diff options
| author |   Pablo Neira Ayuso <pablo@netfilter.org> | 2022-08-13 15:22:05 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2022-08-15 17:54:59 +0200 |
| commit | fc0ae524b5fd2938c94d56da3f749f11eb3273d5 (patch) | |
| tree | ae0fc22dee36a1f023e375823e928d8009518a0a /net | |
| parent | netfilter: nf_tables: NFTA_SET_ELEM_KEY_END requires concat and interval flags (diff) | |
| download | linux-dev-fc0ae524b5fd2938c94d56da3f749f11eb3273d5.tar.xz linux-dev-fc0ae524b5fd2938c94d56da3f749f11eb3273d5.zip | |
netfilter: nf_tables: disallow NFT_SET_ELEM_CATCHALL and NFT_SET_ELEM_INTERVAL_END
These flags are mutually exclusive, report EINVAL in this case.
Fixes: aaa31047a6d2 ("netfilter: nftables: add catch-all set element support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/nf_tables_api.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 1d14d694f654..b1b12e083abb 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -5198,6 +5198,9 @@ static int nft_setelem_parse_flags(const struct nft_set *set, if (!(set->flags & NFT_SET_INTERVAL) && *flags & NFT_SET_ELEM_INTERVAL_END) return -EINVAL; + if ((*flags & (NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL)) == + (NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL)) + return -EINVAL; return 0; } |