Commit 292781c3 authored Feb 01, 2024 by Pablo Neira Ayuso

netfilter: nft_compat: reject unused compat flag



Flag (1 << 0) is ignored is set, never used, reject it it with EINVAL
instead.

Fixes: 0ca743a5 ("netfilter: nf_tables: add compatibility layer for x_tables")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent 36fa8d69

include/uapi/linux/netfilter/nf_tables.h

+2 −0

Original line number	Diff line number	Diff line
		@@ -285,9 +285,11 @@ enum nft_rule_attributes {
		/**
		* enum nft_rule_compat_flags - nf_tables rule compat flags
		*
		* @NFT_RULE_COMPAT_F_UNUSED: unused
		* @NFT_RULE_COMPAT_F_INV: invert the check result
		*/
		enum nft_rule_compat_flags {
		NFT_RULE_COMPAT_F_UNUSED = (1 << 0),
		NFT_RULE_COMPAT_F_INV = (1 << 1),
		NFT_RULE_COMPAT_F_MASK = NFT_RULE_COMPAT_F_INV,
		};

net/netfilter/nft_compat.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -212,7 +212,8 @@ static int nft_parse_compat(const struct nlattr attr, u16 proto, bool *inv)
		return -EINVAL;

		flags = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_FLAGS]));
		if (flags & ~NFT_RULE_COMPAT_F_MASK)
		if (flags & NFT_RULE_COMPAT_F_UNUSED \|\|
		flags & ~NFT_RULE_COMPAT_F_MASK)
		return -EINVAL;
		if (flags & NFT_RULE_COMPAT_F_INV)
		*inv = true;