netfilter: nf_tables: disallow NFT_SET_ELEM_CATCHALL and NFT_SET_ELEM_INTERVAL_END

ummakynes · ummakynes · commit fc0ae524b5fd · 2022-08-15T17:54:59.000+02:00
These flags are mutually exclusive, report EINVAL in this case. Fixes: aaa3104 ("netfilter: nftables: add catch-all set element support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
@@ -5198,6 +5198,9 @@ static int nft_setelem_parse_flags(const struct nft_set *set,
 	if (!(set->flags & NFT_SET_INTERVAL) &&
 	    *flags & NFT_SET_ELEM_INTERVAL_END)
 		return -EINVAL;
+	if ((*flags & (NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL)) ==
+	    (NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL))
+		return -EINVAL;
 
 	return 0;
 }

Original file line number	Diff line number	Diff line change
`@@ -5198,6 +5198,9 @@ static int nft_setelem_parse_flags(const struct nft_set *set,`
`5198`	`5198`	`if (!(set->flags & NFT_SET_INTERVAL) &&`
`5199`	`5199`	`*flags & NFT_SET_ELEM_INTERVAL_END)`
`5200`	`5200`	`return -EINVAL;`
	`5201`	`+ if ((*flags & (NFT_SET_ELEM_INTERVAL_END \| NFT_SET_ELEM_CATCHALL)) ==`
	`5202`	`+ (NFT_SET_ELEM_INTERVAL_END \| NFT_SET_ELEM_CATCHALL))`
	`5203`	`+ return -EINVAL;`
`5201`	`5204`
`5202`	`5205`	`return 0;`
`5203`	`5206`	`}`