Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 46ba5a25 authored by Krishna Kumar's avatar Krishna Kumar Committed by Pablo Neira Ayuso
Browse files

netfilter: nfnetlink_queue: do not allow to set unsupported flag bits 



Allow setting of only supported flag bits in queue->flags.

Signed-off-by: default avatarKrishna Kumar <krkumar2@in.ibm.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 59560a38

include/linux/netfilter/nfnetlink_queue.h

+1 −0
Original line number Diff line number Diff line
@@ -95,5 +95,6 @@ enum nfqnl_attr_config { 
/* Flags for NFQA_CFG_FLAGS */

#define NFQA_CFG_F_FAIL_OPEN			(1 << 0)

#define NFQA_CFG_F_CONNTRACK			(1 << 1)

#define NFQA_CFG_F_MAX				(1 << 2)



#endif /* _NFNETLINK_QUEUE_H */

net/netfilter/nfnetlink_queue_core.c

+5 −0
Original line number Diff line number Diff line
@@ -910,6 +910,11 @@ nfqnl_recv_config(struct sock *ctnl, struct sk_buff *skb, 
		flags = ntohl(nla_get_be32(nfqa[NFQA_CFG_FLAGS]));

		mask = ntohl(nla_get_be32(nfqa[NFQA_CFG_MASK]));



		if (flags >= NFQA_CFG_F_MAX) {

			ret = -EOPNOTSUPP;

			goto err_out_unlock;

		}



		spin_lock_bh(&queue->lock);

		queue->flags &= ~mask;

		queue->flags |= flags & mask;