Commit 2f81814d authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by Ziyang Xuan
Browse files

netfilter: nf_tables: disallow rule removal from chain binding 

mainline inclusion
from mainline-v6.6-rc3
commit f15f29fd
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I84NFY
CVE: CVE-2023-5197

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f15f29fd4779be8a418b66e9d52979bb6d6c2325



---------------------------

Chain binding only requires the rule addition/insertion command within
the same transaction. Removal of rules from chain bindings within the
same transaction makes no sense, userspace does not utilize this
feature. Replace nft_chain_is_bound() check to nft_chain_binding() in
rule deletion commands. Replace command implies a rule deletion, reject
this command too.

Rule flush command can also safely rely on this nft_chain_binding()
check because unbound chains are not allowed since 62e1e94b
("netfilter: nf_tables: reject unbound chain set before commit phase").

Fixes: d0e2c7de ("netfilter: nf_tables: add NFT_CHAIN_BINDING")
Reported-by: default avatarKevin Rich <kevinrich1337@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Conflicts:
	net/netfilter/nf_tables_api.c
Signed-off-by: default avatarZiyang Xuan <william.xuanziyang@huawei.com>
parent e427a81b

net/netfilter/nf_tables_api.c

+15 −4
Original line number Diff line number Diff line
@@ -1250,7 +1250,7 @@ static int nft_flush_table(struct nft_ctx *ctx) 
		if (!nft_is_active_next(ctx->net, chain))

			continue;



		if (nft_chain_is_bound(chain))

		if (nft_chain_binding(chain))

			continue;



		ctx->chain = chain;
@@ -1295,7 +1295,7 @@ static int nft_flush_table(struct nft_ctx *ctx) 
		if (!nft_is_active_next(ctx->net, chain))

			continue;



		if (nft_chain_is_bound(chain))

		if (nft_chain_binding(chain))

			continue;



		ctx->chain = chain;
@@ -2579,6 +2579,9 @@ static int nf_tables_delchain(struct net *net, struct sock *nlsk, 
		return PTR_ERR(chain);

	}



	if (nft_chain_binding(chain))

		return -EOPNOTSUPP;



	if (nlh->nlmsg_flags & NLM_F_NONREC &&

	    chain->use > 0)

		return -EBUSY;
@@ -3474,6 +3477,11 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk, 
	}



	if (nlh->nlmsg_flags & NLM_F_REPLACE) {

		if (nft_chain_binding(chain)) {

			err = -EOPNOTSUPP;

			goto err2;

		}



		trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);

		if (trans == NULL) {

			err = -ENOMEM;
@@ -3580,7 +3588,7 @@ static int nf_tables_delrule(struct net *net, struct sock *nlsk, 
			NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);

			return PTR_ERR(chain);

		}

		if (nft_chain_is_bound(chain))

		if (nft_chain_binding(chain))

			return -EOPNOTSUPP;

	}
@@ -3610,7 +3618,7 @@ static int nf_tables_delrule(struct net *net, struct sock *nlsk, 
		list_for_each_entry(chain, &table->chains, list) {

			if (!nft_is_active_next(net, chain))

				continue;

			if (nft_chain_is_bound(chain))

			if (nft_chain_binding(chain))

				continue;



			ctx.chain = chain;
@@ -9194,6 +9202,9 @@ static void __nft_release_table(struct net *net, struct nft_table *table) 
	ctx.family = table->family;

	ctx.table = table;

	list_for_each_entry(chain, &table->chains, list) {

		if (nft_chain_binding(chain))

			continue;



		ctx.chain = chain;

		list_for_each_entry_safe(rule, nr, &chain->rules, list) {

			list_del(&rule->list);