Re: [PATCH nf] netfilter: nft_dynset: continue to next expr if _OP_ADD succeeded

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Sun, Apr 23, 2017 at 06:29:30PM +0800, Liping Zhang wrote:
> From: Liping Zhang <zlpnobody@gmail.com>
> 
> Currently, after adding the following nft rules:
>   # nft add set x target1 { type ipv4_addr \; flags timeout \;}
>   # nft add rule x y set add ip daddr timeout 1d @target1 counter
> 
> the counters will always be zero despite of the elements are added
> to the dynamic set "target1" or not, as we will break the nft expr
> traversal unconditionally:
>   # nft list ruleset
>   ...
>   set target1 {
>       ...
>       elements = { 8.8.8.8 expires 23h59m53s}
>   }
>   chain output {
>       ...
>       set add ip daddr timeout 1d @target1 counter packets 0 bytes 0
>                                                            ^       ^
>       ...
>   }
> 
> Since we add the elements to the set successfully, we should continue
> to the next expression.
> 
> Additionally, if elements are added to "flow table" successfully, we
> will _always_ continue to the next expr, even if the operation is
> _OP_ADD. So it's better to keep them to be consistent.

Applied, thanks.