| Message ID | 20240307021545.149386-2-pablo@netfilter.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 16603605b667b70da974bea8216c93e7db043bf1 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net,1/5] netfilter: nf_tables: disallow anonymous set with timeout flag | expand |
Hello: This series was applied to netdev/net.git (main) by Pablo Neira Ayuso <pablo@netfilter.org>: On Thu, 7 Mar 2024 03:15:41 +0100 you wrote: > Anonymous sets are never used with timeout from userspace, reject this. > Exception to this rule is NFT_SET_EVAL to ensure legacy meters still work. > > Cc: stable@vger.kernel.org > Fixes: 761da2935d6e ("netfilter: nf_tables: add set timeout API support") > Reported-by: lonial con <kongln9170@gmail.com> > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> > > [...] Here is the summary with links: - [net,1/5] netfilter: nf_tables: disallow anonymous set with timeout flag https://git.kernel.org/netdev/net/c/16603605b667 - [net,2/5] netfilter: nf_tables: reject constant set with timeout https://git.kernel.org/netdev/net/c/5f4fc4bd5cdd - [net,3/5] netfilter: nft_ct: fix l3num expectations with inet pseudo family https://git.kernel.org/netdev/net/c/99993789966a - [net,4/5] netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout https://git.kernel.org/netdev/net/c/552705a3650b - [net,5/5] netfilter: nf_conntrack_h323: Add protection for bmp length out of range https://git.kernel.org/netdev/net/c/767146637efc You are awesome, thank you!
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 7e938c7397dd..bd21067f25cf 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -5001,6 +5001,9 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info, if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) == (NFT_SET_EVAL | NFT_SET_OBJECT)) return -EOPNOTSUPP; + if ((flags & (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT | NFT_SET_EVAL)) == + (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT)) + return -EOPNOTSUPP; } desc.dtype = 0;
Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFT_SET_EVAL to ensure legacy meters still work. Cc: stable@vger.kernel.org Fixes: 761da2935d6e ("netfilter: nf_tables: add set timeout API support") Reported-by: lonial con <kongln9170@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+)