Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 116b0e8e authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by Greg Kroah-Hartman
Browse files

netfilter: nf_tables: disallow timeout for anonymous sets 



commit e26d3009efda338f19016df4175f354a9bd0a4ab upstream.

Never used from userspace, disallow these parameters.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
[Keerthana: code surrounding the patch is different
because nft_set_desc is not present in v4.19-v5.10]
Signed-off-by: default avatarKeerthana K <keerthana.kalyanasundaram@broadcom.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 466488b1

net/netfilter/nf_tables_api.c

+7 −0
Original line number Diff line number Diff line
@@ -3607,6 +3607,9 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, 
		if (!(flags & NFT_SET_TIMEOUT))

			return -EINVAL;



		if (flags & NFT_SET_ANONYMOUS)

			return -EOPNOTSUPP;



		err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &timeout);

		if (err)

			return err;
@@ -3615,6 +3618,10 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, 
	if (nla[NFTA_SET_GC_INTERVAL] != NULL) {

		if (!(flags & NFT_SET_TIMEOUT))

			return -EINVAL;



		if (flags & NFT_SET_ANONYMOUS)

			return -EOPNOTSUPP;



		gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));

	}