netfilter: nft_dynset: relax superfluous check on set updates

Relax this condition to make add and update commands idempotent for sets
with no timeout. The eval function already checks if the set element
timeout is available and updates it if the update command is used.

Fixes: 22fe54d5fefc ("netfilter: nf_tables: add support for dynamic set updates")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
index 6ba3256fa844989461b28af793e7465a40353f17..87f3af4645d9c75697b95adc7ad0a2c2fd01d593 100644 (file)
--- a/net/netfilter/nft_dynset.c
+++ b/net/netfilter/nft_dynset.c
@@ -198,17 +198,8 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
                return -EBUSY;
 
        priv->op = ntohl(nla_get_be32(tb[NFTA_DYNSET_OP]));
-       switch (priv->op) {
-       case NFT_DYNSET_OP_ADD:
-       case NFT_DYNSET_OP_DELETE:
-               break;
-       case NFT_DYNSET_OP_UPDATE:
-               if (!(set->flags & NFT_SET_TIMEOUT))
-                       return -EOPNOTSUPP;
-               break;
-       default:
+       if (priv->op > NFT_DYNSET_OP_DELETE)
                return -EOPNOTSUPP;
-       }
 
        timeout = 0;
        if (tb[NFTA_DYNSET_TIMEOUT] != NULL) {