diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-07-05 17:45:36 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-07-06 14:15:13 +0200 |
| commit | 6ac4bac4ce48604cf0f4b04d61884552520ca55e (patch) | |
| tree | c45d8fcb935d8c9338ed3946dfc258941051f471 /net/netfilter/nft_last.c | |
| parent | cf4466ea47db891be785f867ca7f99e0cd9898c6 (diff) | |
netfilter: nft_last: honor NFTA_LAST_SET on restoration
NFTA_LAST_SET tells us if this expression has ever seen a packet, do not
ignore this attribute when restoring the ruleset.
Fixes: 836382dc2471 ("netfilter: nf_tables: add last expression")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/nft_last.c')
| -rw-r--r-- | net/netfilter/nft_last.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/net/netfilter/nft_last.c b/net/netfilter/nft_last.c index 913ac45167f2..bbb352b64c73 100644 --- a/net/netfilter/nft_last.c +++ b/net/netfilter/nft_last.c @@ -23,15 +23,21 @@ static int nft_last_init(const struct nft_ctx *ctx, const struct nft_expr *expr, { struct nft_last_priv *priv = nft_expr_priv(expr); u64 last_jiffies; + u32 last_set = 0; int err; - if (tb[NFTA_LAST_MSECS]) { + if (tb[NFTA_LAST_SET]) { + last_set = ntohl(nla_get_be32(tb[NFTA_LAST_SET])); + if (last_set == 1) + priv->last_set = 1; + } + + if (last_set && tb[NFTA_LAST_MSECS]) { err = nf_msecs_to_jiffies64(tb[NFTA_LAST_MSECS], &last_jiffies); if (err < 0) return err; priv->last_jiffies = jiffies + (unsigned long)last_jiffies; - priv->last_set = 1; } return 0; |