netfilter: nf_tables: disallow updates of anonymous sets

JIRA: https://issues.redhat.com/browse/RHEL-1720
JIRA: https://issues.redhat.com/browse/RHEL-1721
Upstream Status: commit b770283

commit b770283
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Fri Jun 16 15:22:01 2023 +0200

    netfilter: nf_tables: disallow updates of anonymous sets

    Disallow updates of set timeout and garbage collection parameters for
    anonymous sets.

    Fixes: 123b996 ("netfilter: nf_tables: honor set timeout and garbage collection updates")
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Signed-off-by: Florian Westphal <fwestpha@redhat.com>

Author: fw-strlen

net/netfilter/nf_tables_api.c

@@ -4713,6 +4713,9 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info,
 		if (info->nlh->nlmsg_flags & NLM_F_REPLACE)
 			return -EOPNOTSUPP;
 
+		if (nft_set_is_anonymous(set))
+			return -EOPNOTSUPP;
+
 		err = nft_set_expr_alloc(&ctx, set, nla, exprs, &num_exprs, flags);
 		if (err < 0)
 			return err;