[Bug 1718] The nft(8) manual does not explain how sets are sized

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1718

--- Comment #1 from Pablo Neira Ayuso <pablo at netfilter.org> ---
Currently, size is set to 65535 if the set is dynamic AND it is used by the
ruleset.

I have a kernel patch here that I plan to test and then submit:

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 29c651804cb2..49c068d9b209 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4998,6 +4998,9 @@ static int nf_tables_newset(struct sk_buff *skb, const
struct nfnl_info *info,
                return -EINVAL;
        }

+       if (flags & NFT_SET_EVAL && !desc.size)
+               desc.size = 0xffff;
+
        if (nla[NFTA_SET_EXPR] || nla[NFTA_SET_EXPRESSIONS])
                desc.expr = true;

This sets on the cap earlier, by the time the dynamic set is created.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20231025/ea885319/attachment.html>