Commit d0009eff authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: validate NFPROTO_* family 



Several expressions explicitly refer to NF_INET_* hook definitions
from expr->ops->validate, however, family is not validated.

Bail out with EOPNOTSUPP in case they are used from unsupported
families.

Fixes: 0ca743a5 ("netfilter: nf_tables: add compatibility layer for x_tables")
Fixes: a3c90f7a ("netfilter: nf_tables: flow offload expression")
Fixes: 2fa84193 ("netfilter: nf_tables: introduce routing expression")
Fixes: 554ced0a ("netfilter: nf_tables: add support for native socket matching")
Fixes: ad49d86e ("netfilter: nf_tables: Add synproxy support")
Fixes: 4ed8eb65 ("netfilter: nf_tables: Add native tproxy support")
Fixes: 6c472602 ("netfilter: nf_tables: add xfrm expression")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent f342de4e

net/netfilter/nft_compat.c

+12 −0
Original line number Diff line number Diff line
@@ -350,6 +350,12 @@ static int nft_target_validate(const struct nft_ctx *ctx, 
	unsigned int hook_mask = 0;

	int ret;



	if (ctx->family != NFPROTO_IPV4 &&

	    ctx->family != NFPROTO_IPV6 &&

	    ctx->family != NFPROTO_BRIDGE &&

	    ctx->family != NFPROTO_ARP)

		return -EOPNOTSUPP;



	if (nft_is_base_chain(ctx->chain)) {

		const struct nft_base_chain *basechain =

						nft_base_chain(ctx->chain);
@@ -595,6 +601,12 @@ static int nft_match_validate(const struct nft_ctx *ctx, 
	unsigned int hook_mask = 0;

	int ret;



	if (ctx->family != NFPROTO_IPV4 &&

	    ctx->family != NFPROTO_IPV6 &&

	    ctx->family != NFPROTO_BRIDGE &&

	    ctx->family != NFPROTO_ARP)

		return -EOPNOTSUPP;



	if (nft_is_base_chain(ctx->chain)) {

		const struct nft_base_chain *basechain =

						nft_base_chain(ctx->chain);

net/netfilter/nft_flow_offload.c

+5 −0
Original line number Diff line number Diff line
@@ -384,6 +384,11 @@ static int nft_flow_offload_validate(const struct nft_ctx *ctx, 
{

	unsigned int hook_mask = (1 << NF_INET_FORWARD);



	if (ctx->family != NFPROTO_IPV4 &&

	    ctx->family != NFPROTO_IPV6 &&

	    ctx->family != NFPROTO_INET)

		return -EOPNOTSUPP;



	return nft_chain_validate_hooks(ctx->chain, hook_mask);

}

net/netfilter/nft_nat.c

+5 −0
Original line number Diff line number Diff line
@@ -143,6 +143,11 @@ static int nft_nat_validate(const struct nft_ctx *ctx, 
	struct nft_nat *priv = nft_expr_priv(expr);

	int err;



	if (ctx->family != NFPROTO_IPV4 &&

	    ctx->family != NFPROTO_IPV6 &&

	    ctx->family != NFPROTO_INET)

		return -EOPNOTSUPP;



	err = nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT);

	if (err < 0)

		return err;

net/netfilter/nft_rt.c

+5 −0
Original line number Diff line number Diff line
@@ -166,6 +166,11 @@ static int nft_rt_validate(const struct nft_ctx *ctx, const struct nft_expr *exp 
	const struct nft_rt *priv = nft_expr_priv(expr);

	unsigned int hooks;



	if (ctx->family != NFPROTO_IPV4 &&

	    ctx->family != NFPROTO_IPV6 &&

	    ctx->family != NFPROTO_INET)

		return -EOPNOTSUPP;



	switch (priv->key) {

	case NFT_RT_NEXTHOP4:

	case NFT_RT_NEXTHOP6:

net/netfilter/nft_socket.c

+5 −0
Original line number Diff line number Diff line
@@ -242,6 +242,11 @@ static int nft_socket_validate(const struct nft_ctx *ctx, 
			       const struct nft_expr *expr,

			       const struct nft_data **data)

{

	if (ctx->family != NFPROTO_IPV4 &&

	    ctx->family != NFPROTO_IPV6 &&

	    ctx->family != NFPROTO_INET)

		return -EOPNOTSUPP;



	return nft_chain_validate_hooks(ctx->chain,

					(1 << NF_INET_PRE_ROUTING) |

					(1 << NF_INET_LOCAL_IN) |