| Message ID | 20240301004609.10237-1-pablo@netfilter.org |
|---|---|
| State | Changes Requested |
| Headers | show |
| Series | [nf,1/2] netfilter: nf_tables: disallow anonymous set with NFT_SET_{TIMEOUT,EVAL} flags | expand |
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 7e938c7397dd..70f90e7d108c 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -5001,6 +5001,9 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info, if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) == (NFT_SET_EVAL | NFT_SET_OBJECT)) return -EOPNOTSUPP; + if ((flags & NFT_SET_ANONYMOUS) && + (flags & (NFT_SET_TIMEOUT | NFT_SET_EVAL))) + return -EOPNOTSUPP; } desc.dtype = 0;
Anonymous sets cannot be used neither with timeout nor with the dynamic flag to be populated from packet path. Reject these combinations. Fixes: 761da2935d6e ("netfilter: nf_tables: add set timeout API support") Reported-by: lonial con <kongln9170@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+)