Commit 100a11b6 authored by Florian Westphal's avatar Florian Westphal
Browse files

netfilter: nf_tables: use NLA_POLICY_MASK to test for valid flag options 



nf_tables relies on manual test of netlink attributes coming from userspace
even in cases where this could be handled via netlink policy.

Convert a bunch of 'flag' attributes to use NLA_POLICY_MASK checks.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
parent 5fac9b7c

net/netfilter/nft_fib.c

+7 −6
Original line number Diff line number Diff line
@@ -14,17 +14,18 @@ 
#include <net/netfilter/nf_tables.h>

#include <net/netfilter/nft_fib.h>



#define NFTA_FIB_F_ALL (NFTA_FIB_F_SADDR | NFTA_FIB_F_DADDR | \

			NFTA_FIB_F_MARK | NFTA_FIB_F_IIF | NFTA_FIB_F_OIF | \

			NFTA_FIB_F_PRESENT)



const struct nla_policy nft_fib_policy[NFTA_FIB_MAX + 1] = {

	[NFTA_FIB_DREG]		= { .type = NLA_U32 },

	[NFTA_FIB_RESULT]	= { .type = NLA_U32 },

	[NFTA_FIB_FLAGS]	= { .type = NLA_U32 },

	[NFTA_FIB_FLAGS]	=

		NLA_POLICY_MASK(NLA_BE32, NFTA_FIB_F_ALL),

};

EXPORT_SYMBOL(nft_fib_policy);



#define NFTA_FIB_F_ALL (NFTA_FIB_F_SADDR | NFTA_FIB_F_DADDR | \

			NFTA_FIB_F_MARK | NFTA_FIB_F_IIF | NFTA_FIB_F_OIF | \

			NFTA_FIB_F_PRESENT)



int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr,

		     const struct nft_data **data)

{
@@ -77,7 +78,7 @@ int nft_fib_init(const struct nft_ctx *ctx, const struct nft_expr *expr, 


	priv->flags = ntohl(nla_get_be32(tb[NFTA_FIB_FLAGS]));



	if (priv->flags == 0 || (priv->flags & ~NFTA_FIB_F_ALL))

	if (priv->flags == 0)

		return -EINVAL;



	if ((priv->flags & (NFTA_FIB_F_SADDR | NFTA_FIB_F_DADDR)) ==

net/netfilter/nft_lookup.c

+2 −4
Original line number Diff line number Diff line
@@ -90,7 +90,8 @@ static const struct nla_policy nft_lookup_policy[NFTA_LOOKUP_MAX + 1] = { 
	[NFTA_LOOKUP_SET_ID]	= { .type = NLA_U32 },

	[NFTA_LOOKUP_SREG]	= { .type = NLA_U32 },

	[NFTA_LOOKUP_DREG]	= { .type = NLA_U32 },

	[NFTA_LOOKUP_FLAGS]	= { .type = NLA_U32 },

	[NFTA_LOOKUP_FLAGS]	=

		NLA_POLICY_MASK(NLA_BE32, NFT_LOOKUP_F_INV),

};



static int nft_lookup_init(const struct nft_ctx *ctx,
@@ -120,9 +121,6 @@ static int nft_lookup_init(const struct nft_ctx *ctx, 
	if (tb[NFTA_LOOKUP_FLAGS]) {

		flags = ntohl(nla_get_be32(tb[NFTA_LOOKUP_FLAGS]));



		if (flags & ~NFT_LOOKUP_F_INV)

			return -EINVAL;



		if (flags & NFT_LOOKUP_F_INV)

			priv->invert = true;

	}

net/netfilter/nft_masq.c

+3 −5
Original line number Diff line number Diff line
@@ -20,7 +20,8 @@ struct nft_masq { 
};



static const struct nla_policy nft_masq_policy[NFTA_MASQ_MAX + 1] = {

	[NFTA_MASQ_FLAGS]		= { .type = NLA_U32 },

	[NFTA_MASQ_FLAGS]		=

		NLA_POLICY_MASK(NLA_BE32, NF_NAT_RANGE_MASK),

	[NFTA_MASQ_REG_PROTO_MIN]	= { .type = NLA_U32 },

	[NFTA_MASQ_REG_PROTO_MAX]	= { .type = NLA_U32 },

};
@@ -47,11 +48,8 @@ static int nft_masq_init(const struct nft_ctx *ctx, 
	struct nft_masq *priv = nft_expr_priv(expr);

	int err;



	if (tb[NFTA_MASQ_FLAGS]) {

	if (tb[NFTA_MASQ_FLAGS])

		priv->flags = ntohl(nla_get_be32(tb[NFTA_MASQ_FLAGS]));

		if (priv->flags & ~NF_NAT_RANGE_MASK)

			return -EINVAL;

	}



	if (tb[NFTA_MASQ_REG_PROTO_MIN]) {

		err = nft_parse_register_load(tb[NFTA_MASQ_REG_PROTO_MIN],

net/netfilter/nft_nat.c

+3 −5
Original line number Diff line number Diff line
@@ -132,7 +132,8 @@ static const struct nla_policy nft_nat_policy[NFTA_NAT_MAX + 1] = { 
	[NFTA_NAT_REG_ADDR_MAX]	 = { .type = NLA_U32 },

	[NFTA_NAT_REG_PROTO_MIN] = { .type = NLA_U32 },

	[NFTA_NAT_REG_PROTO_MAX] = { .type = NLA_U32 },

	[NFTA_NAT_FLAGS]	 = { .type = NLA_U32 },

	[NFTA_NAT_FLAGS]	 =

		NLA_POLICY_MASK(NLA_BE32, NF_NAT_RANGE_MASK),

};



static int nft_nat_validate(const struct nft_ctx *ctx,
@@ -246,11 +247,8 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr, 
		priv->flags |= NF_NAT_RANGE_PROTO_SPECIFIED;

	}



	if (tb[NFTA_NAT_FLAGS]) {

	if (tb[NFTA_NAT_FLAGS])

		priv->flags |= ntohl(nla_get_be32(tb[NFTA_NAT_FLAGS]));

		if (priv->flags & ~NF_NAT_RANGE_MASK)

			return -EOPNOTSUPP;

	}



	return nf_ct_netns_get(ctx->net, family);

}

net/netfilter/nft_redir.c

+3 −5
Original line number Diff line number Diff line
@@ -22,7 +22,8 @@ struct nft_redir { 
static const struct nla_policy nft_redir_policy[NFTA_REDIR_MAX + 1] = {

	[NFTA_REDIR_REG_PROTO_MIN]	= { .type = NLA_U32 },

	[NFTA_REDIR_REG_PROTO_MAX]	= { .type = NLA_U32 },

	[NFTA_REDIR_FLAGS]		= { .type = NLA_U32 },

	[NFTA_REDIR_FLAGS]		=

		NLA_POLICY_MASK(NLA_BE32, NF_NAT_RANGE_MASK),

};



static int nft_redir_validate(const struct nft_ctx *ctx,
@@ -68,11 +69,8 @@ static int nft_redir_init(const struct nft_ctx *ctx, 
		priv->flags |= NF_NAT_RANGE_PROTO_SPECIFIED;

	}



	if (tb[NFTA_REDIR_FLAGS]) {

	if (tb[NFTA_REDIR_FLAGS])

		priv->flags = ntohl(nla_get_be32(tb[NFTA_REDIR_FLAGS]));

		if (priv->flags & ~NF_NAT_RANGE_MASK)

			return -EINVAL;

	}



	return nf_ct_netns_get(ctx->net, ctx->family);

}