ec2 files · +2 −4Browse files

Unified · Split

2 files

include/uapi/linux/netfilter/nf_tables.h +1 −1
net/netfilter/nft_dynset.c +1 −3

include/uapi/linux/netfilter/nf_tables.h+1−1

@@ -266,7 +266,7 @@ enum nft_rule_compat_attributes { · 265 unmodified lines
266	* @NFT_SET_INTERVAL: set contains intervals	266	* @NFT_SET_INTERVAL: set contains intervals
267	* @NFT_SET_MAP: set is used as a dictionary	267	* @NFT_SET_MAP: set is used as a dictionary
268	* @NFT_SET_TIMEOUT: set uses timeouts	268	* @NFT_SET_TIMEOUT: set uses timeouts
269	* @NFT_SET_EVAL: set contains expressions for evaluation	269	* @NFT_SET_EVAL: set can be updated from the evaluation path
270	* @NFT_SET_OBJECT: set contains stateful objects	270	* @NFT_SET_OBJECT: set contains stateful objects
271	*/	271	*/
272	enum nft_set_flags {	272	enum nft_set_flags {

net/netfilter/nft_dynset.c+1−3

@@ -203,9 +203,7 @@ static int nft_dynset_init(const struct nft_ctx *ctx, · 202 unmodified lines
203	goto err1;	203	goto err1;
204	set->ops->gc_init(set);	204	set->ops->gc_init(set);
205	}	205	}
206		206	}
207	} else if (set->flags & NFT_SET_EVAL)
208	return -EINVAL;
209		207
210	nft_set_ext_prepare(&priv->tmpl);	208	nft_set_ext_prepare(&priv->tmpl);
211	nft_set_ext_add_length(&priv->tmpl, NFT_SET_EXT_KEY, set->klen);	209	nft_set_ext_add_length(&priv->tmpl, NFT_SET_EXT_KEY, set->klen);