diff options
| author |   Florian Westphal <fw@strlen.de> | 2018-04-16 18:52:58 +0200 |
|---|---|---|
| committer |   Pablo Neira Ayuso <pablo@netfilter.org> | 2018-04-24 10:29:21 +0200 |
| commit | 99a0efbeeb83482893f7d5df343a2d2eb591933d (patch) | |
| tree | f7235e3c30479ff5c7ad69f75880521e43089f82 /net/netfilter/nft_dynset.c | |
| parent | netfilter: nf_tables: support timeouts larger than 23 days (diff) | |
| download | linux-dev-99a0efbeeb83482893f7d5df343a2d2eb591933d.tar.xz linux-dev-99a0efbeeb83482893f7d5df343a2d2eb591933d.zip | |
netfilter: nf_tables: always use an upper set size for dynsets
nft rejects rules that lack a timeout and a size limit when they're used
to add elements from packet path.
Pick a sane upperlimit instead of rejecting outright.
The upperlimit is visible to userspace, just as if it would have been
given during set declaration.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/nft_dynset.c')
| -rw-r--r-- | net/netfilter/nft_dynset.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c index 04863fad05dd..5cc3509659c6 100644 --- a/net/netfilter/nft_dynset.c +++ b/net/netfilter/nft_dynset.c @@ -36,7 +36,7 @@ static void *nft_dynset_new(struct nft_set *set, const struct nft_expr *expr, u64 timeout; void *elem; - if (set->size && !atomic_add_unless(&set->nelems, 1, set->size)) + if (!atomic_add_unless(&set->nelems, 1, set->size)) return NULL; timeout = priv->timeout ? : set->timeout; @@ -216,6 +216,9 @@ static int nft_dynset_init(const struct nft_ctx *ctx, if (err < 0) goto err1; + if (set->size == 0) + set->size = 0xffff; + priv->set = set; return 0; |