From patchwork Thu Sep 5 23:29:13 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 13793098 X-Patchwork-Delegate: kuba@kernel.org Received: from mail.netfilter.org (mail.netfilter.org [217.70.188.207]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 794011BAEFE; Thu, 5 Sep 2024 23:29:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.70.188.207 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725578980; cv=none; b=UIINjm0k1YbhZ44Gx1XQl5dpjPNtCKlzH+qJCXr9kPESFRVre0uEptl8GDFJZxhbCGEYwQEuakOsqPw7AvzmjjE2nl9t6QH90t45Zytk8DSyQtkFOG9J0X49LGKi2CkkWhbXwLnMES204F7hPBjBppS6Ctrz6jVqYaItjdnH/Bk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725578980; c=relaxed/simple; bh=2KXohVpqTfdTqdS/+RQcBX0u+iIcGxJlzVNo8eVWNpw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=Kc8KTpExspMH/c8D/cnwnK8AaR988H8dKWr5OufZ/VsKCIM2gtP3SwEvD15yaZmGXTWp6m1pEXKH8zX8S1xSx9Vcb+UTosOQDPJ5hukltuR8n4Sm9+k9B/ljwaohDXqT/Yrk16j+LuanGcWKQXBKyFFLLmvFJL9ohaZiKNWqiIo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=netfilter.org; spf=pass smtp.mailfrom=netfilter.org; arc=none smtp.client-ip=217.70.188.207 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=netfilter.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=netfilter.org From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Cc: davem@davemloft.net, netdev@vger.kernel.org, kuba@kernel.org, pabeni@redhat.com, edumazet@google.com, fw@strlen.de Subject: [PATCH net-next 09/16] netfilter: nf_tables: reject element expiration with no timeout Date: Fri, 6 Sep 2024 01:29:13 +0200 Message-Id: <20240905232920.5481-10-pablo@netfilter.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20240905232920.5481-1-pablo@netfilter.org> References: <20240905232920.5481-1-pablo@netfilter.org> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org If element timeout is unset and set provides no default timeout, the element expiration is silently ignored, reject this instead to let user know this is unsupported. Also prepare for supporting timeout that never expire, where zero timeout and expiration must be also rejected. Fixes: 8e1102d5a159 ("netfilter: nf_tables: support timeouts larger than 23 days") Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index b49fcd7148d3..da75bc1de466 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -6923,6 +6923,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, if (nla[NFTA_SET_ELEM_EXPIRATION] != NULL) { if (!(set->flags & NFT_SET_TIMEOUT)) return -EINVAL; + if (timeout == 0) + return -EOPNOTSUPP; + err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_EXPIRATION], &expiration); if (err)