lkml.org 
[lkml]   [2019]   [Dec]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.19 20/84] netfilter: nf_tables: validate NFT_SET_ELEM_INTERVAL_END
    Date
    From: Pablo Neira Ayuso <pablo@netfilter.org>

    [ Upstream commit bffc124b6fe37d0ae9b428d104efb426403bb5c9 ]

    Only NFTA_SET_ELEM_KEY and NFTA_SET_ELEM_FLAGS make sense for elements
    whose NFT_SET_ELEM_INTERVAL_END flag is set on.

    Fixes: 96518518cc41 ("netfilter: add nftables")
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/netfilter/nf_tables_api.c | 12 +++++++++---
    1 file changed, 9 insertions(+), 3 deletions(-)

    diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
    index 0e1b1f7f4745..42f79f9532c6 100644
    --- a/net/netfilter/nf_tables_api.c
    +++ b/net/netfilter/nf_tables_api.c
    @@ -4351,14 +4351,20 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
    if (nla[NFTA_SET_ELEM_DATA] == NULL &&
    !(flags & NFT_SET_ELEM_INTERVAL_END))
    return -EINVAL;
    - if (nla[NFTA_SET_ELEM_DATA] != NULL &&
    - flags & NFT_SET_ELEM_INTERVAL_END)
    - return -EINVAL;
    } else {
    if (nla[NFTA_SET_ELEM_DATA] != NULL)
    return -EINVAL;
    }

    + if ((flags & NFT_SET_ELEM_INTERVAL_END) &&
    + (nla[NFTA_SET_ELEM_DATA] ||
    + nla[NFTA_SET_ELEM_OBJREF] ||
    + nla[NFTA_SET_ELEM_TIMEOUT] ||
    + nla[NFTA_SET_ELEM_EXPIRATION] ||
    + nla[NFTA_SET_ELEM_USERDATA] ||
    + nla[NFTA_SET_ELEM_EXPR]))
    + return -EINVAL;
    +
    timeout = 0;
    if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
    if (!(set->flags & NFT_SET_TIMEOUT))
    --
    2.20.1
    \
     
     \ /
      Last update: 2019-12-27 18:45    [W:3.311 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site