Roman Kubiak <r.kubiak@xxxxxxxxxxx> wrote:
> Fixes applied (i'm not sure how i should use the mask parameter to check if NFQA_CFG_F_SECCTX is set
> on the userspace side both the mask and the flag are the same value when i looked at how uid/gid
> are set, maybe this could be done better?)
[..]
> @@ -1142,7 +1170,12 @@ nfqnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
> ret = -EOPNOTSUPP;
> goto err_out_unlock;
> }
> -
> +#if !IS_ENABLED(CONFIG_NETWORK_SECMARK)
> + if (flags == NFQA_CFG_F_SECCTX) {
> + ret = -EOPNOTSUPP;
> + goto err_out_unlock;
> + }
> +#endif
> spin_lock_bh(&queue->lock);
> queue->flags &= ~mask;
> queue->flags |= flags & mask;
Based on last two lines it appears the test should be something like
if (flags & mask & NFQA_CFG_F_SECCTX)
return -EOPNOTSUPP;
[ seems intent is to allow unsetting some flag(s) via
flags = SOME_FEAT_I_WANT;
mask = SOME_FEAT_I_WANT|SOME_FEAT_I_WANT_TO_SWITCH_OFF; ]
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
