Commit e26d3009 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: disallow timeout for anonymous sets 



Never used from userspace, disallow these parameters.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent b770283c

net/netfilter/nf_tables_api.c

+7 −0
Original line number Diff line number Diff line
@@ -4909,6 +4909,9 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info, 
		if (!(flags & NFT_SET_TIMEOUT))

			return -EINVAL;



		if (flags & NFT_SET_ANONYMOUS)

			return -EOPNOTSUPP;



		err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &desc.timeout);

		if (err)

			return err;
@@ -4917,6 +4920,10 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info, 
	if (nla[NFTA_SET_GC_INTERVAL] != NULL) {

		if (!(flags & NFT_SET_TIMEOUT))

			return -EINVAL;



		if (flags & NFT_SET_ANONYMOUS)

			return -EOPNOTSUPP;



		desc.gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));

	}