diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2026-07-01 12:46:57 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2026-07-03 14:45:21 +0200 |
| commit | 278296b69fae5dd951599692cd481bae4995215c (patch) | |
| tree | 5b3d94c8a7605173661c47f3fa6c85027e6ca742 /net/netfilter | |
| parent | 444853cd438201007da5359821adcc2995655ab1 (diff) | |
netfilter: nfnetlink_cthelper: cap to maximum number of expectation per master on updates
Really cap it to NF_CT_EXPECT_MAX_CNT (255) on updates.
The commit ("netfilter: nfnetlink_cthelper: cap to maximum number of
expectation per master") only covers creation of helpers, not updates.
Fixes: 397c8300972f ("netfilter: nf_conntrack_helper: cap maximum number of expectation at helper registration")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'net/netfilter')
| -rw-r--r-- | net/netfilter/nfnetlink_cthelper.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c index 2cbcca9110db..f062ac210343 100644 --- a/net/netfilter/nfnetlink_cthelper.c +++ b/net/netfilter/nfnetlink_cthelper.c @@ -316,6 +316,8 @@ nfnl_cthelper_update_policy_one(const struct nf_conntrack_expect_policy *policy, new_policy->max_expected = ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX])); + if (!new_policy->max_expected) + new_policy->max_expected = NF_CT_EXPECT_MAX_CNT; if (new_policy->max_expected > NF_CT_EXPECT_MAX_CNT) return -EINVAL; |