aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2014-11-10 14:53:55 -0500
committerPablo Neira Ayuso <pablo@netfilter.org>2014-11-12 06:06:24 -0500
commitc918687f5e3962375a19de6ded3c1be85ebdbcd6 (patch)
treebdfa4bde1a777c9a71eb45dbeb5de9344e39149a /net
parent2daf1b4d18e3add229d1a3b5c554331d99ac6c7e (diff)
netfilter: nft_compat: relax chain type validation
Check for nat chain dependency only, which is the one that can actually crash the kernel. Don't care if mangle, filter and security specific match and targets are used out of their scope, they are harmless. This restores iptables-compat with mangle specific match/target when used out of the OUTPUT chain, that are actually emulated through filter chains, which broke when performing strict validation. Fixes: f3f5dde ("netfilter: nft_compat: validate chain type in match/target") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
-rw-r--r--net/netfilter/nft_compat.c32
1 files changed, 2 insertions, 30 deletions
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index b92f129beade..70dc96516305 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -21,45 +21,17 @@
21#include <linux/netfilter_ipv6/ip6_tables.h> 21#include <linux/netfilter_ipv6/ip6_tables.h>
22#include <net/netfilter/nf_tables.h> 22#include <net/netfilter/nf_tables.h>
23 23
24static const struct {
25 const char *name;
26 u8 type;
27} table_to_chaintype[] = {
28 { "filter", NFT_CHAIN_T_DEFAULT },
29 { "raw", NFT_CHAIN_T_DEFAULT },
30 { "security", NFT_CHAIN_T_DEFAULT },
31 { "mangle", NFT_CHAIN_T_ROUTE },
32 { "nat", NFT_CHAIN_T_NAT },
33 { },
34};
35
36static int nft_compat_table_to_chaintype(const char *table)
37{
38 int i;
39
40 for (i = 0; table_to_chaintype[i].name != NULL; i++) {
41 if (strcmp(table_to_chaintype[i].name, table) == 0)
42 return table_to_chaintype[i].type;
43 }
44
45 return -1;
46}
47
48static int nft_compat_chain_validate_dependency(const char *tablename, 24static int nft_compat_chain_validate_dependency(const char *tablename,
49 const struct nft_chain *chain) 25 const struct nft_chain *chain)
50{ 26{
51 enum nft_chain_type type;
52 const struct nft_base_chain *basechain; 27 const struct nft_base_chain *basechain;
53 28
54 if (!tablename || !(chain->flags & NFT_BASE_CHAIN)) 29 if (!tablename || !(chain->flags & NFT_BASE_CHAIN))
55 return 0; 30 return 0;
56 31
57 type = nft_compat_table_to_chaintype(tablename);
58 if (type < 0)
59 return -EINVAL;
60
61 basechain = nft_base_chain(chain); 32 basechain = nft_base_chain(chain);
62 if (basechain->type->type != type) 33 if (strcmp(tablename, "nat") == 0 &&
34 basechain->type->type != NFT_CHAIN_T_NAT)
63 return -EINVAL; 35 return -EINVAL;
64 36
65 return 0; 37 return 0;