lkml.org 
[lkml]   [2022]   [Aug]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 108/779] netfilter: nf_tables: do not allow RULE_ID to refer to another chain
    Date
    From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>

    commit 36d5b2913219ac853908b0f1c664345e04313856 upstream.

    When doing lookups for rules on the same batch by using its ID, a rule from
    a different chain can be used. If a rule is added to a chain but tries to
    be positioned next to a rule from a different chain, it will be linked to
    chain2, but the use counter on chain1 would be the one to be incremented.

    When looking for rules by ID, use the chain that was used for the lookup by
    name. The chain used in the context copied to the transaction needs to
    match that same chain. That way, struct nft_rule does not need to get
    enlarged with another member.

    Fixes: 1a94e38d254b ("netfilter: nf_tables: add NFTA_RULE_ID attribute")
    Fixes: 75dd48e2e420 ("netfilter: nf_tables: Support RULE_ID reference in new rule")
    Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/netfilter/nf_tables_api.c | 7 +++++--
    1 file changed, 5 insertions(+), 2 deletions(-)

    --- a/net/netfilter/nf_tables_api.c
    +++ b/net/netfilter/nf_tables_api.c
    @@ -3276,6 +3276,7 @@ static int nft_table_validate(struct net
    }

    static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
    + const struct nft_chain *chain,
    const struct nlattr *nla);

    #define NFT_RULE_MAXEXPRS 128
    @@ -3364,7 +3365,7 @@ static int nf_tables_newrule(struct sk_b
    return PTR_ERR(old_rule);
    }
    } else if (nla[NFTA_RULE_POSITION_ID]) {
    - old_rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_POSITION_ID]);
    + old_rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_POSITION_ID]);
    if (IS_ERR(old_rule)) {
    NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION_ID]);
    return PTR_ERR(old_rule);
    @@ -3509,6 +3510,7 @@ err_release_expr:
    }

    static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
    + const struct nft_chain *chain,
    const struct nlattr *nla)
    {
    struct nftables_pernet *nft_net = nft_pernet(net);
    @@ -3519,6 +3521,7 @@ static struct nft_rule *nft_rule_lookup_
    struct nft_rule *rule = nft_trans_rule(trans);

    if (trans->msg_type == NFT_MSG_NEWRULE &&
    + trans->ctx.chain == chain &&
    id == nft_trans_rule_id(trans))
    return rule;
    }
    @@ -3568,7 +3571,7 @@ static int nf_tables_delrule(struct sk_b

    err = nft_delrule(&ctx, rule);
    } else if (nla[NFTA_RULE_ID]) {
    - rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]);
    + rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_ID]);
    if (IS_ERR(rule)) {
    NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]);
    return PTR_ERR(rule);

    \
     
     \ /
      Last update: 2022-08-15 20:28    [W:4.151 / U:0.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site