From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 5/6] netfilter: nfnetlink: relax strict multicast group check from netlink_bind
Date: Sat, 10 Jan 2015 19:50:07 +0100 [thread overview]
Message-ID: <1420915808-7160-6-git-send-email-pablo@netfilter.org> (raw)
In-Reply-To: <1420915808-7160-1-git-send-email-pablo@netfilter.org>
Relax the checking that was introduced in 97840cb ("netfilter:
nfnetlink: fix insufficient validation in nfnetlink_bind") when the
subscription bitmask is used. Existing userspace code code may request
to listen to all of the existing netlink groups by setting an all to one
subscription group bitmask. Netlink already validates subscription via
setsockopt() for us.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nfnetlink.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index c6619d4..1aa7049 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -470,7 +470,7 @@ static int nfnetlink_bind(int group)
int type;
if (group <= NFNLGRP_NONE || group > NFNLGRP_MAX)
- return -EINVAL;
+ return 0;
type = nfnl_group2type[group];
--
1.7.10.4
next prev parent reply other threads:[~2015-01-10 18:50 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-01-10 18:50 [PATCH 0/6] netfilter/ipvs fixes for net Pablo Neira Ayuso
2015-01-10 18:50 ` [PATCH 1/6] ipvs: uninitialized data with IP_VS_IPV6 Pablo Neira Ayuso
2015-01-10 18:50 ` [PATCH 2/6] netfilter: nf_tables: fix port natting in little endian archs Pablo Neira Ayuso
2015-01-10 18:50 ` [PATCH 3/6] netfilter: conntrack: fix race between confirmation and flush Pablo Neira Ayuso
2015-01-10 18:50 ` [PATCH 4/6] netfilter: nfnetlink: validate nfnetlink header from batch Pablo Neira Ayuso
2015-01-10 18:50 ` Pablo Neira Ayuso [this message]
2015-01-10 18:50 ` [PATCH 6/6] netfilter: nf_tables: fix flush ruleset chain dependencies Pablo Neira Ayuso
2015-01-12 5:15 ` [PATCH 0/6] netfilter/ipvs fixes for net David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1420915808-7160-6-git-send-email-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).