aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorLiping Zhang2017-04-23 05:29:30 -0500
committerPablo Neira Ayuso2017-04-25 04:10:37 -0500
commit277a292835c196894ef895d5e1fd6170bb916f55 (patch)
tree20f742f20a4ffc9a8e1e7a524e58f4cd2bb8d635 /net
parentcf3cb246e277d98987aa8d62ef2730dbee2f5fa7 (diff)
downloadkernel-277a292835c196894ef895d5e1fd6170bb916f55.tar.gz
kernel-277a292835c196894ef895d5e1fd6170bb916f55.tar.xz
kernel-277a292835c196894ef895d5e1fd6170bb916f55.zip
netfilter: nft_dynset: continue to next expr if _OP_ADD succeeded
Currently, after adding the following nft rules: # nft add set x target1 { type ipv4_addr \; flags timeout \;} # nft add rule x y set add ip daddr timeout 1d @target1 counter the counters will always be zero despite of the elements are added to the dynamic set "target1" or not, as we will break the nft expr traversal unconditionally: # nft list ruleset ... set target1 { ... elements = { 8.8.8.8 expires 23h59m53s} } chain output { ... set add ip daddr timeout 1d @target1 counter packets 0 bytes 0 ^ ^ ... } Since we add the elements to the set successfully, we should continue to the next expression. Additionally, if elements are added to "flow table" successfully, we will _always_ continue to the next expr, even if the operation is _OP_ADD. So it's better to keep them to be consistent. Fixes: 22fe54d5fefc ("netfilter: nf_tables: add support for dynamic set updates") Reported-by: Robert White <rwhite@pobox.com> Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
-rw-r--r--net/netfilter/nft_dynset.c5
1 files changed, 2 insertions, 3 deletions
diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
index 049ad2d9ee66..fafbeea3ed04 100644
--- a/net/netfilter/nft_dynset.c
+++ b/net/netfilter/nft_dynset.c
@@ -82,8 +82,7 @@ static void nft_dynset_eval(const struct nft_expr *expr,
82 nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) { 82 nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
83 timeout = priv->timeout ? : set->timeout; 83 timeout = priv->timeout ? : set->timeout;
84 *nft_set_ext_expiration(ext) = jiffies + timeout; 84 *nft_set_ext_expiration(ext) = jiffies + timeout;
85 } else if (sexpr == NULL) 85 }
86 goto out;
87 86
88 if (sexpr != NULL) 87 if (sexpr != NULL)
89 sexpr->ops->eval(sexpr, regs, pkt); 88 sexpr->ops->eval(sexpr, regs, pkt);
@@ -92,7 +91,7 @@ static void nft_dynset_eval(const struct nft_expr *expr,
92 regs->verdict.code = NFT_BREAK; 91 regs->verdict.code = NFT_BREAK;
93 return; 92 return;
94 } 93 }
95out: 94
96 if (!priv->invert) 95 if (!priv->invert)
97 regs->verdict.code = NFT_BREAK; 96 regs->verdict.code = NFT_BREAK;
98} 97}