From: Patrick McHardy <kaber@trash.net>
To: pablo@netfilter.org
Cc: netfilter-devel@vger.kernel.org
Subject: [PATCH 01/13] netfilter: nf_tables: split chain policy validation from actually setting it
Date: Thu, 9 Jan 2014 18:42:31 +0000 [thread overview]
Message-ID: <1389292963-4089-2-git-send-email-kaber@trash.net> (raw)
In-Reply-To: <1389292963-4089-1-git-send-email-kaber@trash.net>
Currently nf_tables_newchain() atomicity is broken because of having
validation of some netlink attributes performed after changing attributes
of the chain. The chain policy is (currently) fine, but split it up as
preparation for the following fixes and to avoid future mistakes.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
net/netfilter/nf_tables_api.c | 56 ++++++++++++++++---------------------------
1 file changed, 20 insertions(+), 36 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 572d88d..30fad4f 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -760,22 +760,6 @@ err:
return err;
}
-static int
-nf_tables_chain_policy(struct nft_base_chain *chain, const struct nlattr *attr)
-{
- switch (ntohl(nla_get_be32(attr))) {
- case NF_DROP:
- chain->policy = NF_DROP;
- break;
- case NF_ACCEPT:
- chain->policy = NF_ACCEPT;
- break;
- default:
- return -EINVAL;
- }
- return 0;
-}
-
static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
[NFTA_COUNTER_PACKETS] = { .type = NLA_U64 },
[NFTA_COUNTER_BYTES] = { .type = NLA_U64 },
@@ -834,6 +818,7 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
struct nlattr *ha[NFTA_HOOK_MAX + 1];
struct net *net = sock_net(skb->sk);
int family = nfmsg->nfgen_family;
+ u8 policy = NF_ACCEPT;
u64 handle = 0;
unsigned int i;
int err;
@@ -869,6 +854,22 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
}
}
+ if (nla[NFTA_CHAIN_POLICY]) {
+ if ((chain != NULL &&
+ !(chain->flags & NFT_BASE_CHAIN)) ||
+ nla[NFTA_CHAIN_HOOK] == NULL)
+ return -EOPNOTSUPP;
+
+ policy = nla_get_be32(nla[NFTA_CHAIN_POLICY]);
+ switch (policy) {
+ case NF_DROP:
+ case NF_ACCEPT:
+ break;
+ default:
+ return -EINVAL;
+ }
+ }
+
if (chain != NULL) {
if (nlh->nlmsg_flags & NLM_F_EXCL)
return -EEXIST;
@@ -879,15 +880,8 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
!IS_ERR(nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME])))
return -EEXIST;
- if (nla[NFTA_CHAIN_POLICY]) {
- if (!(chain->flags & NFT_BASE_CHAIN))
- return -EOPNOTSUPP;
-
- err = nf_tables_chain_policy(nft_base_chain(chain),
- nla[NFTA_CHAIN_POLICY]);
- if (err < 0)
- return err;
- }
+ if (nla[NFTA_CHAIN_POLICY])
+ nft_base_chain(chain)->policy = policy;
if (nla[NFTA_CHAIN_COUNTERS]) {
if (!(chain->flags & NFT_BASE_CHAIN))
@@ -958,17 +952,7 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
}
chain->flags |= NFT_BASE_CHAIN;
-
- if (nla[NFTA_CHAIN_POLICY]) {
- err = nf_tables_chain_policy(basechain,
- nla[NFTA_CHAIN_POLICY]);
- if (err < 0) {
- free_percpu(basechain->stats);
- kfree(basechain);
- return err;
- }
- } else
- basechain->policy = NF_ACCEPT;
+ basechain->policy = policy;
if (nla[NFTA_CHAIN_COUNTERS]) {
err = nf_tables_counters(basechain,
--
1.8.4.2
next prev parent reply other threads:[~2014-01-09 18:43 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-01-09 18:42 [PATCH 00/13] netfilter: nf_tables: bug fixes and minor cleanups Patrick McHardy
2014-01-09 18:42 ` Patrick McHardy [this message]
2014-01-09 18:42 ` [PATCH 02/13] netfilter: nf_tables: restore chain change atomicity Patrick McHardy
2014-01-09 18:42 ` [PATCH 03/13] netfilter: nf_tables: fix check for table overflow Patrick McHardy
2014-01-09 18:42 ` [PATCH 04/13] netfilter: nf_tables: fix chain type module reference handling Patrick McHardy
2014-01-09 18:42 ` [PATCH 05/13] netfilter: nf_tables: add missing module references to chain types Patrick McHardy
2014-01-09 18:42 ` [PATCH 06/13] netfilter: nf_tables: replay request after dropping locks to load chain type Patrick McHardy
2014-01-09 18:42 ` [PATCH 07/13] netfilter: nf_tables: constify chain type definitions and pointers Patrick McHardy
2014-01-09 18:42 ` [PATCH 08/13] netfilter: nf_tables: minor nf_chain_type cleanups Patrick McHardy
2014-01-09 18:42 ` [PATCH 09/13] netfilter: nf_tables: perform flags validation before table allocation Patrick McHardy
2014-01-09 18:42 ` [PATCH 10/13] netfilter: nf_tables: take AF module reference when creating a table Patrick McHardy
2014-01-09 18:42 ` [PATCH 11/13] netfilter: nf_tables: prohibit deletion of a table with existing sets Patrick McHardy
2014-01-09 18:42 ` [PATCH 12/13] netfilter: nf_tables: unininline nft_trace_packet() Patrick McHardy
2014-01-09 18:42 ` [PATCH 13/13] netfilter: nf_tables: rename nft_do_chain_pktinfo() to nft_do_chain() Patrick McHardy
2014-01-10 0:25 ` [PATCH 00/13] netfilter: nf_tables: bug fixes and minor cleanups Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1389292963-4089-2-git-send-email-kaber@trash.net \
--to=kaber@trash.net \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).