Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bcf49342 authored by Phil Sutter's avatar Phil Sutter Committed by Pablo Neira Ayuso
Browse files

netfilter: ebtables: Fix extension lookup with identical name 



If a requested extension exists as module and is not loaded,
ebt_check_match() might accidentally use an NFPROTO_UNSPEC one with same
name and fail.

Reproduced with limit match: Given xt_limit and ebt_limit both built as
module, the following would fail:

  modprobe xt_limit
  ebtables -I INPUT --limit 1/s -j ACCEPT

The fix is to make ebt_check_match() distrust a found NFPROTO_UNSPEC
extension and retry after requesting an appropriate module.

Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: default avatarPhil Sutter <phil@nwl.cc>
Acked-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 644c7e48

net/bridge/netfilter/ebtables.c

+5 −1
Original line number Diff line number Diff line
@@ -370,7 +370,11 @@ ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par, 
	    left - sizeof(struct ebt_entry_match) < m->match_size)

		return -EINVAL;



	match = xt_request_find_match(NFPROTO_BRIDGE, m->u.name, 0);

	match = xt_find_match(NFPROTO_BRIDGE, m->u.name, 0);

	if (IS_ERR(match) || match->family != NFPROTO_BRIDGE) {

		request_module("ebt_%s", m->u.name);

		match = xt_find_match(NFPROTO_BRIDGE, m->u.name, 0);

	}

	if (IS_ERR(match))

		return PTR_ERR(match);

	m->u.match = match;