netfilter: nft_ct: report error if mark and dir specified simultaneously
authorLiping Zhang <liping.zhang@spreadtrum.com>
Thu, 22 Sep 2016 14:28:52 +0000 (22:28 +0800)
committerPablo Neira Ayuso <pablo@netfilter.org>
Sun, 25 Sep 2016 12:54:04 +0000 (14:54 +0200)
NFT_CT_MARK is unrelated to direction, so if NFTA_CT_DIRECTION attr is
specified, report EINVAL to the userspace. This validation check was
already done at nft_ct_get_init, but we missed it in nft_ct_set_init.

Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nft_ct.c

index 825fbbc62f4822a2dc0aaf0e42cd1c182ae2de2c..d7b0d171172ad792321d3d46eaf413791c4174a5 100644 (file)
@@ -364,6 +364,8 @@ static int nft_ct_set_init(const struct nft_ctx *ctx,
        switch (priv->key) {
 #ifdef CONFIG_NF_CONNTRACK_MARK
        case NFT_CT_MARK:
+               if (tb[NFTA_CT_DIRECTION])
+                       return -EINVAL;
                len = FIELD_SIZEOF(struct nf_conn, mark);
                break;
 #endif