netfilter: nf_tables: reject unbound anonymous set before commit phase

Browse source

[ Upstream commit 938154b93b ]

Add a new list to track set transaction and to check for unbound
anonymous sets before entering the commit phase.

Bail out at the end of the transaction handling if an anonymous set
remains unbound.

Fixes: 96518518cc ("netfilter: add nftables")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Pablo Neira Ayuso 2023-06-16 15:21:33 +02:00 • committed by Greg Kroah-Hartman

parent b60c0ce0ff

commit 46f801ab5f

2 changed files with 35 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

3

include/net/netfilter/nf_tables.h

View file

35

net/netfilter/nf_tables_api.c

View file