lkml.org 
[lkml]   [2018]   [Nov]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 050/118] netfilter: nft_compat: ebtables nat table is normal chain type
    Date
    4.19-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    [ Upstream commit e4844c9c62a0fe47980d6c3d4b7a096a5d755925 ]

    Unlike ip(6)tables, the ebtables nat table has no special properties.
    This bug causes 'ebtables -A' to fail when using a target such as
    'snat' (ebt_snat target sets ".table = "nat"'). Targets that have
    no table restrictions work fine.

    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/netfilter/nft_compat.c | 21 ++++++++++++---------
    1 file changed, 12 insertions(+), 9 deletions(-)

    diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
    index 32535eea51b2..ad2fe6a7e47d 100644
    --- a/net/netfilter/nft_compat.c
    +++ b/net/netfilter/nft_compat.c
    @@ -54,9 +54,11 @@ static bool nft_xt_put(struct nft_xt *xt)
    return false;
    }

    -static int nft_compat_chain_validate_dependency(const char *tablename,
    - const struct nft_chain *chain)
    +static int nft_compat_chain_validate_dependency(const struct nft_ctx *ctx,
    + const char *tablename)
    {
    + enum nft_chain_types type = NFT_CHAIN_T_DEFAULT;
    + const struct nft_chain *chain = ctx->chain;
    const struct nft_base_chain *basechain;

    if (!tablename ||
    @@ -64,9 +66,12 @@ static int nft_compat_chain_validate_dependency(const char *tablename,
    return 0;

    basechain = nft_base_chain(chain);
    - if (strcmp(tablename, "nat") == 0 &&
    - basechain->type->type != NFT_CHAIN_T_NAT)
    - return -EINVAL;
    + if (strcmp(tablename, "nat") == 0) {
    + if (ctx->family != NFPROTO_BRIDGE)
    + type = NFT_CHAIN_T_NAT;
    + if (basechain->type->type != type)
    + return -EINVAL;
    + }

    return 0;
    }
    @@ -323,8 +328,7 @@ static int nft_target_validate(const struct nft_ctx *ctx,
    if (target->hooks && !(hook_mask & target->hooks))
    return -EINVAL;

    - ret = nft_compat_chain_validate_dependency(target->table,
    - ctx->chain);
    + ret = nft_compat_chain_validate_dependency(ctx, target->table);
    if (ret < 0)
    return ret;
    }
    @@ -570,8 +574,7 @@ static int nft_match_validate(const struct nft_ctx *ctx,
    if (match->hooks && !(hook_mask & match->hooks))
    return -EINVAL;

    - ret = nft_compat_chain_validate_dependency(match->table,
    - ctx->chain);
    + ret = nft_compat_chain_validate_dependency(ctx, match->table);
    if (ret < 0)
    return ret;
    }
    --
    2.17.1


    \
     
     \ /
      Last update: 2018-11-26 12:11    [W:6.966 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site