diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2018-06-11 17:18:29 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2018-06-12 19:12:48 +0200 |
| commit | 215a31f19dedd4e92a67cf5a9717ee898d012b3a (patch) | |
| tree | 997446c43106f7d0bf1ddfdbad73a9bfa17f2371 /net | |
| parent | netfilter: nft_socket: fix module autoload (diff) | |
| download | linux-215a31f19dedd4e92a67cf5a9717ee898d012b3a.tar.xz linux-215a31f19dedd4e92a67cf5a9717ee898d012b3a.zip | |
netfilter: nft_dynset: do not reject set updates with NFT_SET_EVAL
NFT_SET_EVAL is signalling the kernel that this sets can be updated from
the evaluation path, even if there are no expressions attached to the
element. Otherwise, set updates with no expressions fail. Update
description to describe the right semantics.
Fixes: 22fe54d5fefc ("netfilter: nf_tables: add support for dynamic set updates")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/nft_dynset.c | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c index 4d49529cff61..27d7e4598ab6 100644 --- a/net/netfilter/nft_dynset.c +++ b/net/netfilter/nft_dynset.c @@ -203,9 +203,7 @@ static int nft_dynset_init(const struct nft_ctx *ctx, goto err1; set->ops->gc_init(set); } - - } else if (set->flags & NFT_SET_EVAL) - return -EINVAL; + } nft_set_ext_prepare(&priv->tmpl); nft_set_ext_add_length(&priv->tmpl, NFT_SET_EXT_KEY, set->klen); |