[PATCH nf,v2] netfilter: nf_tables: reject mismatching sum of field_len with set key length

[PATCH nf,v2] netfilter: nf_tables: reject mismatching sum of field_len with set key length

[Pablo Neira Ayuso]

The field length description provides the length of each separated key
field in the concatenation, each field gets rounded up to 32-bits to
calculate the pipapo rule width from pipapo_init(). The set key length
provides the total size of the key aligned to 32-bits.

Register-based arithmetics still allows for combining mismatching set
key length and field length description, eg. set key length 10 and field
description [ 5, 4 ] leading to pipapo width of 12.

Fixes: 3ce67e3793f4 ("netfilter: nf_tables: do not allow mismatch field size and set key length")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
v2: reject inconsistent input from nft_set_desc_concat() instead of pipapo_init()
    based on Florian's feedback.

 net/netfilter/nf_tables_api.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index c4af283356e7..e5662dc087c8 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -5065,7 +5065,7 @@ static int nft_set_desc_concat_parse(const struct nlattr *attr,
 static int nft_set_desc_concat(struct nft_set_desc *desc,
 			       const struct nlattr *nla)
 {
-	u32 num_regs = 0, key_num_regs = 0;
+	u32 len = 0, num_regs;
 	struct nlattr *attr;
 	int rem, err, i;
 
@@ -5079,12 +5079,12 @@ static int nft_set_desc_concat(struct nft_set_desc *desc,
 	}
 
 	for (i = 0; i < desc->field_count; i++)
-		num_regs += DIV_ROUND_UP(desc->field_len[i], sizeof(u32));
+		len += round_up(desc->field_len[i], sizeof(u32));
 
-	key_num_regs = DIV_ROUND_UP(desc->klen, sizeof(u32));
-	if (key_num_regs != num_regs)
+	if (len != desc->klen)
 		return -EINVAL;
 
+	num_regs = DIV_ROUND_UP(desc->klen, sizeof(u32));
 	if (num_regs > NFT_REG32_COUNT)
 		return -E2BIG;
 
-- 
2.30.2

Re: [PATCH nf,v2] netfilter: nf_tables: reject mismatching sum of field_len with set key length

[Florian Westphal]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> The field length description provides the length of each separated key
> field in the concatenation, each field gets rounded up to 32-bits to
> calculate the pipapo rule width from pipapo_init(). The set key length
> provides the total size of the key aligned to 32-bits.
> 
> Register-based arithmetics still allows for combining mismatching set
> key length and field length description, eg. set key length 10 and field
> description [ 5, 4 ] leading to pipapo width of 12.

Thanks for explaining, makes sense to me.

Reviewed-by: Florian Westphal <fw@strlen.de>