netfilter-devel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 10/47] netfilter: x_tables: enforce unique and ascending entry points
@ 2018-03-30 11:38 Pablo Neira Ayuso
  2018-03-30 11:38 ` [PATCH 11/47] netfilter: x_tables: cap allocations at 512 mbyte Pablo Neira Ayuso
                   ` (8 more replies)
  0 siblings, 9 replies; 10+ messages in thread
From: Pablo Neira Ayuso @ 2018-03-30 11:38 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

From: Florian Westphal <fw@strlen.de>

Harmless from kernel point of view, but iptables assumes that this is
true when decoding a ruleset.

iptables walks the dumped blob from kernel, and, for each entry that
creates a new chain it prints out rule/chain information.
Base chains (hook entry points) are thus only shown when they appear
in the rule blob.  One base chain that is referenced multiple times
in hook blob is then only printed once.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/x_tables.c | 31 ++++++++++++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 5d8ba89a8da8..4e6cbb38e616 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -529,10 +529,15 @@ static int xt_check_entry_match(const char *match, const char *target,
  */
 int xt_check_table_hooks(const struct xt_table_info *info, unsigned int valid_hooks)
 {
-	unsigned int i;
+	const char *err = "unsorted underflow";
+	unsigned int i, max_uflow, max_entry;
+	bool check_hooks = false;
 
 	BUILD_BUG_ON(ARRAY_SIZE(info->hook_entry) != ARRAY_SIZE(info->underflow));
 
+	max_entry = 0;
+	max_uflow = 0;
+
 	for (i = 0; i < ARRAY_SIZE(info->hook_entry); i++) {
 		if (!(valid_hooks & (1 << i)))
 			continue;
@@ -541,9 +546,33 @@ int xt_check_table_hooks(const struct xt_table_info *info, unsigned int valid_ho
 			return -EINVAL;
 		if (info->underflow[i] == 0xFFFFFFFF)
 			return -EINVAL;
+
+		if (check_hooks) {
+			if (max_uflow > info->underflow[i])
+				goto error;
+
+			if (max_uflow == info->underflow[i]) {
+				err = "duplicate underflow";
+				goto error;
+			}
+			if (max_entry > info->hook_entry[i]) {
+				err = "unsorted entry";
+				goto error;
+			}
+			if (max_entry == info->hook_entry[i]) {
+				err = "duplicate entry";
+				goto error;
+			}
+		}
+		max_entry = info->hook_entry[i];
+		max_uflow = info->underflow[i];
+		check_hooks = true;
 	}
 
 	return 0;
+error:
+	pr_err_ratelimited("%s at hook %d\n", err, i);
+	return -EINVAL;
 }
 EXPORT_SYMBOL(xt_check_table_hooks);
 
-- 
2.11.0

^ permalink raw reply related	[flat|nested] 10+ messages in thread
end of thread, other threads:[~2018-03-30 11:38 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-03-30 11:38 [PATCH 10/47] netfilter: x_tables: enforce unique and ascending entry points Pablo Neira Ayuso
2018-03-30 11:38 ` [PATCH 11/47] netfilter: x_tables: cap allocations at 512 mbyte Pablo Neira Ayuso
2018-03-30 11:38 ` [PATCH 12/47] netfilter: x_tables: limit allocation requests for blob rule heads Pablo Neira Ayuso
2018-03-30 11:38 ` [PATCH 13/47] netfilter: x_tables: add counters allocation wrapper Pablo Neira Ayuso
2018-03-30 11:38 ` [PATCH 14/47] netfilter: compat: prepare xt_compat_init_offsets to return errors Pablo Neira Ayuso
2018-03-30 11:38 ` [PATCH 15/47] netfilter: compat: reject huge allocation requests Pablo Neira Ayuso
2018-03-30 11:38 ` [PATCH 16/47] netfilter: x_tables: make sure compat af mutex is held Pablo Neira Ayuso
2018-03-30 11:38 ` [PATCH 17/47] netfilter: x_tables: ensure last rule in base chain matches underflow/policy Pablo Neira Ayuso
2018-03-30 11:38 ` [PATCH 18/47] netfilter: make xt_rateest hash table per net Pablo Neira Ayuso
2018-03-30 11:38 ` [PATCH 19/47] netfilter: xt_limit: Spelling s/maxmum/maximum/ Pablo Neira Ayuso

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).