michael/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only

Browse Source 
[ Upstream commit 9d74da1177 ]

conncount has its own GC handler which determines when to reap stale
elements, this is convenient for dynamic sets. However, this also reaps
non-dynamic sets with static configurations coming from control plane.
Always run connlimit gc handler but honor feedback to reap element if
this set is dynamic.

Fixes: 290180e244 ("netfilter: nf_tables: add connlimit support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Pablo Neira Ayuso
2025-03-21 23:24:20 +01:00
committed by Greg Kroah-Hartman
parent 018e6cf250
commit b87f19c495
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
net/netfilter/nft_set_hash.c
View File

@@ -310,7 +310,8 @@ static bool nft_rhash_expr_needs_gc_run(const struct nft_set *set,
nft_setelem_expr_foreach(expr, elem_expr, size) {
if (expr->ops->gc &&
expr->ops->gc(read_pnet(&set->net), expr))
expr->ops->gc(read_pnet(&set->net), expr) &&
set->flags & NFT_SET_EVAL)
return true;
}