diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2024-03-01 00:11:10 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-04-13 12:50:08 +0200 |
| commit | e4988d8415bd0294d6f9f4a1e7095f8b50a97ca9 (patch) | |
| tree | 5d52f7d9a26ae797a4e076e5ce35c36c9112cf53 | |
| parent | 4b6e87971dbea7d9231f670281723003f90429b2 (diff) | |
| download | linux-stable-e4988d8415bd0294d6f9f4a1e7095f8b50a97ca9.tar.gz linux-stable-e4988d8415bd0294d6f9f4a1e7095f8b50a97ca9.tar.bz2 linux-stable-e4988d8415bd0294d6f9f4a1e7095f8b50a97ca9.zip | |
netfilter: nf_tables: disallow anonymous set with timeout flag
commit 16603605b667b70da974bea8216c93e7db043bf1 upstream.
Anonymous sets are never used with timeout from userspace, reject this.
Exception to this rule is NFT_SET_EVAL to ensure legacy meters still work.
Cc: stable@vger.kernel.org
Fixes: 761da2935d6e ("netfilter: nf_tables: add set timeout API support")
Reported-by: lonial con <kongln9170@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | net/netfilter/nf_tables_api.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 94f1104b0487..44cfc8c3ff00 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -3560,6 +3560,9 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) == (NFT_SET_EVAL | NFT_SET_OBJECT)) return -EOPNOTSUPP; + if ((flags & (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT | NFT_SET_EVAL)) == + (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT)) + return -EOPNOTSUPP; } dtype = 0; |