Commit ce537996 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nft_dynset: dump expressions when set definition contains no expressions 



If the set definition provides no stateful expressions, then include the
stateful expression in the ruleset listing. Without this fix, the dynset
rule listing shows the stateful expressions provided by the set
definition.

Fixes: 65038428 ("netfilter: nf_tables: allow to specify stateful expression in set definition")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 0c5b7a50

net/netfilter/nft_dynset.c

+17 −14
Original line number Diff line number Diff line
@@ -384,8 +384,10 @@ static int nft_dynset_dump(struct sk_buff *skb, const struct nft_expr *expr) 
			 nf_jiffies64_to_msecs(priv->timeout),

			 NFTA_DYNSET_PAD))

		goto nla_put_failure;

	if (priv->set->num_exprs == 0) {

		if (priv->num_exprs == 1) {

		if (nft_expr_dump(skb, NFTA_DYNSET_EXPR, priv->expr_array[0]))

			if (nft_expr_dump(skb, NFTA_DYNSET_EXPR,

					  priv->expr_array[0]))

				goto nla_put_failure;

		} else if (priv->num_exprs > 1) {

			struct nlattr *nest;
@@ -401,6 +403,7 @@ static int nft_dynset_dump(struct sk_buff *skb, const struct nft_expr *expr) 
			}

			nla_nest_end(skb, nest);

		}

	}

	if (nla_put_be32(skb, NFTA_DYNSET_FLAGS, htonl(flags)))

		goto nla_put_failure;

	return 0;