Commit fc0ae524 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: disallow NFT_SET_ELEM_CATCHALL and NFT_SET_ELEM_INTERVAL_END 



These flags are mutually exclusive, report EINVAL in this case.

Fixes: aaa31047 ("netfilter: nftables: add catch-all set element support")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 88cccd90

net/netfilter/nf_tables_api.c

+3 −0
Original line number Diff line number Diff line
@@ -5198,6 +5198,9 @@ static int nft_setelem_parse_flags(const struct nft_set *set, 
	if (!(set->flags & NFT_SET_INTERVAL) &&

	    *flags & NFT_SET_ELEM_INTERVAL_END)

		return -EINVAL;

	if ((*flags & (NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL)) ==

	    (NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL))

		return -EINVAL;



	return 0;

}