diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2025-03-21 23:24:20 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-04-10 14:33:40 +0200 |
| commit | 3f620f0a29382b63f8fc248253b6e415ae740b8e (patch) | |
| tree | 65e0229dd692b62ecac771e79b4b6f5fd7bfffec /net/netfilter | |
| parent | 38253922a89a742e7e622f626b41c64388367361 (diff) | |
| download | linux-3f620f0a29382b63f8fc248253b6e415ae740b8e.tar.gz linux-3f620f0a29382b63f8fc248253b6e415ae740b8e.tar.bz2 linux-3f620f0a29382b63f8fc248253b6e415ae740b8e.zip | |
netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only
[ Upstream commit 9d74da1177c800eb3d51c13f9821b7b0683845a5 ]
conncount has its own GC handler which determines when to reap stale
elements, this is convenient for dynamic sets. However, this also reaps
non-dynamic sets with static configurations coming from control plane.
Always run connlimit gc handler but honor feedback to reap element if
this set is dynamic.
Fixes: 290180e2448c ("netfilter: nf_tables: add connlimit support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net/netfilter')
| -rw-r--r-- | net/netfilter/nft_set_hash.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c index 5c4209b49bda..a592cca7a61f 100644 --- a/net/netfilter/nft_set_hash.c +++ b/net/netfilter/nft_set_hash.c @@ -310,7 +310,8 @@ static bool nft_rhash_expr_needs_gc_run(const struct nft_set *set, nft_setelem_expr_foreach(expr, elem_expr, size) { if (expr->ops->gc && - expr->ops->gc(read_pnet(&set->net), expr)) + expr->ops->gc(read_pnet(&set->net), expr) && + set->flags & NFT_SET_EVAL) return true; } |