Skip to content

Commit 2bfffe7

Browse files
committed
netfilter: nf_tables: disallow element updates of bound anonymous sets
jira VUlN-429 subsystem-sync netfilter:nf_tables 4.18.0-511 commit-author Pablo Neira Ayuso <[email protected]> commit c88c535 Anonymous sets come with NFT_SET_CONSTANT from userspace. Although API allows to create anonymous sets without NFT_SET_CONSTANT, it makes no sense to allow to add and to delete elements for bound anonymous sets. Fixes: 9651851 ("netfilter: add nftables") Signed-off-by: Pablo Neira Ayuso <[email protected]> (cherry picked from commit c88c535) Signed-off-by: Greg Rose <[email protected]>
1 parent 5dd4019 commit 2bfffe7

File tree

1 file changed

+5
-2
lines changed

1 file changed

+5
-2
lines changed

net/netfilter/nf_tables_api.c

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5646,7 +5646,8 @@ static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
56465646
if (IS_ERR(set))
56475647
return PTR_ERR(set);
56485648

5649-
if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
5649+
if (!list_empty(&set->bindings) &&
5650+
(set->flags & (NFT_SET_CONSTANT | NFT_SET_ANONYMOUS)))
56505651
return -EBUSY;
56515652

56525653
nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
@@ -5851,7 +5852,9 @@ static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
58515852
set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
58525853
if (IS_ERR(set))
58535854
return PTR_ERR(set);
5854-
if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
5855+
5856+
if (!list_empty(&set->bindings) &&
5857+
(set->flags & (NFT_SET_CONSTANT | NFT_SET_ANONYMOUS)))
58555858
return -EBUSY;
58565859

58575860
if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {

0 commit comments

Comments
 (0)