diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2019-12-05 19:07:16 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2019-12-09 13:56:11 +0100 |
| commit | fbae632804554aa39abb8f76fbca5935cdd7e620 (patch) | |
| tree | c161a16410b51ea04c49ceee1562f71a0091f4b7 /src/netlink.c | |
| parent | 940b93a5c63d16ee21b5879f530876941ba04759 (diff) | |
segtree: don't remove nul-root element from interval set
Check from the delinearize set element path if the nul-root element
already exists in the interval set. Hence, the element insertion path
skips the implicit nul-root interval insertion.
Under some circunstances, nft bogusly fails to delete the last element
of the interval set and to create an element in an existing empty
internal set. This patch includes a test that reproduces the issue.
Fixes: 4935a0d561b5 ("segtree: special handling for the first non-matching segment")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/netlink.c')
| -rw-r--r-- | src/netlink.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/src/netlink.c b/src/netlink.c index 486e1247..9fc0b171 100644 --- a/src/netlink.c +++ b/src/netlink.c @@ -790,7 +790,7 @@ static void set_elem_parse_udata(struct nftnl_set_elem *nlse, } int netlink_delinearize_setelem(struct nftnl_set_elem *nlse, - const struct set *set, struct nft_cache *cache) + struct set *set, struct nft_cache *cache) { struct nft_data_delinearize nld; struct expr *expr, *key, *data; @@ -828,8 +828,11 @@ int netlink_delinearize_setelem(struct nftnl_set_elem *nlse, nle = nftnl_set_elem_get(nlse, NFTNL_SET_ELEM_EXPR, NULL); expr->stmt = netlink_parse_set_expr(set, cache, nle); } - if (flags & NFT_SET_ELEM_INTERVAL_END) + if (flags & NFT_SET_ELEM_INTERVAL_END) { expr->flags |= EXPR_F_INTERVAL_END; + if (mpz_cmp_ui(set->key->value, 0) == 0) + set->root = true; + } if (set_is_datamap(set->flags)) { if (nftnl_set_elem_is_set(nlse, NFTNL_SET_ELEM_DATA)) { |