Unverified Commit 1a78fe97 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!4021 netfilter: nf_tables: Reject tables of unsupported family 

Merge Pull Request from: @ci-robot 
 
PR sync from: Liu Jian <liujian56@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/BEMUK2ISDDJICJTNFZTEUWOBMGAIVN2Q/ 
 
https://gitee.com/src-openeuler/kernel/issues/I8VPKT 
 
Link:https://gitee.com/openeuler/kernel/pulls/4021

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents b57fe44e e8cafee5

net/netfilter/nf_tables_api.c

+27 −0
Original line number Diff line number Diff line
@@ -853,6 +853,30 @@ static int nft_chain_hash_cmp(struct rhashtable_compare_arg *arg, 
	return strcmp(chain->name, name);

}



static bool nft_supported_family(u8 family)

{

	return false

#ifdef CONFIG_NF_TABLES_INET

		|| family == NFPROTO_INET

#endif

#ifdef CONFIG_NF_TABLES_IPV4

		|| family == NFPROTO_IPV4

#endif

#ifdef CONFIG_NF_TABLES_ARP

		|| family == NFPROTO_ARP

#endif

#ifdef CONFIG_NF_TABLES_NETDEV

		|| family == NFPROTO_NETDEV

#endif

#if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE)

		|| family == NFPROTO_BRIDGE

#endif

#ifdef CONFIG_NF_TABLES_IPV6

		|| family == NFPROTO_IPV6

#endif

		;

}



static int nf_tables_newtable(struct net *net, struct sock *nlsk,

			      struct sk_buff *skb, const struct nlmsghdr *nlh,

			      const struct nlattr * const nla[],
@@ -867,6 +891,9 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk, 
	struct nft_ctx ctx;

	int err;



	if (!nft_supported_family(family))

		return -EOPNOTSUPP;



	lockdep_assert_held(&net->nft.commit_mutex);

	attr = nla[NFTA_TABLE_NAME];

	table = nft_table_lookup(net, attr, family, genmask);