From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 11/23] netfilter: nf_tables: split chain policy validation from actually setting it
Date: Fri, 10 Jan 2014 01:35:30 +0100 [thread overview]
Message-ID: <1389314142-17969-12-git-send-email-pablo@netfilter.org> (raw)
In-Reply-To: <1389314142-17969-1-git-send-email-pablo@netfilter.org>
From: Patrick McHardy <kaber@trash.net>
Currently nf_tables_newchain() atomicity is broken because of having
validation of some netlink attributes performed after changing attributes
of the chain. The chain policy is (currently) fine, but split it up as
preparation for the following fixes and to avoid future mistakes.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 56 +++++++++++++++--------------------------
1 file changed, 20 insertions(+), 36 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 572d88d..30fad4f 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -760,22 +760,6 @@ err:
return err;
}
-static int
-nf_tables_chain_policy(struct nft_base_chain *chain, const struct nlattr *attr)
-{
- switch (ntohl(nla_get_be32(attr))) {
- case NF_DROP:
- chain->policy = NF_DROP;
- break;
- case NF_ACCEPT:
- chain->policy = NF_ACCEPT;
- break;
- default:
- return -EINVAL;
- }
- return 0;
-}
-
static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
[NFTA_COUNTER_PACKETS] = { .type = NLA_U64 },
[NFTA_COUNTER_BYTES] = { .type = NLA_U64 },
@@ -834,6 +818,7 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
struct nlattr *ha[NFTA_HOOK_MAX + 1];
struct net *net = sock_net(skb->sk);
int family = nfmsg->nfgen_family;
+ u8 policy = NF_ACCEPT;
u64 handle = 0;
unsigned int i;
int err;
@@ -869,6 +854,22 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
}
}
+ if (nla[NFTA_CHAIN_POLICY]) {
+ if ((chain != NULL &&
+ !(chain->flags & NFT_BASE_CHAIN)) ||
+ nla[NFTA_CHAIN_HOOK] == NULL)
+ return -EOPNOTSUPP;
+
+ policy = nla_get_be32(nla[NFTA_CHAIN_POLICY]);
+ switch (policy) {
+ case NF_DROP:
+ case NF_ACCEPT:
+ break;
+ default:
+ return -EINVAL;
+ }
+ }
+
if (chain != NULL) {
if (nlh->nlmsg_flags & NLM_F_EXCL)
return -EEXIST;
@@ -879,15 +880,8 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
!IS_ERR(nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME])))
return -EEXIST;
- if (nla[NFTA_CHAIN_POLICY]) {
- if (!(chain->flags & NFT_BASE_CHAIN))
- return -EOPNOTSUPP;
-
- err = nf_tables_chain_policy(nft_base_chain(chain),
- nla[NFTA_CHAIN_POLICY]);
- if (err < 0)
- return err;
- }
+ if (nla[NFTA_CHAIN_POLICY])
+ nft_base_chain(chain)->policy = policy;
if (nla[NFTA_CHAIN_COUNTERS]) {
if (!(chain->flags & NFT_BASE_CHAIN))
@@ -958,17 +952,7 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
}
chain->flags |= NFT_BASE_CHAIN;
-
- if (nla[NFTA_CHAIN_POLICY]) {
- err = nf_tables_chain_policy(basechain,
- nla[NFTA_CHAIN_POLICY]);
- if (err < 0) {
- free_percpu(basechain->stats);
- kfree(basechain);
- return err;
- }
- } else
- basechain->policy = NF_ACCEPT;
+ basechain->policy = policy;
if (nla[NFTA_CHAIN_COUNTERS]) {
err = nf_tables_counters(basechain,
--
1.7.10.4
next prev parent reply other threads:[~2014-01-10 0:35 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-01-10 0:35 [PATCH 00/23] nf_tables updates for net-next Pablo Neira Ayuso
2014-01-10 0:35 ` [PATCH 01/23] netfilter: nft_reject: fix compilation warning if NF_TABLES_IPV6 is disabled Pablo Neira Ayuso
2014-01-10 20:33 ` Sergei Shtylyov
2014-01-10 19:39 ` David Miller
2014-01-10 0:35 ` [PATCH 02/23] netfilter: nf_tables: make chain types override the default AF functions Pablo Neira Ayuso
2014-01-10 0:35 ` [PATCH 03/23] netfilter: nf_tables: add hook ops to struct nft_pktinfo Pablo Neira Ayuso
2014-01-10 0:35 ` [PATCH 04/23] netfilter: nf_tables: add support for multi family tables Pablo Neira Ayuso
2014-01-10 0:35 ` [PATCH 05/23] netfilter: nf_tables: add "inet" table for IPv4/IPv6 Pablo Neira Ayuso
2014-01-10 0:35 ` [PATCH 06/23] netfilter: nf_tables: add nfproto support to meta expression Pablo Neira Ayuso
2014-01-10 0:35 ` [PATCH 07/23] netfilter: nft_meta: add l4proto support Pablo Neira Ayuso
2014-01-10 0:35 ` [PATCH 08/23] netfilter: nft_ct: load both IPv4 and IPv6 conntrack modules for NFPROTO_INET Pablo Neira Ayuso
2014-01-10 20:40 ` Sergei Shtylyov
2014-01-10 19:42 ` Patrick McHardy
2014-01-10 19:48 ` David Miller
2014-01-10 19:59 ` Patrick McHardy
2014-01-10 0:35 ` [PATCH 09/23] netfilter: nft_ct: Add support to set the connmark Pablo Neira Ayuso
2014-01-10 0:35 ` [PATCH 10/23] netfilter: nft_meta: fix lack of validation of the input register Pablo Neira Ayuso
2014-01-10 0:35 ` Pablo Neira Ayuso [this message]
2014-01-10 0:35 ` [PATCH 12/23] netfilter: nf_tables: restore chain change atomicity Pablo Neira Ayuso
2014-01-10 0:35 ` [PATCH 13/23] netfilter: nf_tables: fix check for table overflow Pablo Neira Ayuso
2014-01-10 0:35 ` [PATCH 14/23] netfilter: nf_tables: fix chain type module reference handling Pablo Neira Ayuso
2014-01-10 0:35 ` [PATCH 15/23] netfilter: nf_tables: add missing module references to chain types Pablo Neira Ayuso
2014-01-10 0:35 ` [PATCH 16/23] netfilter: nf_tables: replay request after dropping locks to load chain type Pablo Neira Ayuso
2014-01-10 0:35 ` [PATCH 17/23] netfilter: nf_tables: constify chain type definitions and pointers Pablo Neira Ayuso
2014-01-10 0:35 ` [PATCH 18/23] netfilter: nf_tables: minor nf_chain_type cleanups Pablo Neira Ayuso
2014-01-10 0:35 ` [PATCH 19/23] netfilter: nf_tables: perform flags validation before table allocation Pablo Neira Ayuso
2014-01-10 0:35 ` [PATCH 20/23] netfilter: nf_tables: take AF module reference when creating a table Pablo Neira Ayuso
2014-01-10 0:35 ` [PATCH 21/23] netfilter: nf_tables: prohibit deletion of a table with existing sets Pablo Neira Ayuso
2014-01-10 0:35 ` [PATCH 22/23] netfilter: nf_tables: rename nft_do_chain_pktinfo() to nft_do_chain() Pablo Neira Ayuso
2014-01-10 0:35 ` [PATCH 23/23] netfilter: nf_tables: fix error path in the init functions Pablo Neira Ayuso
2014-01-10 2:36 ` [PATCH 00/23] nf_tables updates for net-next David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1389314142-17969-12-git-send-email-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).