From: Patrick McHardy <kaber@trash.net>
Date: Sun, 5 Apr 2015 12:41:05 +0000 (+0200)
Subject: netfilter: nf_tables: fix set selection when timeouts are requested
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=4a8678efbec6b0ea46baafb77cd297e6e02da933;p=linux-beck.git

netfilter: nf_tables: fix set selection when timeouts are requested

The NFT_SET_TIMEOUT flag is ignore in nft_select_set_ops, which may
lead to selection of a set implementation that doesn't actually
support timeouts.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 3aa92b3f85fd..0dab872e821b 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2159,7 +2159,7 @@ nft_select_set_ops(const struct nlattr * const nla[],
 	features = 0;
 	if (nla[NFTA_SET_FLAGS] != NULL) {
 		features = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
-		features &= NFT_SET_INTERVAL | NFT_SET_MAP;
+		features &= NFT_SET_INTERVAL | NFT_SET_MAP | NFT_SET_TIMEOUT;
 	}
 
 	bops	   = NULL;