Otherwise kernel bails out with EINVAL in case that the sets got no
timeout flag.
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
---
src/netlink_linearize.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c
index 01a85d0..f4db685 100644
--- a/src/netlink_linearize.c
+++ b/src/netlink_linearize.c
@@ -1027,8 +1027,9 @@ static void netlink_gen_set_stmt(struct netlink_linearize_ctx *ctx,
nle = alloc_nft_expr("dynset");
netlink_put_register(nle, NFTNL_EXPR_DYNSET_SREG_KEY, sreg_key);
- nftnl_expr_set_u64(nle, NFTNL_EXPR_DYNSET_TIMEOUT,
- stmt->set.key->timeout);
+ if (stmt->set.key->timeout > 0)
+ nftnl_expr_set_u64(nle, NFTNL_EXPR_DYNSET_TIMEOUT,
+ stmt->set.key->timeout);
nftnl_expr_set_u32(nle, NFTNL_EXPR_DYNSET_OP, stmt->set.op);
nftnl_expr_set_str(nle, NFTNL_EXPR_DYNSET_SET_NAME, set->handle.set);
nftnl_expr_set_u32(nle, NFTNL_EXPR_DYNSET_SET_ID, set->handle.set_id);
--
2.1.4
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
