[PATCH -next] netfilter: nfnetlink: work around wrong endianess with old nft userspace

[PATCH -next] netfilter: nfnetlink: work around wrong endianess with old nft userspace

[Florian Westphal]

The nfgenmsg res_id is __be16.  Unfortunately nftables batch support uses
host byte order.

This adds a compat workaround for old nft userspace.

Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
---
 net/netfilter/nfnetlink.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index 0c0e8ec..2e255ad 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -276,18 +276,24 @@ enum {
 };
 
 static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
-				u_int16_t subsys_id)
+				__be16 __subsys_id)
 {
 	struct sk_buff *oskb = skb;
 	struct net *net = sock_net(skb->sk);
 	const struct nfnetlink_subsystem *ss;
 	const struct nfnl_callback *nc;
 	static LIST_HEAD(err_list);
+	u16 subsys_id = ntohs(__subsys_id);
 	u32 status;
 	int err;
 
-	if (subsys_id >= NFNL_SUBSYS_COUNT)
-		return netlink_ack(skb, nlh, -EINVAL);
+	if (subsys_id >= NFNL_SUBSYS_COUNT) {
+		/* Work around old nft using host byte order */
+		if (NFNL_SUBSYS_NFTABLES != (__force __u16) __subsys_id)
+			return netlink_ack(skb, nlh, -EINVAL);
+
+		subsys_id = (__force __u16) __subsys_id;
+	}
 replay:
 	status = 0;
 
-- 
2.0.5

Re: [PATCH -next] netfilter: nfnetlink: work around wrong endianess with old nft userspace

[Pablo Neira Ayuso]

[-- Attachment #1: Type: text/plain, Size: 274 bytes --]

On Fri, Aug 28, 2015 at 12:17:43AM +0200, Florian Westphal wrote:
> The nfgenmsg res_id is __be16.  Unfortunately nftables batch support uses
> host byte order.
> 
> This adds a compat workaround for old nft userspace.

Would you be also OK with the attached patch? Thanks.

[-- Attachment #2: 0001-netfilter-nfnetlink-work-around-wrong-endianess-in-r.patch --]
[-- Type: text/x-diff, Size: 1926 bytes --]

>From 97901f6e597987be7c9d9b1f6875004b4713e924 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 28 Aug 2015 19:17:46 +0200
Subject: [PATCH] netfilter: nfnetlink: work around wrong endianess in res_id
 field

The convention in nfnetlink is to use network byte order in every header field
as well as in the attribute payload. The initial version of the batching
infrastructure assumes that res_id comes in host byte order though.

The only client of the batching infrastructure is nf_tables, so let's add a
workaround to address this inconsistency. We currently have 11 nfnetlink
subsystems according to NFNL_SUBSYS_COUNT, so we can assume that the subsystem
2560, ie. htons(10), will not be allocated anytime soon, so it can be an alias
of nf_tables from the nfnetlink batching path when interpreting the res_id
field.

Based on original patch from Florian Westphal.

Reported-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nfnetlink.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index 0c0e8ec..70277b1 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -444,6 +444,7 @@ done:
 static void nfnetlink_rcv(struct sk_buff *skb)
 {
 	struct nlmsghdr *nlh = nlmsg_hdr(skb);
+	u_int16_t res_id;
 	int msglen;
 
 	if (nlh->nlmsg_len < NLMSG_HDRLEN ||
@@ -468,7 +469,12 @@ static void nfnetlink_rcv(struct sk_buff *skb)
 
 		nfgenmsg = nlmsg_data(nlh);
 		skb_pull(skb, msglen);
-		nfnetlink_rcv_batch(skb, nlh, nfgenmsg->res_id);
+		/* Work around old nft using host byte order */
+		if (nfgenmsg->res_id == NFNL_SUBSYS_NFTABLES)
+			res_id = NFNL_SUBSYS_NFTABLES;
+		else
+			res_id = ntohs(nfgenmsg->res_id);
+		nfnetlink_rcv_batch(skb, nlh, res_id);
 	} else {
 		netlink_rcv_skb(skb, &nfnetlink_rcv_msg);
 	}
-- 
1.7.10.4

Re: [PATCH -next] netfilter: nfnetlink: work around wrong endianess with old nft userspace

[Florian Westphal]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Fri, Aug 28, 2015 at 12:17:43AM +0200, Florian Westphal wrote:
> > The nfgenmsg res_id is __be16.  Unfortunately nftables batch support uses
> > host byte order.
> > 
> > This adds a compat workaround for old nft userspace.
> 
> Would you be also OK with the attached patch? Thanks.

Sure.