Commit 8059918a authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations 



- Disallow families other than NFPROTO_{IPV4,IPV6,INET}.
- Disallow layer 4 protocol with no ports, since destination port is a
  mandatory attribute for this object.

Fixes: 857b4602 ("netfilter: nft_ct: add ct expectations support")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 259eb329

net/netfilter/nft_ct.c

+24 −0
Original line number Diff line number Diff line
@@ -1250,7 +1250,31 @@ static int nft_ct_expect_obj_init(const struct nft_ctx *ctx, 
	if (tb[NFTA_CT_EXPECT_L3PROTO])

		priv->l3num = ntohs(nla_get_be16(tb[NFTA_CT_EXPECT_L3PROTO]));



	switch (priv->l3num) {

	case NFPROTO_IPV4:

	case NFPROTO_IPV6:

		if (priv->l3num != ctx->family)

			return -EINVAL;



		fallthrough;

	case NFPROTO_INET:

		break;

	default:

		return -EOPNOTSUPP;

	}



	priv->l4proto = nla_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]);

	switch (priv->l4proto) {

	case IPPROTO_TCP:

	case IPPROTO_UDP:

	case IPPROTO_UDPLITE:

	case IPPROTO_DCCP:

	case IPPROTO_SCTP:

		break;

	default:

		return -EOPNOTSUPP;

	}



	priv->dport = nla_get_be16(tb[NFTA_CT_EXPECT_DPORT]);

	priv->timeout = nla_get_u32(tb[NFTA_CT_EXPECT_TIMEOUT]);

	priv->size = nla_get_u8(tb[NFTA_CT_EXPECT_SIZE]);