Commit d46fc894 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: validate catch-all set elements 



catch-all set element might jump/goto to chain that uses expressions
that require validation.

Fixes: aaa31047 ("netfilter: nftables: add catch-all set element support")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent c55c0e91

include/net/netfilter/nf_tables.h

+4 −0
Original line number Diff line number Diff line
@@ -1085,6 +1085,10 @@ struct nft_chain { 
};



int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain);

int nft_setelem_validate(const struct nft_ctx *ctx, struct nft_set *set,

			 const struct nft_set_iter *iter,

			 struct nft_set_elem *elem);

int nft_set_catchall_validate(const struct nft_ctx *ctx, struct nft_set *set);



enum nft_chain_types {

	NFT_CHAIN_T_DEFAULT = 0,

net/netfilter/nf_tables_api.c

+58 −6
Original line number Diff line number Diff line
@@ -3447,6 +3447,64 @@ static int nft_table_validate(struct net *net, const struct nft_table *table) 
	return 0;

}



int nft_setelem_validate(const struct nft_ctx *ctx, struct nft_set *set,

			 const struct nft_set_iter *iter,

			 struct nft_set_elem *elem)

{

	const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);

	struct nft_ctx *pctx = (struct nft_ctx *)ctx;

	const struct nft_data *data;

	int err;



	if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&

	    *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)

		return 0;



	data = nft_set_ext_data(ext);

	switch (data->verdict.code) {

	case NFT_JUMP:

	case NFT_GOTO:

		pctx->level++;

		err = nft_chain_validate(ctx, data->verdict.chain);

		if (err < 0)

			return err;

		pctx->level--;

		break;

	default:

		break;

	}



	return 0;

}



struct nft_set_elem_catchall {

	struct list_head	list;

	struct rcu_head		rcu;

	void			*elem;

};



int nft_set_catchall_validate(const struct nft_ctx *ctx, struct nft_set *set)

{

	u8 genmask = nft_genmask_next(ctx->net);

	struct nft_set_elem_catchall *catchall;

	struct nft_set_elem elem;

	struct nft_set_ext *ext;

	int ret = 0;



	list_for_each_entry_rcu(catchall, &set->catchall_list, list) {

		ext = nft_set_elem_ext(set, catchall->elem);

		if (!nft_set_elem_active(ext, genmask))

			continue;



		elem.priv = catchall->elem;

		ret = nft_setelem_validate(ctx, set, NULL, &elem);

		if (ret < 0)

			return ret;

	}



	return ret;

}



static struct nft_rule *nft_rule_lookup_byid(const struct net *net,

					     const struct nft_chain *chain,

					     const struct nlattr *nla);
@@ -4759,12 +4817,6 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info, 
	return err;

}



struct nft_set_elem_catchall {

	struct list_head	list;

	struct rcu_head		rcu;

	void			*elem;

};



static void nft_set_catchall_destroy(const struct nft_ctx *ctx,

				     struct nft_set *set)

{

net/netfilter/nft_lookup.c

+4 −32
Original line number Diff line number Diff line
@@ -199,37 +199,6 @@ static int nft_lookup_dump(struct sk_buff *skb, 
	return -1;

}



static int nft_lookup_validate_setelem(const struct nft_ctx *ctx,

				       struct nft_set *set,

				       const struct nft_set_iter *iter,

				       struct nft_set_elem *elem)

{

	const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);

	struct nft_ctx *pctx = (struct nft_ctx *)ctx;

	const struct nft_data *data;

	int err;



	if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&

	    *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)

		return 0;



	data = nft_set_ext_data(ext);

	switch (data->verdict.code) {

	case NFT_JUMP:

	case NFT_GOTO:

		pctx->level++;

		err = nft_chain_validate(ctx, data->verdict.chain);

		if (err < 0)

			return err;

		pctx->level--;

		break;

	default:

		break;

	}



	return 0;

}



static int nft_lookup_validate(const struct nft_ctx *ctx,

			       const struct nft_expr *expr,

			       const struct nft_data **d)
@@ -245,9 +214,12 @@ static int nft_lookup_validate(const struct nft_ctx *ctx, 
	iter.skip	= 0;

	iter.count	= 0;

	iter.err	= 0;

	iter.fn		= nft_lookup_validate_setelem;

	iter.fn		= nft_setelem_validate;



	priv->set->ops->walk(ctx, priv->set, &iter);

	if (!iter.err)

		iter.err = nft_set_catchall_validate(ctx, priv->set);



	if (iter.err < 0)

		return iter.err;