mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 12:52:29 -04:00
Code Issues Packages Projects Releases Wiki Activity

netfilter: nft_dynset: honor stateful expressions in set definition

Browse Source 
If the set definition contains stateful expressions, allocate them for
the newly added entries from the packet path.

Fixes: 65038428b2 ("netfilter: nf_tables: allow to specify stateful expression in set definition")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso
2021-01-16 12:26:46 +01:00
parent c8a8ead017
commit fca05d4d61
3 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
include/net/netfilter/nf_tables.h
View File

@@ -721,6 +721,8 @@ void *nft_set_elem_init(const struct nft_set *set,
const struct nft_set_ext_tmpl *tmpl, const struct nft_set_ext_tmpl *tmpl,
const u32 *key, const u32 *key_end, const u32 *data, const u32 *key, const u32 *key_end, const u32 *data,
u64 timeout, u64 expiration, gfp_t gfp); u64 timeout, u64 expiration, gfp_t gfp);
int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set,
struct nft_expr *expr_array[]);
void nft_set_elem_destroy(const struct nft_set *set, void *elem, void nft_set_elem_destroy(const struct nft_set *set, void *elem,
bool destroy_expr); bool destroy_expr);

5
net/netfilter/nf_tables_api.c
View File

@@ -5235,9 +5235,8 @@ static void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,
kfree(elem); kfree(elem);
} }
static int nft_set_elem_expr_clone(const struct nft_ctx *ctx, int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set,
struct nft_set *set, struct nft_expr *expr_array[])
struct nft_expr *expr_array[])
{ {
struct nft_expr *expr; struct nft_expr *expr;
int err, i, k; int err, i, k;

6
net/netfilter/nft_dynset.c
View File

@@ -295,6 +295,12 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
err = -EOPNOTSUPP; err = -EOPNOTSUPP;
goto err_expr_free; goto err_expr_free;
} }
} else if (set->num_exprs > 0) {
err = nft_set_elem_expr_clone(ctx, set, priv->expr_array);
if (err < 0)
return err;
priv->num_exprs = set->num_exprs;
} }
nft_set_ext_prepare(&priv->tmpl); nft_set_ext_prepare(&priv->tmpl);