History

netfilter: nf_tables: limit allowed range via nla_policy

These NLA_U32 types get stored in u8 fields, reject invalid values instead of silently casting to u8.

Florian Westphal committed 3 years ago

Commit a412dbf1 parent 079cd6315 files · +21 −21Browse files

Unified · Split

15 files
  1. net/netfilter/nft_bitwise.c +1 −1
  2. net/netfilter/nft_byteorder.c +3 −3
  3. net/netfilter/nft_ct.c +1 −1
  4. net/netfilter/nft_dynset.c +1 −1
  5. net/netfilter/nft_exthdr.c +2 −2
  6. net/netfilter/nft_fwd_netdev.c +1 −1
  7. net/netfilter/nft_hash.c +1 −1
  8. net/netfilter/nft_meta.c +1 −1
  9. net/netfilter/nft_range.c +1 −1
  10. net/netfilter/nft_reject.c +1 −1
  11. net/netfilter/nft_rt.c +1 −1
  12. net/netfilter/nft_socket.c +2 −2
  13. net/netfilter/nft_tproxy.c +1 −1
  14. net/netfilter/nft_tunnel.c +2 −2
  15. net/netfilter/nft_xfrm.c +2 −2
net/netfilter/nft_bitwise.c+1−1
@@ -86,7 +86,7 @@ static const struct nla_policy nft_bitwise_policy[NFTA_BITWISE_MAX + 1] = { · 85 unmodified lines
86 [NFTA_BITWISE_LEN] = { .type = NLA_U32 },86 [NFTA_BITWISE_LEN] = { .type = NLA_U32 },
87 [NFTA_BITWISE_MASK] = { .type = NLA_NESTED },87 [NFTA_BITWISE_MASK] = { .type = NLA_NESTED },
88 [NFTA_BITWISE_XOR] = { .type = NLA_NESTED },88 [NFTA_BITWISE_XOR] = { .type = NLA_NESTED },
89 [NFTA_BITWISE_OP] = { .type = NLA_U32 },89 [NFTA_BITWISE_OP] = NLA_POLICY_MAX(NLA_BE32, 255),
90 [NFTA_BITWISE_DATA] = { .type = NLA_NESTED },90 [NFTA_BITWISE_DATA] = { .type = NLA_NESTED },
91};91};
92 92
net/netfilter/nft_byteorder.c+3−3
@@ -88,9 +88,9 @@ void nft_byteorder_eval(const struct nft_expr *expr, · 87 unmodified lines
88static const struct nla_policy nft_byteorder_policy[NFTA_BYTEORDER_MAX + 1] = {88static const struct nla_policy nft_byteorder_policy[NFTA_BYTEORDER_MAX + 1] = {
89 [NFTA_BYTEORDER_SREG] = { .type = NLA_U32 },89 [NFTA_BYTEORDER_SREG] = { .type = NLA_U32 },
90 [NFTA_BYTEORDER_DREG] = { .type = NLA_U32 },90 [NFTA_BYTEORDER_DREG] = { .type = NLA_U32 },
91 [NFTA_BYTEORDER_OP] = { .type = NLA_U32 },91 [NFTA_BYTEORDER_OP] = NLA_POLICY_MAX(NLA_BE32, 255),
92 [NFTA_BYTEORDER_LEN] = { .type = NLA_U32 },92 [NFTA_BYTEORDER_LEN] = NLA_POLICY_MAX(NLA_BE32, 255),
93 [NFTA_BYTEORDER_SIZE] = { .type = NLA_U32 },93 [NFTA_BYTEORDER_SIZE] = NLA_POLICY_MAX(NLA_BE32, 255),
94};94};
95 95
96static int nft_byteorder_init(const struct nft_ctx *ctx,96static int nft_byteorder_init(const struct nft_ctx *ctx,
net/netfilter/nft_ct.c+1−1
@@ -332,7 +332,7 @@ static void nft_ct_set_eval(const struct nft_expr *expr, · 331 unmodified lines
332 332
333static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {333static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
334 [NFTA_CT_DREG] = { .type = NLA_U32 },334 [NFTA_CT_DREG] = { .type = NLA_U32 },
335 [NFTA_CT_KEY] = { .type = NLA_U32 },335 [NFTA_CT_KEY] = NLA_POLICY_MAX(NLA_BE32, 255),
336 [NFTA_CT_DIRECTION] = { .type = NLA_U8 },336 [NFTA_CT_DIRECTION] = { .type = NLA_U8 },
337 [NFTA_CT_SREG] = { .type = NLA_U32 },337 [NFTA_CT_SREG] = { .type = NLA_U32 },
338};338};
net/netfilter/nft_dynset.c+1−1
@@ -148,7 +148,7 @@ static const struct nla_policy nft_dynset_policy[NFTA_DYNSET_MAX + 1] = { · 147 unmodified lines
148 [NFTA_DYNSET_SET_NAME] = { .type = NLA_STRING,148 [NFTA_DYNSET_SET_NAME] = { .type = NLA_STRING,
149 .len = NFT_SET_MAXNAMELEN - 1 },149 .len = NFT_SET_MAXNAMELEN - 1 },
150 [NFTA_DYNSET_SET_ID] = { .type = NLA_U32 },150 [NFTA_DYNSET_SET_ID] = { .type = NLA_U32 },
151 [NFTA_DYNSET_OP] = { .type = NLA_U32 },151 [NFTA_DYNSET_OP] = NLA_POLICY_MAX(NLA_BE32, 255),
152 [NFTA_DYNSET_SREG_KEY] = { .type = NLA_U32 },152 [NFTA_DYNSET_SREG_KEY] = { .type = NLA_U32 },
153 [NFTA_DYNSET_SREG_DATA] = { .type = NLA_U32 },153 [NFTA_DYNSET_SREG_DATA] = { .type = NLA_U32 },
154 [NFTA_DYNSET_TIMEOUT] = { .type = NLA_U64 },154 [NFTA_DYNSET_TIMEOUT] = { .type = NLA_U64 },
net/netfilter/nft_exthdr.c+2−2
@@ -487,9 +487,9 @@ static const struct nla_policy nft_exthdr_policy[NFTA_EXTHDR_MAX + 1] = { · 486 unmodified lines
487 [NFTA_EXTHDR_DREG] = { .type = NLA_U32 },487 [NFTA_EXTHDR_DREG] = { .type = NLA_U32 },
488 [NFTA_EXTHDR_TYPE] = { .type = NLA_U8 },488 [NFTA_EXTHDR_TYPE] = { .type = NLA_U8 },
489 [NFTA_EXTHDR_OFFSET] = { .type = NLA_U32 },489 [NFTA_EXTHDR_OFFSET] = { .type = NLA_U32 },
490 [NFTA_EXTHDR_LEN] = { .type = NLA_U32 },490 [NFTA_EXTHDR_LEN] = NLA_POLICY_MAX(NLA_BE32, 255),
491 [NFTA_EXTHDR_FLAGS] = { .type = NLA_U32 },491 [NFTA_EXTHDR_FLAGS] = { .type = NLA_U32 },
492 [NFTA_EXTHDR_OP] = { .type = NLA_U32 },492 [NFTA_EXTHDR_OP] = NLA_POLICY_MAX(NLA_BE32, 255),
493 [NFTA_EXTHDR_SREG] = { .type = NLA_U32 },493 [NFTA_EXTHDR_SREG] = { .type = NLA_U32 },
494};494};
495 495
net/netfilter/nft_fwd_netdev.c+1−1
@@ -40,7 +40,7 @@ static void nft_fwd_netdev_eval(const struct nft_expr *expr, · 39 unmodified lines
40static const struct nla_policy nft_fwd_netdev_policy[NFTA_FWD_MAX + 1] = {40static const struct nla_policy nft_fwd_netdev_policy[NFTA_FWD_MAX + 1] = {
41 [NFTA_FWD_SREG_DEV] = { .type = NLA_U32 },41 [NFTA_FWD_SREG_DEV] = { .type = NLA_U32 },
42 [NFTA_FWD_SREG_ADDR] = { .type = NLA_U32 },42 [NFTA_FWD_SREG_ADDR] = { .type = NLA_U32 },
43 [NFTA_FWD_NFPROTO] = { .type = NLA_U32 },43 [NFTA_FWD_NFPROTO] = NLA_POLICY_MAX(NLA_BE32, 255),
44};44};
45 45
46static int nft_fwd_netdev_init(const struct nft_ctx *ctx,46static int nft_fwd_netdev_init(const struct nft_ctx *ctx,
net/netfilter/nft_hash.c+1−1
@@ -59,7 +59,7 @@ static void nft_symhash_eval(const struct nft_expr *expr, · 58 unmodified lines
59static const struct nla_policy nft_hash_policy[NFTA_HASH_MAX + 1] = {59static const struct nla_policy nft_hash_policy[NFTA_HASH_MAX + 1] = {
60 [NFTA_HASH_SREG] = { .type = NLA_U32 },60 [NFTA_HASH_SREG] = { .type = NLA_U32 },
61 [NFTA_HASH_DREG] = { .type = NLA_U32 },61 [NFTA_HASH_DREG] = { .type = NLA_U32 },
62 [NFTA_HASH_LEN] = { .type = NLA_U32 },62 [NFTA_HASH_LEN] = NLA_POLICY_MAX(NLA_BE32, 255),
63 [NFTA_HASH_MODULUS] = { .type = NLA_U32 },63 [NFTA_HASH_MODULUS] = { .type = NLA_U32 },
64 [NFTA_HASH_SEED] = { .type = NLA_U32 },64 [NFTA_HASH_SEED] = { .type = NLA_U32 },
65 [NFTA_HASH_OFFSET] = { .type = NLA_U32 },65 [NFTA_HASH_OFFSET] = { .type = NLA_U32 },
net/netfilter/nft_meta.c+1−1
@@ -458,7 +458,7 @@ EXPORT_SYMBOL_GPL(nft_meta_set_eval); · 457 unmodified lines
458 458
459const struct nla_policy nft_meta_policy[NFTA_META_MAX + 1] = {459const struct nla_policy nft_meta_policy[NFTA_META_MAX + 1] = {
460 [NFTA_META_DREG] = { .type = NLA_U32 },460 [NFTA_META_DREG] = { .type = NLA_U32 },
461 [NFTA_META_KEY] = { .type = NLA_U32 },461 [NFTA_META_KEY] = NLA_POLICY_MAX(NLA_BE32, 255),
462 [NFTA_META_SREG] = { .type = NLA_U32 },462 [NFTA_META_SREG] = { .type = NLA_U32 },
463};463};
464EXPORT_SYMBOL_GPL(nft_meta_policy);464EXPORT_SYMBOL_GPL(nft_meta_policy);
net/netfilter/nft_range.c+1−1
@@ -42,7 +42,7 @@ void nft_range_eval(const struct nft_expr *expr, · 41 unmodified lines
42 42
43static const struct nla_policy nft_range_policy[NFTA_RANGE_MAX + 1] = {43static const struct nla_policy nft_range_policy[NFTA_RANGE_MAX + 1] = {
44 [NFTA_RANGE_SREG] = { .type = NLA_U32 },44 [NFTA_RANGE_SREG] = { .type = NLA_U32 },
45 [NFTA_RANGE_OP] = { .type = NLA_U32 },45 [NFTA_RANGE_OP] = NLA_POLICY_MAX(NLA_BE32, 255),
46 [NFTA_RANGE_FROM_DATA] = { .type = NLA_NESTED },46 [NFTA_RANGE_FROM_DATA] = { .type = NLA_NESTED },
47 [NFTA_RANGE_TO_DATA] = { .type = NLA_NESTED },47 [NFTA_RANGE_TO_DATA] = { .type = NLA_NESTED },
48};48};
net/netfilter/nft_reject.c+1−1
@@ -18,7 +18,7 @@ · 17 unmodified lines
18#include <linux/icmpv6.h>18#include <linux/icmpv6.h>
19 19
20const struct nla_policy nft_reject_policy[NFTA_REJECT_MAX + 1] = {20const struct nla_policy nft_reject_policy[NFTA_REJECT_MAX + 1] = {
21 [NFTA_REJECT_TYPE] = { .type = NLA_U32 },21 [NFTA_REJECT_TYPE] = NLA_POLICY_MAX(NLA_BE32, 255),
22 [NFTA_REJECT_ICMP_CODE] = { .type = NLA_U8 },22 [NFTA_REJECT_ICMP_CODE] = { .type = NLA_U8 },
23};23};
24EXPORT_SYMBOL_GPL(nft_reject_policy);24EXPORT_SYMBOL_GPL(nft_reject_policy);
net/netfilter/nft_rt.c+1−1
@@ -104,7 +104,7 @@ err: · 103 unmodified lines
104 104
105static const struct nla_policy nft_rt_policy[NFTA_RT_MAX + 1] = {105static const struct nla_policy nft_rt_policy[NFTA_RT_MAX + 1] = {
106 [NFTA_RT_DREG] = { .type = NLA_U32 },106 [NFTA_RT_DREG] = { .type = NLA_U32 },
107 [NFTA_RT_KEY] = { .type = NLA_U32 },107 [NFTA_RT_KEY] = NLA_POLICY_MAX(NLA_BE32, 255),
108};108};
109 109
110static int nft_rt_get_init(const struct nft_ctx *ctx,110static int nft_rt_get_init(const struct nft_ctx *ctx,
net/netfilter/nft_socket.c+2−2
@@ -138,9 +138,9 @@ static void nft_socket_eval(const struct nft_expr *expr, · 137 unmodified lines
138}138}
139 139
140static const struct nla_policy nft_socket_policy[NFTA_SOCKET_MAX + 1] = {140static const struct nla_policy nft_socket_policy[NFTA_SOCKET_MAX + 1] = {
141 [NFTA_SOCKET_KEY] = { .type = NLA_U32 },141 [NFTA_SOCKET_KEY] = NLA_POLICY_MAX(NLA_BE32, 255),
142 [NFTA_SOCKET_DREG] = { .type = NLA_U32 },142 [NFTA_SOCKET_DREG] = { .type = NLA_U32 },
143 [NFTA_SOCKET_LEVEL] = { .type = NLA_U32 },143 [NFTA_SOCKET_LEVEL] = NLA_POLICY_MAX(NLA_BE32, 255),
144};144};
145 145
146static int nft_socket_init(const struct nft_ctx *ctx,146static int nft_socket_init(const struct nft_ctx *ctx,
net/netfilter/nft_tproxy.c+1−1
@@ -183,7 +183,7 @@ static void nft_tproxy_eval(const struct nft_expr *expr, · 182 unmodified lines
183}183}
184 184
185static const struct nla_policy nft_tproxy_policy[NFTA_TPROXY_MAX + 1] = {185static const struct nla_policy nft_tproxy_policy[NFTA_TPROXY_MAX + 1] = {
186 [NFTA_TPROXY_FAMILY] = { .type = NLA_U32 },186 [NFTA_TPROXY_FAMILY] = NLA_POLICY_MAX(NLA_BE32, 255),
187 [NFTA_TPROXY_REG_ADDR] = { .type = NLA_U32 },187 [NFTA_TPROXY_REG_ADDR] = { .type = NLA_U32 },
188 [NFTA_TPROXY_REG_PORT] = { .type = NLA_U32 },188 [NFTA_TPROXY_REG_PORT] = { .type = NLA_U32 },
189};189};
net/netfilter/nft_tunnel.c+2−2
@@ -66,9 +66,9 @@ static void nft_tunnel_get_eval(const struct nft_expr *expr, · 65 unmodified lines
66}66}
67 67
68static const struct nla_policy nft_tunnel_policy[NFTA_TUNNEL_MAX + 1] = {68static const struct nla_policy nft_tunnel_policy[NFTA_TUNNEL_MAX + 1] = {
69 [NFTA_TUNNEL_KEY] = { .type = NLA_U32 },69 [NFTA_TUNNEL_KEY] = NLA_POLICY_MAX(NLA_BE32, 255),
70 [NFTA_TUNNEL_DREG] = { .type = NLA_U32 },70 [NFTA_TUNNEL_DREG] = { .type = NLA_U32 },
71 [NFTA_TUNNEL_MODE] = { .type = NLA_U32 },71 [NFTA_TUNNEL_MODE] = NLA_POLICY_MAX(NLA_BE32, 255),
72};72};
73 73
74static int nft_tunnel_get_init(const struct nft_ctx *ctx,74static int nft_tunnel_get_init(const struct nft_ctx *ctx,
net/netfilter/nft_xfrm.c+2−2
@@ -16,9 +16,9 @@ · 15 unmodified lines
16#include <net/xfrm.h>16#include <net/xfrm.h>
17 17
18static const struct nla_policy nft_xfrm_policy[NFTA_XFRM_MAX + 1] = {18static const struct nla_policy nft_xfrm_policy[NFTA_XFRM_MAX + 1] = {
19 [NFTA_XFRM_KEY] = { .type = NLA_U32 },19 [NFTA_XFRM_KEY] = NLA_POLICY_MAX(NLA_BE32, 255),
20 [NFTA_XFRM_DIR] = { .type = NLA_U8 },20 [NFTA_XFRM_DIR] = { .type = NLA_U8 },
21 [NFTA_XFRM_SPNUM] = { .type = NLA_U32 },21 [NFTA_XFRM_SPNUM] = NLA_POLICY_MAX(NLA_BE32, 255),
22 [NFTA_XFRM_DREG] = { .type = NLA_U32 },22 [NFTA_XFRM_DREG] = { .type = NLA_U32 },
23};23};
24 24