diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2022-08-15 18:55:07 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-08-25 12:38:06 +0300 |
| commit | 3561f4d12fb92a5749a2f0f87706e3bc1fc55e68 (patch) | |
| tree | 5f6cbbf367cd8325e86bc632a3c01db4c08b498e /net/netfilter | |
| parent | 01b0cae6b74f28259a8ee444a9a9106531054a93 (diff) | |
| download | linux-3561f4d12fb92a5749a2f0f87706e3bc1fc55e68.tar.xz | |
netfilter: nf_tables: check NFT_SET_CONCAT flag if field_count is specified
commit 1b6345d4160ecd3d04bd8cd75df90c67811e8cc9 upstream.
Since f3a2181e16f1 ("netfilter: nf_tables: Support for sets with
multiple ranged fields"), it possible to combine intervals and
concatenations. Later on, ef516e8625dd ("netfilter: nf_tables:
reintroduce the NFT_SET_CONCAT flag") provides the NFT_SET_CONCAT flag
for userspace to report that the set stores a concatenation.
Make sure NFT_SET_CONCAT is set on if field_count is specified for
consistency. Otherwise, if NFT_SET_CONCAT is specified with no
field_count, bail out with EINVAL.
Fixes: ef516e8625dd ("netfilter: nf_tables: reintroduce the NFT_SET_CONCAT flag")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/netfilter')
| -rw-r--r-- | net/netfilter/nf_tables_api.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index c12bc3a2079b..990a0274e555 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -4241,6 +4241,11 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, err = nf_tables_set_desc_parse(&desc, nla[NFTA_SET_DESC]); if (err < 0) return err; + + if (desc.field_count > 1 && !(flags & NFT_SET_CONCAT)) + return -EINVAL; + } else if (flags & NFT_SET_CONCAT) { + return -EINVAL; } if (nla[NFTA_SET_EXPR]) |