Commit f15f29fd authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: disallow rule removal from chain binding 



Chain binding only requires the rule addition/insertion command within
the same transaction. Removal of rules from chain bindings within the
same transaction makes no sense, userspace does not utilize this
feature. Replace nft_chain_is_bound() check to nft_chain_binding() in
rule deletion commands. Replace command implies a rule deletion, reject
this command too.

Rule flush command can also safely rely on this nft_chain_binding()
check because unbound chains are not allowed since 62e1e94b
("netfilter: nf_tables: reject unbound chain set before commit phase").

Fixes: d0e2c7de ("netfilter: nf_tables: add NFT_CHAIN_BINDING")
Reported-by: default avatarKevin Rich <kevinrich1337@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 1b36955c

net/netfilter/nf_tables_api.c

+13 −5
Original line number Diff line number Diff line
@@ -1432,7 +1432,7 @@ static int nft_flush_table(struct nft_ctx *ctx) 
		if (!nft_is_active_next(ctx->net, chain))

			continue;



		if (nft_chain_is_bound(chain))

		if (nft_chain_binding(chain))

			continue;



		ctx->chain = chain;
@@ -1477,7 +1477,7 @@ static int nft_flush_table(struct nft_ctx *ctx) 
		if (!nft_is_active_next(ctx->net, chain))

			continue;



		if (nft_chain_is_bound(chain))

		if (nft_chain_binding(chain))

			continue;



		ctx->chain = chain;
@@ -2910,6 +2910,9 @@ static int nf_tables_delchain(struct sk_buff *skb, const struct nfnl_info *info, 
		return PTR_ERR(chain);

	}



	if (nft_chain_binding(chain))

		return -EOPNOTSUPP;



	nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla);



	if (nla[NFTA_CHAIN_HOOK]) {
@@ -3971,6 +3974,11 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info, 
	}



	if (info->nlh->nlmsg_flags & NLM_F_REPLACE) {

		if (nft_chain_binding(chain)) {

			err = -EOPNOTSUPP;

			goto err_destroy_flow_rule;

		}



		err = nft_delrule(&ctx, old_rule);

		if (err < 0)

			goto err_destroy_flow_rule;
@@ -4078,7 +4086,7 @@ static int nf_tables_delrule(struct sk_buff *skb, const struct nfnl_info *info, 
			NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);

			return PTR_ERR(chain);

		}

		if (nft_chain_is_bound(chain))

		if (nft_chain_binding(chain))

			return -EOPNOTSUPP;

	}
@@ -4112,7 +4120,7 @@ static int nf_tables_delrule(struct sk_buff *skb, const struct nfnl_info *info, 
		list_for_each_entry(chain, &table->chains, list) {

			if (!nft_is_active_next(net, chain))

				continue;

			if (nft_chain_is_bound(chain))

			if (nft_chain_binding(chain))

				continue;



			ctx.chain = chain;
@@ -11054,7 +11062,7 @@ static void __nft_release_table(struct net *net, struct nft_table *table) 
	ctx.family = table->family;

	ctx.table = table;

	list_for_each_entry(chain, &table->chains, list) {

		if (nft_chain_is_bound(chain))

		if (nft_chain_binding(chain))

			continue;



		ctx.chain = chain;