Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6ec30320 authored by Florian Westphal's avatar Florian Westphal Committed by Sasha Levin
Browse files

netfilter: nft_ct: fix l3num expectations with inet pseudo family 



[ Upstream commit 99993789966a6eb4f1295193dc543686899892d3 ]

Following is rejected but should be allowed:

table inet t {
        ct expectation exp1 {
                [..]
                l3proto ip

Valid combos are:
table ip t, l3proto ip
table ip6 t, l3proto ip6
table inet t, l3proto ip OR l3proto ip6

Disallow inet pseudeo family, the l3num must be a on-wire protocol known
to conntrack.

Retain NFPROTO_INET case to make it clear its rejected
intentionally rather as oversight.

Fixes: 8059918a1377 ("netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations")
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 997efea2

net/netfilter/nft_ct.c

+5 −6
Original line number Diff line number Diff line
@@ -1180,14 +1180,13 @@ static int nft_ct_expect_obj_init(const struct nft_ctx *ctx, 
	switch (priv->l3num) {

	case NFPROTO_IPV4:

	case NFPROTO_IPV6:

		if (priv->l3num != ctx->family)

			return -EINVAL;



		fallthrough;

	case NFPROTO_INET:

		if (priv->l3num == ctx->family || ctx->family == NFPROTO_INET)

			break;



		return -EINVAL;

	case NFPROTO_INET: /* tuple.src.l3num supports NFPROTO_IPV4/6 only */

	default:

		return -EOPNOTSUPP;

		return -EAFNOSUPPORT;

	}



	priv->l4proto = nla_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]);