From 22f98fe20c60fcbfdfa01e78a348e024a175132d Mon Sep 17 00:00:00 2001 From: Greg Rose Date: Mon, 21 Oct 2024 14:04:44 -0700 Subject: [PATCH] netfilter: nf_tables: disallow timeout for anonymous sets jira VULN-429 subsystem-sync netfilter:nf_tables 4.18.0-511 commit-author Pablo Neira Ayuso commit e26d3009efda338f19016df4175f354a9bd0a4ab Never used from userspace, disallow these parameters. Signed-off-by: Pablo Neira Ayuso (cherry picked from commit e26d3009efda338f19016df4175f354a9bd0a4ab) Signed-off-by: Greg Rose --- net/netfilter/nf_tables_api.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 0481ac59bcc4..486f9f95f242 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -4164,6 +4164,10 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, if (nla[NFTA_SET_GC_INTERVAL] != NULL) { if (!(flags & NFT_SET_TIMEOUT)) return -EINVAL; + + if (flags & NFT_SET_ANONYMOUS) + return -EOPNOTSUPP; + gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL])); } @@ -5342,6 +5346,10 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) { if (!(set->flags & NFT_SET_TIMEOUT)) return -EINVAL; + + if (flags & NFT_SET_ANONYMOUS) + return -EOPNOTSUPP; + err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_TIMEOUT], &timeout); if (err)