Commit 88cccd90 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: NFTA_SET_ELEM_KEY_END requires concat and interval flags 



If the NFT_SET_CONCAT|NFT_SET_INTERVAL flags are set on, then the
netlink attribute NFTA_SET_ELEM_KEY_END must be specified. Otherwise,
NFTA_SET_ELEM_KEY_END should not be present.

For catch-all element, NFTA_SET_ELEM_KEY_END should not be present.
The NFT_SET_ELEM_INTERVAL_END is never used with this set flags
combination.

Fixes: 7b225d0b ("netfilter: nf_tables: add NFTA_SET_ELEM_KEY_END attribute")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 5a2f3dc3

net/netfilter/nf_tables_api.c

+24 −0
Original line number Diff line number Diff line
@@ -5844,6 +5844,24 @@ static void nft_setelem_remove(const struct net *net, 
		set->ops->remove(net, set, elem);

}



static bool nft_setelem_valid_key_end(const struct nft_set *set,

				      struct nlattr **nla, u32 flags)

{

	if ((set->flags & (NFT_SET_CONCAT | NFT_SET_INTERVAL)) ==

			  (NFT_SET_CONCAT | NFT_SET_INTERVAL)) {

		if (flags & NFT_SET_ELEM_INTERVAL_END)

			return false;

		if (!nla[NFTA_SET_ELEM_KEY_END] &&

		    !(flags & NFT_SET_ELEM_CATCHALL))

			return false;

	} else {

		if (nla[NFTA_SET_ELEM_KEY_END])

			return false;

	}



	return true;

}



static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,

			    const struct nlattr *attr, u32 nlmsg_flags)

{
@@ -5903,6 +5921,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, 
			return -EINVAL;

	}



	if (!nft_setelem_valid_key_end(set, nla, flags))

		return -EINVAL;



	if ((flags & NFT_SET_ELEM_INTERVAL_END) &&

	     (nla[NFTA_SET_ELEM_DATA] ||

	      nla[NFTA_SET_ELEM_OBJREF] ||
@@ -6333,6 +6354,9 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set, 
	if (!nla[NFTA_SET_ELEM_KEY] && !(flags & NFT_SET_ELEM_CATCHALL))

		return -EINVAL;



	if (!nft_setelem_valid_key_end(set, nla, flags))

		return -EINVAL;



	nft_set_ext_prepare(&tmpl);



	if (flags != 0) {