Commit 277a2928 authored by Liping Zhang's avatar Liping Zhang Committed by Pablo Neira Ayuso

netfilter: nft_dynset: continue to next expr if _OP_ADD succeeded

Currently, after adding the following nft rules:
  # nft add set x target1 { type ipv4_addr \; flags timeout \;}
  # nft add rule x y set add ip daddr timeout 1d @target1 counter

the counters will always be zero despite of the elements are added
to the dynamic set "target1" or not, as we will break the nft expr
traversal unconditionally:
  # nft list ruleset
  ...
  set target1 {
      ...
      elements = { 8.8.8.8 expires 23h59m53s}
  }
  chain output {
      ...
      set add ip daddr timeout 1d @target1 counter packets 0 bytes 0
                                                           ^       ^
      ...
  }

Since we add the elements to the set successfully, we should continue
to the next expression.

Additionally, if elements are added to "flow table" successfully, we
will _always_ continue to the next expr, even if the operation is
_OP_ADD. So it's better to keep them to be consistent.

Fixes: 22fe54d5 ("netfilter: nf_tables: add support for dynamic set updates")
Reported-by: default avatarRobert White <rwhite@pobox.com>
Signed-off-by: default avatarLiping Zhang <zlpnobody@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent cf3cb246
...@@ -82,8 +82,7 @@ static void nft_dynset_eval(const struct nft_expr *expr, ...@@ -82,8 +82,7 @@ static void nft_dynset_eval(const struct nft_expr *expr,
nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) { nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
timeout = priv->timeout ? : set->timeout; timeout = priv->timeout ? : set->timeout;
*nft_set_ext_expiration(ext) = jiffies + timeout; *nft_set_ext_expiration(ext) = jiffies + timeout;
} else if (sexpr == NULL) }
goto out;
if (sexpr != NULL) if (sexpr != NULL)
sexpr->ops->eval(sexpr, regs, pkt); sexpr->ops->eval(sexpr, regs, pkt);
...@@ -92,7 +91,7 @@ static void nft_dynset_eval(const struct nft_expr *expr, ...@@ -92,7 +91,7 @@ static void nft_dynset_eval(const struct nft_expr *expr,
regs->verdict.code = NFT_BREAK; regs->verdict.code = NFT_BREAK;
return; return;
} }
out:
if (!priv->invert) if (!priv->invert)
regs->verdict.code = NFT_BREAK; regs->verdict.code = NFT_BREAK;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment