Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d214c753 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by David S. Miller
Browse files

filter: add SKF_AD_NLATTR_NEST to look for nested attributes 



SKF_AD_NLATTR allows us to find the first matching attribute in a
stream of netlink attributes from one offset to the end of the
netlink message. This is not suitable to look for a specific
matching inside a set of nested attributes.

For example, in ctnetlink messages, if we look for the CTA_V6_SRC
attribute in a message that talks about an IPv4 connection,
SKF_AD_NLATTR returns the offset of CTA_STATUS which has the same
value of CTA_V6_SRC but outside the nest. To differenciate
CTA_STATUS and CTA_V6_SRC, we would have to make assumptions on the
size of the attribute and the usual offset, resulting in horrible
BSF code.

This patch adds SKF_AD_NLATTR_NEST, which is a variant of
SKF_AD_NLATTR, that looks for an attribute inside the limits of
a nested attributes, but not further.

This patch validates that we have enough room to look for the
nested attributes - based on a suggestion from Patrick McHardy.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Acked-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 68fd9910

include/linux/filter.h

+2 −1
Original line number Diff line number Diff line
@@ -122,7 +122,8 @@ struct sock_fprog /* Required for SO_ATTACH_FILTER. */ 
#define SKF_AD_PKTTYPE 	4

#define SKF_AD_IFINDEX 	8

#define SKF_AD_NLATTR	12

#define SKF_AD_MAX 	16

#define SKF_AD_NLATTR_NEST	16

#define SKF_AD_MAX	20

#define SKF_NET_OFF   (-0x100000)

#define SKF_LL_OFF    (-0x200000)

net/core/filter.c

+19 −0
Original line number Diff line number Diff line
@@ -319,6 +319,25 @@ unsigned int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int 
				A = 0;

			continue;

		}

		case SKF_AD_NLATTR_NEST: {

			struct nlattr *nla;



			if (skb_is_nonlinear(skb))

				return 0;

			if (A > skb->len - sizeof(struct nlattr))

				return 0;



			nla = (struct nlattr *)&skb->data[A];

			if (nla->nla_len > A - skb->len)

				return 0;



			nla = nla_find_nested(nla, X);

			if (nla)

				A = (void *)nla - (void *)skb->data;

			else

				A = 0;

			continue;

		}

		default:

			return 0;

		}