mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-05 00:20:32 +00:00
netfilter: nft_dynset: continue to next expr if _OP_ADD succeeded
Currently, after adding the following nft rules:
# nft add set x target1 { type ipv4_addr \; flags timeout \;}
# nft add rule x y set add ip daddr timeout 1d @target1 counter
the counters will always be zero despite of the elements are added
to the dynamic set "target1" or not, as we will break the nft expr
traversal unconditionally:
# nft list ruleset
...
set target1 {
...
elements = { 8.8.8.8 expires 23h59m53s}
}
chain output {
...
set add ip daddr timeout 1d @target1 counter packets 0 bytes 0
^ ^
...
}
Since we add the elements to the set successfully, we should continue
to the next expression.
Additionally, if elements are added to "flow table" successfully, we
will _always_ continue to the next expr, even if the operation is
_OP_ADD. So it's better to keep them to be consistent.
Fixes: 22fe54d5fe
("netfilter: nf_tables: add support for dynamic set updates")
Reported-by: Robert White <rwhite@pobox.com>
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
cf3cb246e2
commit
277a292835
1 changed files with 2 additions and 3 deletions
|
@ -82,8 +82,7 @@ static void nft_dynset_eval(const struct nft_expr *expr,
|
|||
nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
|
||||
timeout = priv->timeout ? : set->timeout;
|
||||
*nft_set_ext_expiration(ext) = jiffies + timeout;
|
||||
} else if (sexpr == NULL)
|
||||
goto out;
|
||||
}
|
||||
|
||||
if (sexpr != NULL)
|
||||
sexpr->ops->eval(sexpr, regs, pkt);
|
||||
|
@ -92,7 +91,7 @@ static void nft_dynset_eval(const struct nft_expr *expr,
|
|||
regs->verdict.code = NFT_BREAK;
|
||||
return;
|
||||
}
|
||||
out:
|
||||
|
||||
if (!priv->invert)
|
||||
regs->verdict.code = NFT_BREAK;
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue