2 files changed, 29 insertions, 1 deletions

diff --git a/include/uapi/linux/netfilter/nf_conntrack_common.h b/include/uapi/linux/netfilter/nf_conntrack_common.h
index 6d074d14ee27..6a8e33dd4ecb 100644
--- a/include/uapi/linux/netfilter/nf_conntrack_common.h
+++ b/include/uapi/linux/netfilter/nf_conntrack_common.h
@@ -82,6 +82,10 @@ enum ip_conntrack_status {
         IPS_DYING_BIT = 9,
         IPS_DYING = (1 << IPS_DYING_BIT),
 
+        /* Bits that cannot be altered from userland. */
+        IPS_UNCHANGEABLE_MASK = (IPS_NAT_DONE_MASK | IPS_NAT_MASK |
+                                 IPS_EXPECTED | IPS_CONFIRMED | IPS_DYING),
+
         /* Connection has fixed timeout. */
         IPS_FIXED_TIMEOUT_BIT = 10,
         IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT),
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 27540455dc62..bf04b7e9d6f7 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -2270,6 +2270,30 @@ nla_put_failure:
 }
 
 static int
+ctnetlink_update_status(struct nf_conn *ct, const struct nlattr * const cda[])
+{
+        unsigned int status = ntohl(nla_get_be32(cda[CTA_STATUS]));
+        unsigned long d = ct->status ^ status;
+
+        if (d & IPS_SEEN_REPLY && !(status & IPS_SEEN_REPLY))
+                /* SEEN_REPLY bit can only be set */
+                return -EBUSY;
+
+        if (d & IPS_ASSURED && !(status & IPS_ASSURED))
+                /* ASSURED bit can only be set */
+                return -EBUSY;
+
+        /* This check is less strict than ctnetlink_change_status()
+         * because callers often flip IPS_EXPECTED bits when sending
+         * an NFQA_CT attribute to the kernel.  So ignore the
+         * unchangeable bits but do not error out.
+         */
+        ct->status = (status & ~IPS_UNCHANGEABLE_MASK) |
+                     (ct->status & IPS_UNCHANGEABLE_MASK);
+        return 0;
+}
+
+static int
 ctnetlink_glue_parse_ct(const struct nlattr *cda[], struct nf_conn *ct)
 {
         int err;
@@ -2280,7 +2304,7 @@ ctnetlink_glue_parse_ct(const struct nlattr *cda[], struct nf_conn *ct)
                         return err;
         }
         if (cda[CTA_STATUS]) {
-                err = ctnetlink_change_status(ct, cda);
+                err = ctnetlink_update_status(ct, cda);
                 if (err < 0)
                         return err;
         }