Commit 113661e0 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso

netfilter: nf_tables: reject NFT_SET_CONCAT with not field length description

It is still possible to set on the NFT_SET_CONCAT flag by specifying a
set size and no field description, report EINVAL in such case.

Fixes: 1b6345d4 ("netfilter: nf_tables: check NFT_SET_CONCAT flag if field_count is specified")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 6b1ca88e
......@@ -5070,8 +5070,12 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info,
if (err < 0)
return err;
if (desc.field_count > 1 && !(flags & NFT_SET_CONCAT))
if (desc.field_count > 1) {
if (!(flags & NFT_SET_CONCAT))
return -EINVAL;
} else if (flags & NFT_SET_CONCAT) {
return -EINVAL;
}
} else if (flags & NFT_SET_CONCAT) {
return -EINVAL;
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment