Skip to content

Commit a412dbf

Browse files
Florian Westphalummakynes
Florian Westphal
authored and
ummakynes
committed
netfilter: nf_tables: limit allowed range via nla_policy
These NLA_U32 types get stored in u8 fields, reject invalid values instead of silently casting to u8. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
1 parent 079cd63 commit a412dbf

15 files changed

Lines changed: 21 additions & 21 deletions

‎net/netfilter/nft_bitwise.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ static const struct nla_policy nft_bitwise_policy[NFTA_BITWISE_MAX + 1] = {
8686
[NFTA_BITWISE_LEN] = { .type = NLA_U32 },
8787
[NFTA_BITWISE_MASK] = { .type = NLA_NESTED },
8888
[NFTA_BITWISE_XOR] = { .type = NLA_NESTED },
89-
[NFTA_BITWISE_OP] = { .type = NLA_U32 },
89+
[NFTA_BITWISE_OP] = NLA_POLICY_MAX(NLA_BE32, 255),
9090
[NFTA_BITWISE_DATA] = { .type = NLA_NESTED },
9191
};
9292

‎net/netfilter/nft_byteorder.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -88,9 +88,9 @@ void nft_byteorder_eval(const struct nft_expr *expr,
8888
static const struct nla_policy nft_byteorder_policy[NFTA_BYTEORDER_MAX + 1] = {
8989
[NFTA_BYTEORDER_SREG] = { .type = NLA_U32 },
9090
[NFTA_BYTEORDER_DREG] = { .type = NLA_U32 },
91-
[NFTA_BYTEORDER_OP] = { .type = NLA_U32 },
92-
[NFTA_BYTEORDER_LEN] = { .type = NLA_U32 },
93-
[NFTA_BYTEORDER_SIZE] = { .type = NLA_U32 },
91+
[NFTA_BYTEORDER_OP] = NLA_POLICY_MAX(NLA_BE32, 255),
92+
[NFTA_BYTEORDER_LEN] = NLA_POLICY_MAX(NLA_BE32, 255),
93+
[NFTA_BYTEORDER_SIZE] = NLA_POLICY_MAX(NLA_BE32, 255),
9494
};
9595

9696
static int nft_byteorder_init(const struct nft_ctx *ctx,

‎net/netfilter/nft_ct.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -332,7 +332,7 @@ static void nft_ct_set_eval(const struct nft_expr *expr,
332332

333333
static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
334334
[NFTA_CT_DREG] = { .type = NLA_U32 },
335-
[NFTA_CT_KEY] = { .type = NLA_U32 },
335+
[NFTA_CT_KEY] = NLA_POLICY_MAX(NLA_BE32, 255),
336336
[NFTA_CT_DIRECTION] = { .type = NLA_U8 },
337337
[NFTA_CT_SREG] = { .type = NLA_U32 },
338338
};

‎net/netfilter/nft_dynset.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@ static const struct nla_policy nft_dynset_policy[NFTA_DYNSET_MAX + 1] = {
148148
[NFTA_DYNSET_SET_NAME] = { .type = NLA_STRING,
149149
.len = NFT_SET_MAXNAMELEN - 1 },
150150
[NFTA_DYNSET_SET_ID] = { .type = NLA_U32 },
151-
[NFTA_DYNSET_OP] = { .type = NLA_U32 },
151+
[NFTA_DYNSET_OP] = NLA_POLICY_MAX(NLA_BE32, 255),
152152
[NFTA_DYNSET_SREG_KEY] = { .type = NLA_U32 },
153153
[NFTA_DYNSET_SREG_DATA] = { .type = NLA_U32 },
154154
[NFTA_DYNSET_TIMEOUT] = { .type = NLA_U64 },

‎net/netfilter/nft_exthdr.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -487,9 +487,9 @@ static const struct nla_policy nft_exthdr_policy[NFTA_EXTHDR_MAX + 1] = {
487487
[NFTA_EXTHDR_DREG] = { .type = NLA_U32 },
488488
[NFTA_EXTHDR_TYPE] = { .type = NLA_U8 },
489489
[NFTA_EXTHDR_OFFSET] = { .type = NLA_U32 },
490-
[NFTA_EXTHDR_LEN] = { .type = NLA_U32 },
490+
[NFTA_EXTHDR_LEN] = NLA_POLICY_MAX(NLA_BE32, 255),
491491
[NFTA_EXTHDR_FLAGS] = { .type = NLA_U32 },
492-
[NFTA_EXTHDR_OP] = { .type = NLA_U32 },
492+
[NFTA_EXTHDR_OP] = NLA_POLICY_MAX(NLA_BE32, 255),
493493
[NFTA_EXTHDR_SREG] = { .type = NLA_U32 },
494494
};
495495

‎net/netfilter/nft_fwd_netdev.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ static void nft_fwd_netdev_eval(const struct nft_expr *expr,
4040
static const struct nla_policy nft_fwd_netdev_policy[NFTA_FWD_MAX + 1] = {
4141
[NFTA_FWD_SREG_DEV] = { .type = NLA_U32 },
4242
[NFTA_FWD_SREG_ADDR] = { .type = NLA_U32 },
43-
[NFTA_FWD_NFPROTO] = { .type = NLA_U32 },
43+
[NFTA_FWD_NFPROTO] = NLA_POLICY_MAX(NLA_BE32, 255),
4444
};
4545

4646
static int nft_fwd_netdev_init(const struct nft_ctx *ctx,

‎net/netfilter/nft_hash.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ static void nft_symhash_eval(const struct nft_expr *expr,
5959
static const struct nla_policy nft_hash_policy[NFTA_HASH_MAX + 1] = {
6060
[NFTA_HASH_SREG] = { .type = NLA_U32 },
6161
[NFTA_HASH_DREG] = { .type = NLA_U32 },
62-
[NFTA_HASH_LEN] = { .type = NLA_U32 },
62+
[NFTA_HASH_LEN] = NLA_POLICY_MAX(NLA_BE32, 255),
6363
[NFTA_HASH_MODULUS] = { .type = NLA_U32 },
6464
[NFTA_HASH_SEED] = { .type = NLA_U32 },
6565
[NFTA_HASH_OFFSET] = { .type = NLA_U32 },

‎net/netfilter/nft_meta.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -458,7 +458,7 @@ EXPORT_SYMBOL_GPL(nft_meta_set_eval);
458458

459459
const struct nla_policy nft_meta_policy[NFTA_META_MAX + 1] = {
460460
[NFTA_META_DREG] = { .type = NLA_U32 },
461-
[NFTA_META_KEY] = { .type = NLA_U32 },
461+
[NFTA_META_KEY] = NLA_POLICY_MAX(NLA_BE32, 255),
462462
[NFTA_META_SREG] = { .type = NLA_U32 },
463463
};
464464
EXPORT_SYMBOL_GPL(nft_meta_policy);

‎net/netfilter/nft_range.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ void nft_range_eval(const struct nft_expr *expr,
4242

4343
static const struct nla_policy nft_range_policy[NFTA_RANGE_MAX + 1] = {
4444
[NFTA_RANGE_SREG] = { .type = NLA_U32 },
45-
[NFTA_RANGE_OP] = { .type = NLA_U32 },
45+
[NFTA_RANGE_OP] = NLA_POLICY_MAX(NLA_BE32, 255),
4646
[NFTA_RANGE_FROM_DATA] = { .type = NLA_NESTED },
4747
[NFTA_RANGE_TO_DATA] = { .type = NLA_NESTED },
4848
};

‎net/netfilter/nft_reject.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
#include <linux/icmpv6.h>
1919

2020
const struct nla_policy nft_reject_policy[NFTA_REJECT_MAX + 1] = {
21-
[NFTA_REJECT_TYPE] = { .type = NLA_U32 },
21+
[NFTA_REJECT_TYPE] = NLA_POLICY_MAX(NLA_BE32, 255),
2222
[NFTA_REJECT_ICMP_CODE] = { .type = NLA_U8 },
2323
};
2424
EXPORT_SYMBOL_GPL(nft_reject_policy);

0 commit comments

Comments
 (0)