Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a5bbd579 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by Greg Kroah-Hartman
Browse files

netfilter: nf_tables: validate NFPROTO_* family 



[ Upstream commit d0009effa8862c20a13af4cb7475d9771b905693 ]

Several expressions explicitly refer to NF_INET_* hook definitions
from expr->ops->validate, however, family is not validated.

Bail out with EOPNOTSUPP in case they are used from unsupported
families.

Fixes: 0ca743a5 ("netfilter: nf_tables: add compatibility layer for x_tables")
Fixes: a3c90f7a ("netfilter: nf_tables: flow offload expression")
Fixes: 2fa84193 ("netfilter: nf_tables: introduce routing expression")
Fixes: 554ced0a ("netfilter: nf_tables: add support for native socket matching")
Fixes: ad49d86e07a4 ("netfilter: nf_tables: Add synproxy support")
Fixes: 4ed8eb65 ("netfilter: nf_tables: Add native tproxy support")
Fixes: 6c47260250fc ("netfilter: nf_tables: add xfrm expression")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 18f1f505

net/netfilter/nft_compat.c

+12 −0
Original line number Diff line number Diff line
@@ -319,6 +319,12 @@ static int nft_target_validate(const struct nft_ctx *ctx, 
	unsigned int hook_mask = 0;

	int ret;



	if (ctx->family != NFPROTO_IPV4 &&

	    ctx->family != NFPROTO_IPV6 &&

	    ctx->family != NFPROTO_BRIDGE &&

	    ctx->family != NFPROTO_ARP)

		return -EOPNOTSUPP;



	if (nft_is_base_chain(ctx->chain)) {

		const struct nft_base_chain *basechain =

						nft_base_chain(ctx->chain);
@@ -560,6 +566,12 @@ static int nft_match_validate(const struct nft_ctx *ctx, 
	unsigned int hook_mask = 0;

	int ret;



	if (ctx->family != NFPROTO_IPV4 &&

	    ctx->family != NFPROTO_IPV6 &&

	    ctx->family != NFPROTO_BRIDGE &&

	    ctx->family != NFPROTO_ARP)

		return -EOPNOTSUPP;



	if (nft_is_base_chain(ctx->chain)) {

		const struct nft_base_chain *basechain =

						nft_base_chain(ctx->chain);

net/netfilter/nft_flow_offload.c

+5 −0
Original line number Diff line number Diff line
@@ -145,6 +145,11 @@ static int nft_flow_offload_validate(const struct nft_ctx *ctx, 
{

	unsigned int hook_mask = (1 << NF_INET_FORWARD);



	if (ctx->family != NFPROTO_IPV4 &&

	    ctx->family != NFPROTO_IPV6 &&

	    ctx->family != NFPROTO_INET)

		return -EOPNOTSUPP;



	return nft_chain_validate_hooks(ctx->chain, hook_mask);

}

net/netfilter/nft_nat.c

+5 −0
Original line number Diff line number Diff line
@@ -94,6 +94,11 @@ static int nft_nat_validate(const struct nft_ctx *ctx, 
	struct nft_nat *priv = nft_expr_priv(expr);

	int err;



	if (ctx->family != NFPROTO_IPV4 &&

	    ctx->family != NFPROTO_IPV6 &&

	    ctx->family != NFPROTO_INET)

		return -EOPNOTSUPP;



	err = nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT);

	if (err < 0)

		return err;

net/netfilter/nft_rt.c

+5 −0
Original line number Diff line number Diff line
@@ -159,6 +159,11 @@ static int nft_rt_validate(const struct nft_ctx *ctx, const struct nft_expr *exp 
	const struct nft_rt *priv = nft_expr_priv(expr);

	unsigned int hooks;



	if (ctx->family != NFPROTO_IPV4 &&

	    ctx->family != NFPROTO_IPV6 &&

	    ctx->family != NFPROTO_INET)

		return -EOPNOTSUPP;



	switch (priv->key) {

	case NFT_RT_NEXTHOP4:

	case NFT_RT_NEXTHOP6:

net/netfilter/nft_socket.c

+5 −0
Original line number Diff line number Diff line
@@ -139,6 +139,11 @@ static int nft_socket_validate(const struct nft_ctx *ctx, 
			       const struct nft_expr *expr,

			       const struct nft_data **data)

{

	if (ctx->family != NFPROTO_IPV4 &&

	    ctx->family != NFPROTO_IPV6 &&

	    ctx->family != NFPROTO_INET)

		return -EOPNOTSUPP;



	return nft_chain_validate_hooks(ctx->chain,

					(1 << NF_INET_PRE_ROUTING) |

					(1 << NF_INET_LOCAL_IN) |