diff options
| author |   Liping Zhang <liping.zhang@spreadtrum.com> | 2016-09-22 22:28:52 +0800 |
|---|---|---|
| committer |   Pablo Neira Ayuso <pablo@netfilter.org> | 2016-09-25 14:54:04 +0200 |
| commit | 7bfdde7045ad54d9fdccac70baffd094d9de73f8 (patch) | |
| tree | 299515d8e6cfd77a65dba12479cf1337841c1a90 /net/netfilter | |
| parent | netfilter: nft_ct: unnecessary to require dir when use ct l3proto/protocol (diff) | |
| download | linux-dev-7bfdde7045ad54d9fdccac70baffd094d9de73f8.tar.xz linux-dev-7bfdde7045ad54d9fdccac70baffd094d9de73f8.zip | |
netfilter: nft_ct: report error if mark and dir specified simultaneously
NFT_CT_MARK is unrelated to direction, so if NFTA_CT_DIRECTION attr is
specified, report EINVAL to the userspace. This validation check was
already done at nft_ct_get_init, but we missed it in nft_ct_set_init.
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter')
| -rw-r--r-- | net/netfilter/nft_ct.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c index 825fbbc62f48..d7b0d171172a 100644 --- a/net/netfilter/nft_ct.c +++ b/net/netfilter/nft_ct.c @@ -364,6 +364,8 @@ static int nft_ct_set_init(const struct nft_ctx *ctx, switch (priv->key) { #ifdef CONFIG_NF_CONNTRACK_MARK case NFT_CT_MARK: + if (tb[NFTA_CT_DIRECTION]) + return -EINVAL; len = FIELD_SIZEOF(struct nf_conn, mark); break; #endif |