Commit 4b80ced9 authored by Florian Westphal's avatar Florian Westphal
Browse files

netfilter: nf_tables: validate all pending tables 



We have to validate all tables in the transaction that are in
VALIDATE_DO state, the blamed commit below did not move the break
statement to its right location so we only validate one table.

Moreover, we can't init table->validate to _SKIP when a table object
is allocated.

If we do, then if a transcaction creates a new table and then
fails the transaction, nfnetlink will loop and nft will hang until
user cancels the command.

Add back the pernet state as a place to stash the last state encountered.
This is either _DO (we hit an error during commit validation) or _SKIP
(transaction passed all checks).

Fixes: 00c320f9 ("netfilter: nf_tables: make validation state per table")
Reported-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
parent bfedba3b

include/net/netfilter/nf_tables.h

+1 −0
Original line number Diff line number Diff line
@@ -1729,6 +1729,7 @@ struct nftables_pernet { 
	u64			table_handle;

	unsigned int		base_seq;

	unsigned int		gc_seq;

	u8			validate_state;

};



extern unsigned int nf_tables_net_id;

net/netfilter/nf_tables_api.c

+7 −4
Original line number Diff line number Diff line
@@ -1373,7 +1373,7 @@ static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info, 
	if (table == NULL)

		goto err_kzalloc;



	table->validate_state = NFT_VALIDATE_SKIP;

	table->validate_state = nft_net->validate_state;

	table->name = nla_strdup(attr, GFP_KERNEL_ACCOUNT);

	if (table->name == NULL)

		goto err_strdup;
@@ -9051,10 +9051,9 @@ static int nf_tables_validate(struct net *net) 
				return -EAGAIN;



			nft_validate_state_update(table, NFT_VALIDATE_SKIP);

		}



			break;

		}

	}



	return 0;

}
@@ -9799,8 +9798,10 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) 
	}



	/* 0. Validate ruleset, otherwise roll back for error reporting. */

	if (nf_tables_validate(net) < 0)

	if (nf_tables_validate(net) < 0) {

		nft_net->validate_state = NFT_VALIDATE_DO;

		return -EAGAIN;

	}



	err = nft_flow_rule_offload_commit(net);

	if (err < 0)
@@ -10059,6 +10060,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) 
	nf_tables_commit_audit_log(&adl, nft_net->base_seq);



	nft_gc_seq_end(nft_net, gc_seq);

	nft_net->validate_state = NFT_VALIDATE_SKIP;

	nf_tables_commit_release(net);



	return 0;
@@ -11115,6 +11117,7 @@ static int __net_init nf_tables_init_net(struct net *net) 
	mutex_init(&nft_net->commit_mutex);

	nft_net->base_seq = 1;

	nft_net->gc_seq = 0;

	nft_net->validate_state = NFT_VALIDATE_SKIP;



	return 0;

}