Commit f323ef3a authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: disallow jump to implicit chain from set element 



Extend struct nft_data_desc to add a flag field that specifies
nft_data_init() is being called for set element data.

Use it to disallow jump to implicit chain from set element, only jump
to chain via immediate expression is allowed.

Fixes: d0e2c7de ("netfilter: nf_tables: add NFT_CHAIN_BINDING")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 341b6941

include/net/netfilter/nf_tables.h

+5 −0
Original line number Diff line number Diff line
@@ -221,10 +221,15 @@ struct nft_ctx { 
	bool				report;

};



enum nft_data_desc_flags {

	NFT_DATA_DESC_SETELEM	= (1 << 0),

};



struct nft_data_desc {

	enum nft_data_types		type;

	unsigned int			size;

	unsigned int			len;

	unsigned int			flags;

};



int nft_data_init(const struct nft_ctx *ctx, struct nft_data *data,

net/netfilter/nf_tables_api.c

+4 −0
Original line number Diff line number Diff line
@@ -5226,6 +5226,7 @@ static int nft_setelem_parse_data(struct nft_ctx *ctx, struct nft_set *set, 
	desc->type = dtype;

	desc->size = NFT_DATA_VALUE_MAXLEN;

	desc->len = set->dlen;

	desc->flags = NFT_DATA_DESC_SETELEM;



	return nft_data_init(ctx, data, desc, attr);

}
@@ -9665,6 +9666,9 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, 
			return PTR_ERR(chain);

		if (nft_is_base_chain(chain))

			return -EOPNOTSUPP;

		if (desc->flags & NFT_DATA_DESC_SETELEM &&

		    chain->flags & NFT_CHAIN_BINDING)

			return -EINVAL;



		chain->use++;

		data->verdict.chain = chain;