Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 215a31f1 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nft_dynset: do not reject set updates with NFT_SET_EVAL 



NFT_SET_EVAL is signalling the kernel that this sets can be updated from
the evaluation path, even if there are no expressions attached to the
element. Otherwise, set updates with no expressions fail. Update
description to describe the right semantics.

Fixes: 22fe54d5 ("netfilter: nf_tables: add support for dynamic set updates")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 3fb61eca

include/uapi/linux/netfilter/nf_tables.h

+1 −1
Original line number Diff line number Diff line
@@ -266,7 +266,7 @@ enum nft_rule_compat_attributes { 
 * @NFT_SET_INTERVAL: set contains intervals

 * @NFT_SET_MAP: set is used as a dictionary

 * @NFT_SET_TIMEOUT: set uses timeouts

 * @NFT_SET_EVAL: set contains expressions for evaluation

 * @NFT_SET_EVAL: set can be updated from the evaluation path

 * @NFT_SET_OBJECT: set contains stateful objects

 */

enum nft_set_flags {

net/netfilter/nft_dynset.c

+1 −3
Original line number Diff line number Diff line
@@ -203,9 +203,7 @@ static int nft_dynset_init(const struct nft_ctx *ctx, 
				goto err1;

			set->ops->gc_init(set);

		}



	} else if (set->flags & NFT_SET_EVAL)

		return -EINVAL;

	}



	nft_set_ext_prepare(&priv->tmpl);

	nft_set_ext_add_length(&priv->tmpl, NFT_SET_EXT_KEY, set->klen);