From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org, kuba@kernel.org,
pabeni@redhat.com, edumazet@google.com
Subject: [PATCH net 07/14] netfilter: nf_tables: disallow element updates of bound anonymous sets
Date: Tue, 20 Jun 2023 11:35:35 +0200 [thread overview]
Message-ID: <20230620093542.69232-8-pablo@netfilter.org> (raw)
In-Reply-To: <20230620093542.69232-1-pablo@netfilter.org>
Anonymous sets come with NFT_SET_CONSTANT from userspace. Although API
allows to create anonymous sets without NFT_SET_CONSTANT, it makes no
sense to allow to add and to delete elements for bound anonymous sets.
Fixes: 96518518cc41 ("netfilter: add nftables")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index cf10b3bd5c0f..6f26520bd865 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -6779,7 +6779,8 @@ static int nf_tables_newsetelem(struct sk_buff *skb,
if (IS_ERR(set))
return PTR_ERR(set);
- if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
+ if (!list_empty(&set->bindings) &&
+ (set->flags & (NFT_SET_CONSTANT | NFT_SET_ANONYMOUS)))
return -EBUSY;
nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
@@ -7053,7 +7054,9 @@ static int nf_tables_delsetelem(struct sk_buff *skb,
set = nft_set_lookup(table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
if (IS_ERR(set))
return PTR_ERR(set);
- if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
+
+ if (!list_empty(&set->bindings) &&
+ (set->flags & (NFT_SET_CONSTANT | NFT_SET_ANONYMOUS)))
return -EBUSY;
nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
--
2.30.2
next prev parent reply other threads:[~2023-06-20 9:36 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-20 9:35 [PATCH net 00/14,v2] Netfilter/IPVS fixes for net Pablo Neira Ayuso
2023-06-20 9:35 ` [PATCH net 01/14] ipvs: align inner_mac_header for encapsulation Pablo Neira Ayuso
2023-06-20 9:35 ` [PATCH net 02/14] netfilter: nf_tables: fix chain binding transaction logic Pablo Neira Ayuso
2023-06-20 9:35 ` [PATCH net 03/14] netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain Pablo Neira Ayuso
2023-06-20 9:35 ` [PATCH net 04/14] netfilter: nf_tables: drop map element references from preparation phase Pablo Neira Ayuso
2023-06-20 9:35 ` [PATCH net 05/14] netfilter: nft_set_pipapo: .walk does not deal with generations Pablo Neira Ayuso
2023-06-20 9:35 ` [PATCH net 06/14] netfilter: nf_tables: fix underflow in object reference counter Pablo Neira Ayuso
2023-06-20 9:35 ` Pablo Neira Ayuso [this message]
2023-06-20 9:35 ` [PATCH net 08/14] netfilter: nf_tables: reject unbound anonymous set before commit phase Pablo Neira Ayuso
2023-06-20 9:35 ` [PATCH net 09/14] netfilter: nf_tables: reject unbound chain " Pablo Neira Ayuso
2023-06-20 9:35 ` [PATCH net 10/14] netfilter: nf_tables: disallow updates of anonymous sets Pablo Neira Ayuso
2023-06-20 9:35 ` [PATCH net 11/14] netfilter: nf_tables: disallow timeout for " Pablo Neira Ayuso
2023-06-20 9:35 ` [PATCH net 12/14] netfilter: nf_tables: drop module reference after updating chain Pablo Neira Ayuso
2023-06-20 9:35 ` [PATCH net 13/14] netfilter: nfnetlink_osf: fix module autoload Pablo Neira Ayuso
2023-06-20 9:35 ` [PATCH net 14/14] netfilter: nf_tables: Fix for deleting base chains with payload Pablo Neira Ayuso
2023-06-20 17:00 ` [PATCH net 00/14,v2] Netfilter/IPVS fixes for net Pablo Neira Ayuso
-- strict thread matches above, loose matches on Subject: below --
2023-06-21 10:07 [PATCH net,v3 00/14] " Pablo Neira Ayuso
2023-06-21 10:07 ` [PATCH net 07/14] netfilter: nf_tables: disallow element updates of bound anonymous sets Pablo Neira Ayuso
2023-06-19 14:57 [PATCH net 00/14] Netfilter/IPVS fixes for net Pablo Neira Ayuso
2023-06-19 14:57 ` [PATCH net 07/14] netfilter: nf_tables: disallow element updates of bound anonymous sets Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230620093542.69232-8-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.