netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only

[ Upstream commit 9d74da1177c800eb3d51c13f9821b7b0683845a5 ]

conncount has its own GC handler which determines when to reap stale
elements, this is convenient for dynamic sets. However, this also reaps
non-dynamic sets with static configurations coming from control plane.
Always run connlimit gc handler but honor feedback to reap element if
this set is dynamic.

Fixes: 290180e2448c ("netfilter: nf_tables: add connlimit support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
index 0370f69dce86dd8c544f60b8ce78c8ac31732204..2f1012bde1f34eb92293b3e8661d9d65e5b0118d 100644 (file)
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -308,7 +308,8 @@ static bool nft_rhash_expr_needs_gc_run(const struct nft_set *set,
 
        nft_setelem_expr_foreach(expr, elem_expr, size) {
                if (expr->ops->gc &&
-                   expr->ops->gc(read_pnet(&set->net), expr))
+                   expr->ops->gc(read_pnet(&set->net), expr) &&
+                   set->flags & NFT_SET_EVAL)
                        return true;
        }