summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2018-06-11 17:18:29 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2018-06-12 19:12:48 +0200
commit215a31f19dedd4e92a67cf5a9717ee898d012b3a (patch)
tree997446c43106f7d0bf1ddfdbad73a9bfa17f2371 /net
parent3fb61eca185cc65a1be23d9a5a11347eef79f597 (diff)
downloadlinux-stable-215a31f19dedd4e92a67cf5a9717ee898d012b3a.tar.gz
linux-stable-215a31f19dedd4e92a67cf5a9717ee898d012b3a.tar.bz2
linux-stable-215a31f19dedd4e92a67cf5a9717ee898d012b3a.zip
netfilter: nft_dynset: do not reject set updates with NFT_SET_EVAL
NFT_SET_EVAL is signalling the kernel that this sets can be updated from the evaluation path, even if there are no expressions attached to the element. Otherwise, set updates with no expressions fail. Update description to describe the right semantics. Fixes: 22fe54d5fefc ("netfilter: nf_tables: add support for dynamic set updates") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
-rw-r--r--net/netfilter/nft_dynset.c4
1 files changed, 1 insertions, 3 deletions
diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
index 4d49529cff61..27d7e4598ab6 100644
--- a/net/netfilter/nft_dynset.c
+++ b/net/netfilter/nft_dynset.c
@@ -203,9 +203,7 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
goto err1;
set->ops->gc_init(set);
}
-
- } else if (set->flags & NFT_SET_EVAL)
- return -EINVAL;
+ }
nft_set_ext_prepare(&priv->tmpl);
nft_set_ext_add_length(&priv->tmpl, NFT_SET_EXT_KEY, set->klen);