diff mbox series

[nf-next,v2,3/9] netfilter: nf_tables: reject expiration higher than timeout

Message ID 20240902231726.171964-3-pablo@netfilter.org
State Changes Requested
Headers show
Series [nf-next,v2,1/9] netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire | expand

Commit Message

Pablo Neira Ayuso Sept. 2, 2024, 11:17 p.m. UTC 
Report ERANGE to userspace if user specifies an expiration larger than
the timeout.

Fixes: 8e1102d5a159 ("netfilter: nf_tables: support timeouts larger than 23 days")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
v2: no changes.

 net/netfilter/nf_tables_api.c | 3 +++
 1 file changed, 3 insertions(+)
diff mbox series

Patch

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 1884125ebb28..684dff68b2c3 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -6924,6 +6924,9 @@  static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
 					    &expiration);
 		if (err)
 			return err;
+
+		if (expiration > timeout)
+			return -ERANGE;
 	}
 
 	if (nla[NFTA_SET_ELEM_EXPR]) {