netfilter: xt_owner: bail out with EINVAL in case of unsupported flags

Reject flags that are not supported with EINVAL.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/uapi/linux/netfilter/xt_owner.h b/include/uapi/linux/netfilter/xt_owner.h
index 9e98c09eda32741d21bbe85833583fdcc1f67cae..5108df4d03134a1ca822397870f67224c981f719 100644 (file)
--- a/include/uapi/linux/netfilter/xt_owner.h
+++ b/include/uapi/linux/netfilter/xt_owner.h
@@ -11,6 +11,11 @@ enum {
        XT_OWNER_SUPPL_GROUPS = 1 << 3,
 };
 
+#define XT_OWNER_MASK  (XT_OWNER_UID |         \
+                        XT_OWNER_GID |         \
+                        XT_OWNER_SOCKET |      \
+                        XT_OWNER_SUPPL_GROUPS)
+
 struct xt_owner_match_info {
        __u32 uid_min, uid_max;
        __u32 gid_min, gid_max;

diff --git a/net/netfilter/xt_owner.c b/net/netfilter/xt_owner.c
index a8784502aca6963b808c52e1e6a0a23ae9253cc5..ee597fdc5db7ba5f4cf23fe7081528757d3bb8db 100644 (file)
--- a/net/netfilter/xt_owner.c
+++ b/net/netfilter/xt_owner.c
@@ -25,6 +25,9 @@ static int owner_check(const struct xt_mtchk_param *par)
        struct xt_owner_match_info *info = par->matchinfo;
        struct net *net = par->net;
 
+       if (info->match & ~XT_OWNER_MASK)
+               return -EINVAL;
+
        /* Only allow the common case where the userns of the writer
         * matches the userns of the network namespace.
         */