korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-23 20:24:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

netfilter: nft_dynset: dump expressions when set definition contains no expressions

Browse Source 
If the set definition provides no stateful expressions, then include the
stateful expression in the ruleset listing. Without this fix, the dynset
rule listing shows the stateful expressions provided by the set
definition.

Fixes: 65038428b2 ("netfilter: nf_tables: allow to specify stateful expression in set definition")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso 2021-01-16 19:50:34 +01:00
parent 0c5b7a501e
commit ce5379963b
1 changed files with 17 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
net/netfilter/nft_dynset.c
View File

@ -384,8 +384,10 @@ static int nft_dynset_dump(struct sk_buff *skb, const struct nft_expr *expr)
nf_jiffies64_to_msecs(priv->timeout),
NFTA_DYNSET_PAD))
goto nla_put_failure;
if (priv->set->num_exprs == 0) {
if (priv->num_exprs == 1) {
if (nft_expr_dump(skb, NFTA_DYNSET_EXPR, priv->expr_array[0]))
if (nft_expr_dump(skb, NFTA_DYNSET_EXPR,
priv->expr_array[0]))
goto nla_put_failure;
} else if (priv->num_exprs > 1) {
struct nlattr *nest;
@ -401,6 +403,7 @@ static int nft_dynset_dump(struct sk_buff *skb, const struct nft_expr *expr)
}
nla_nest_end(skb, nest);
}
}
if (nla_put_be32(skb, NFTA_DYNSET_FLAGS, htonl(flags)))
goto nla_put_failure;
return 0;