Commit 5c819a39 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nft_nat: insufficient attribute validation 



We have to validate that we at least get an NFTA_NAT_REG_ADDR_MIN or
NFTA_NFT_REG_PROTO_MIN attribute. Reject the configuration if none
of them are present.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent f3f5dded

net/netfilter/nft_nat.c

+3 −1
Original line number Diff line number Diff line
@@ -99,7 +99,9 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr, 
	if (err < 0)

		return err;



	if (tb[NFTA_NAT_TYPE] == NULL)

	if (tb[NFTA_NAT_TYPE] == NULL ||

	    (tb[NFTA_NAT_REG_ADDR_MIN] == NULL &&

	     tb[NFTA_NAT_REG_PROTO_MIN] == NULL))

		return -EINVAL;



	switch (ntohl(nla_get_be32(tb[NFTA_NAT_TYPE]))) {