From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Jakub Kicinski <kuba@kernel.org>,
Pablo Neira Ayuso <pablo@netfilter.org>
Subject: [PATCH 4.19 81/89] netfilter: nft_tunnel: add missing attribute validation for tunnels
Date: Tue, 17 Mar 2020 11:55:30 +0100 [thread overview]
Message-ID: <20200317103309.406869995@linuxfoundation.org> (raw)
In-Reply-To: <20200317103259.744774526@linuxfoundation.org>
From: Jakub Kicinski <kuba@kernel.org>
commit 88a637719a1570705c02cacb3297af164b1714e7 upstream.
Add missing attribute validation for tunnel source and
destination ports to the netlink policy.
Fixes: af308b94a2a4 ("netfilter: nf_tables: add tunnel support")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nft_tunnel.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/netfilter/nft_tunnel.c
+++ b/net/netfilter/nft_tunnel.c
@@ -308,6 +308,8 @@ static const struct nla_policy nft_tunne
[NFTA_TUNNEL_KEY_FLAGS] = { .type = NLA_U32, },
[NFTA_TUNNEL_KEY_TOS] = { .type = NLA_U8, },
[NFTA_TUNNEL_KEY_TTL] = { .type = NLA_U8, },
+ [NFTA_TUNNEL_KEY_SPORT] = { .type = NLA_U16, },
+ [NFTA_TUNNEL_KEY_DPORT] = { .type = NLA_U16, },
[NFTA_TUNNEL_KEY_OPTS] = { .type = NLA_NESTED, },
};
next prev parent reply other threads:[~2020-03-17 10:59 UTC|newest]
Thread overview: 97+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-17 10:54 [PATCH 4.19 00/89] 4.19.111-rc1 review Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 01/89] phy: Revert toggling reset changes Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 02/89] net: phy: Avoid multiple suspends Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 03/89] cgroup, netclassid: periodically release file_lock on classid updating Greg Kroah-Hartman
2020-03-18 9:02 ` Pavel Machek
2020-03-18 10:01 ` Konstantin Khlebnikov
2020-03-17 10:54 ` [PATCH 4.19 04/89] gre: fix uninit-value in __iptunnel_pull_header Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 05/89] inet_diag: return classid for all socket types Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 06/89] ipv6/addrconf: call ipv6_mc_up() for non-Ethernet interface Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 07/89] ipvlan: add cond_resched_rcu() while processing muticast backlog Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 08/89] ipvlan: do not add hardware address of master to its unicast filter list Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 09/89] ipvlan: do not use cond_resched_rcu() in ipvlan_process_multicast() Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 10/89] ipvlan: dont deref eth hdr before checking its set Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 11/89] net/ipv6: use configured metric when add peer route Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 12/89] netlink: Use netlink header as base to calculate bad attribute offset Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 13/89] net: macsec: update SCI upon MAC address change Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 14/89] net: nfc: fix bounds checking bugs on "pipe" Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 15/89] net/packet: tpacket_rcv: do not increment ring index on drop Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 16/89] net: stmmac: dwmac1000: Disable ACS if enhanced descs are not used Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 17/89] net: systemport: fix index check to avoid an array out of bounds access Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 18/89] r8152: check disconnect status after long sleep Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 19/89] sfc: detach from cb_page in efx_copy_channel() Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 20/89] bnxt_en: reinitialize IRQs when MTU is modified Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 21/89] cgroup: memcg: net: do not associate sock with unrelated cgroup Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 22/89] net: memcg: late association of sock to memcg Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 23/89] net: memcg: fix lockdep splat in inet_csk_accept() Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 24/89] devlink: validate length of param values Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 25/89] fib: add missing attribute validation for tun_id Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 26/89] nl802154: add missing attribute validation Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 27/89] nl802154: add missing attribute validation for dev_type Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 28/89] can: add missing attribute validation for termination Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 29/89] macsec: add missing attribute validation for port Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 30/89] net: fq: add missing attribute validation for orphan mask Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 31/89] team: add missing attribute validation for port ifindex Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 32/89] team: add missing attribute validation for array index Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 33/89] nfc: add missing attribute validation for SE API Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 34/89] nfc: add missing attribute validation for deactivate target Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 35/89] nfc: add missing attribute validation for vendor subcommand Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 36/89] net: phy: fix MDIO bus PM PHY resuming Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 37/89] selftests/net/fib_tests: update addr_metric_test for peer route testing Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 38/89] net/ipv6: need update peer route when modify metric Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 39/89] net/ipv6: remove the old peer route if change it to a new one Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 40/89] tipc: add missing attribute validation for MTU property Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 41/89] devlink: validate length of region addr/len Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 42/89] bonding/alb: make sure arp header is pulled before accessing it Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 43/89] slip: make slhc_compress() more robust against malicious packets Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 44/89] net: fec: validate the new settings in fec_enet_set_coalesce() Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 45/89] macvlan: add cond_resched() during multicast processing Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 46/89] cgroup: cgroup_procs_next should increase position index Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 47/89] cgroup: Iterate tasks that did not finish do_exit() Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 48/89] iwlwifi: mvm: Do not require PHY_SKU NVM section for 3168 devices Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 49/89] virtio-blk: fix hw_queue stopped on arbitrary error Greg Kroah-Hartman
2020-03-17 10:54 ` [PATCH 4.19 50/89] iommu/vt-d: quirk_ioat_snb_local_iommu: replace WARN_TAINT with pr_warn + add_taint Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 51/89] netfilter: nf_conntrack: ct_cpu_seq_next should increase position index Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 52/89] netfilter: synproxy: synproxy_cpu_seq_next " Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 53/89] netfilter: xt_recent: recent_seq_next " Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 54/89] netfilter: x_tables: xt_mttg_seq_next " Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 55/89] workqueue: dont use wq_select_unbound_cpu() for bound works Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 56/89] drm/amd/display: remove duplicated assignment to grph_obj_type Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 57/89] ktest: Add timeout for ssh sync testing Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 58/89] cifs_atomic_open(): fix double-put on late allocation failure Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 59/89] gfs2_atomic_open(): fix O_EXCL|O_CREAT handling on cold dcache Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 60/89] KVM: x86: clear stale x86_emulate_ctxt->intercept value Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 61/89] ARC: define __ALIGN_STR and __ALIGN symbols for ARC Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 62/89] macintosh: windfarm: fix MODINFO regression Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 63/89] efi: Fix a race and a buffer overflow while reading efivars via sysfs Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 64/89] efi: Make efi_rts_work accessible to efi page fault handler Greg Kroah-Hartman
2020-03-19 9:42 ` Chris Wilson
2020-03-19 10:04 ` Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 65/89] mt76: fix array overflow on receiving too many fragments for a packet Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 66/89] x86/mce: Fix logic and comments around MSR_PPIN_CTL Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 67/89] iommu/dma: Fix MSI reservation allocation Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 68/89] iommu/vt-d: dmar: replace WARN_TAINT with pr_warn + add_taint Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 69/89] iommu/vt-d: Fix a bug in intel_iommu_iova_to_phys() for huge page Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 70/89] batman-adv: Dont schedule OGM for disabled interface Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 71/89] pinctrl: meson-gxl: fix GPIOX sdio pins Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 72/89] pinctrl: core: Remove extra kref_get which blocks hogs being freed Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 73/89] drm/i915/gvt: Fix unnecessary schedule timer when no vGPU exits Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 74/89] i2c: gpio: suppress error on probe defer Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 75/89] nl80211: add missing attribute validation for critical protocol indication Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 76/89] nl80211: add missing attribute validation for beacon report scanning Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 77/89] nl80211: add missing attribute validation for channel switch Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 78/89] perf bench futex-wake: Restore thread count default to online CPU count Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 79/89] netfilter: cthelper: add missing attribute validation for cthelper Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 80/89] netfilter: nft_payload: add missing attribute validation for payload csum flags Greg Kroah-Hartman
2020-03-17 10:55 ` Greg Kroah-Hartman [this message]
2020-03-17 10:55 ` [PATCH 4.19 82/89] iommu/vt-d: Fix the wrong printing in RHSA parsing Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 83/89] iommu/vt-d: Ignore devices with out-of-spec domain number Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 84/89] i2c: acpi: put device when verifying client fails Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 85/89] ipv6: restrict IPV6_ADDRFORM operation Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 86/89] net/smc: check for valid ib_client_data Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 87/89] net/smc: cancel event worker during device removal Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 88/89] efi: Add a sanity check to efivar_store_raw() Greg Kroah-Hartman
2020-03-17 10:55 ` [PATCH 4.19 89/89] batman-adv: Avoid free/alloc race when handling OGM2 buffer Greg Kroah-Hartman
2020-03-17 20:16 ` [PATCH 4.19 00/89] 4.19.111-rc1 review Guenter Roeck
2020-03-17 20:26 ` Naresh Kamboju
2020-03-18 0:08 ` shuah
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200317103309.406869995@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).