Kernel/linux-next
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git synced 2025-01-16 05:26:07 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

netfilter: nft_limit: do not ignore unsupported flags

Browse Source 
Bail out if userspace provides unsupported flags, otherwise future
extensions to the limit expression will be silently ignored by the
kernel.

Fixes: c7862a5f0de5 ("netfilter: nft_limit: allow to invert matching criteria")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso 2024-01-10 00:42:37 +01:00
parent 3c13725f43
commit 91a139cee1
1 changed files with 12 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
net/netfilter/nft_limit.c
View File

@ -58,6 +58,7 @@ static inline bool nft_limit_eval(struct nft_limit_priv *priv, u64 cost)
static int nft_limit_init(struct nft_limit_priv *priv, static int nft_limit_init(struct nft_limit_priv *priv,
const struct nlattr * const tb[], bool pkts) const struct nlattr * const tb[], bool pkts)
{ {
bool invert = false;
u64 unit, tokens; u64 unit, tokens;
if (tb[NFTA_LIMIT_RATE] == NULL || if (tb[NFTA_LIMIT_RATE] == NULL ||
@ -90,19 +91,23 @@ static int nft_limit_init(struct nft_limit_priv *priv,
priv->rate); priv->rate);
} }
if (tb[NFTA_LIMIT_FLAGS]) {
u32 flags = ntohl(nla_get_be32(tb[NFTA_LIMIT_FLAGS]));
if (flags & ~NFT_LIMIT_F_INV)
return -EOPNOTSUPP;
if (flags & NFT_LIMIT_F_INV)
invert = true;
}
priv->limit = kmalloc(sizeof(*priv->limit), GFP_KERNEL_ACCOUNT); priv->limit = kmalloc(sizeof(*priv->limit), GFP_KERNEL_ACCOUNT);
if (!priv->limit) if (!priv->limit)
return -ENOMEM; return -ENOMEM;
priv->limit->tokens = tokens; priv->limit->tokens = tokens;
priv->tokens_max = priv->limit->tokens; priv->tokens_max = priv->limit->tokens;
priv->invert = invert;
if (tb[NFTA_LIMIT_FLAGS]) {
u32 flags = ntohl(nla_get_be32(tb[NFTA_LIMIT_FLAGS]));
if (flags & NFT_LIMIT_F_INV)
priv->invert = true;
}
priv->limit->last = ktime_get_ns(); priv->limit->last = ktime_get_ns();
spin_lock_init(&priv->limit->lock); spin_lock_init(&priv->limit->lock);