Commit 99a0efbe authored Apr 16, 2018 by Florian Westphal Committed by Pablo Neira Ayuso Apr 24, 2018

netfilter: nf_tables: always use an upper set size for dynsets



nft rejects rules that lack a timeout and a size limit when they're used
to add elements from packet path.

Pick a sane upperlimit instead of rejecting outright.
The upperlimit is visible to userspace, just as if it would have been
given during set declaration.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent 8e1102d5

net/netfilter/nft_dynset.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -36,7 +36,7 @@ static void nft_dynset_new(struct nft_set set, const struct nft_expr *expr,
		u64 timeout;
		void *elem;

		if (set->size && !atomic_add_unless(&set->nelems, 1, set->size))
		if (!atomic_add_unless(&set->nelems, 1, set->size))
		return NULL;

		timeout = priv->timeout ? : set->timeout;
		@@ -216,6 +216,9 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
		if (err < 0)
		goto err1;

		if (set->size == 0)
		set->size = 0xffff;

		priv->set = set;
		return 0;