public inbox for stable@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH 5.4.y] netfilter: nf_tables: Reject tables of unsupported family
@ 2024-01-12  1:54 Cengiz Can
  2024-01-12  1:54 ` [PATCH 5.10.y] " Cengiz Can
                   ` (2 more replies)
  0 siblings, 3 replies; 4+ messages in thread
From: Cengiz Can @ 2024-01-12  1:54 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: Phil Sutter, Pablo Neira Ayuso, Jozsef Kadlecsik,
	Florian Westphal, David S . Miller, stable

From: Phil Sutter <phil@nwl.cc>

commit f1082dd31fe461d482d69da2a8eccfeb7bf07ac2 upstream.

An nftables family is merely a hollow container, its family just a
number and such not reliant on compile-time options other than nftables
support itself. Add an artificial check so attempts at using a family
the kernel can't support fail as early as possible. This helps user
space detect kernels which lack e.g. NFPROTO_INET.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Cengiz Can <cengiz.can@canonical.com>
---
 net/netfilter/nf_tables_api.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 78be121f38ac..915df77161e1 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1005,6 +1005,30 @@ static int nft_objname_hash_cmp(struct rhashtable_compare_arg *arg,
 	return strcmp(obj->key.name, k->name);
 }
 
+static bool nft_supported_family(u8 family)
+{
+	return false
+#ifdef CONFIG_NF_TABLES_INET
+		|| family == NFPROTO_INET
+#endif
+#ifdef CONFIG_NF_TABLES_IPV4
+		|| family == NFPROTO_IPV4
+#endif
+#ifdef CONFIG_NF_TABLES_ARP
+		|| family == NFPROTO_ARP
+#endif
+#ifdef CONFIG_NF_TABLES_NETDEV
+		|| family == NFPROTO_NETDEV
+#endif
+#if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE)
+		|| family == NFPROTO_BRIDGE
+#endif
+#ifdef CONFIG_NF_TABLES_IPV6
+		|| family == NFPROTO_IPV6
+#endif
+		;
+}
+
 static int nf_tables_newtable(struct net *net, struct sock *nlsk,
 			      struct sk_buff *skb, const struct nlmsghdr *nlh,
 			      const struct nlattr * const nla[],
@@ -1020,6 +1044,9 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk,
 	struct nft_ctx ctx;
 	int err;
 
+	if (!nft_supported_family(family))
+		return -EOPNOTSUPP;
+
 	lockdep_assert_held(&nft_net->commit_mutex);
 	attr = nla[NFTA_TABLE_NAME];
 	table = nft_table_lookup(net, attr, family, genmask);
-- 
2.40.1


^ permalink raw reply related	[flat|nested] 4+ messages in thread

* [PATCH 5.10.y] netfilter: nf_tables: Reject tables of unsupported family
  2024-01-12  1:54 [PATCH 5.4.y] netfilter: nf_tables: Reject tables of unsupported family Cengiz Can
@ 2024-01-12  1:54 ` Cengiz Can
  2024-01-12  1:54 ` [PATCH 5.15.y] " Cengiz Can
  2024-01-13  9:15 ` [PATCH 5.4.y] " Greg Kroah-Hartman
  2 siblings, 0 replies; 4+ messages in thread
From: Cengiz Can @ 2024-01-12  1:54 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: Phil Sutter, Pablo Neira Ayuso, Jozsef Kadlecsik,
	Florian Westphal, David S . Miller, stable

From: Phil Sutter <phil@nwl.cc>

commit f1082dd31fe461d482d69da2a8eccfeb7bf07ac2 upstream.

An nftables family is merely a hollow container, its family just a
number and such not reliant on compile-time options other than nftables
support itself. Add an artificial check so attempts at using a family
the kernel can't support fail as early as possible. This helps user
space detect kernels which lack e.g. NFPROTO_INET.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Cengiz Can <cengiz.can@canonical.com>
---
 net/netfilter/nf_tables_api.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index f244a4323a43..d7c9475639f2 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1186,6 +1186,30 @@ static int nft_objname_hash_cmp(struct rhashtable_compare_arg *arg,
 	return strcmp(obj->key.name, k->name);
 }
 
+static bool nft_supported_family(u8 family)
+{
+	return false
+#ifdef CONFIG_NF_TABLES_INET
+		|| family == NFPROTO_INET
+#endif
+#ifdef CONFIG_NF_TABLES_IPV4
+		|| family == NFPROTO_IPV4
+#endif
+#ifdef CONFIG_NF_TABLES_ARP
+		|| family == NFPROTO_ARP
+#endif
+#ifdef CONFIG_NF_TABLES_NETDEV
+		|| family == NFPROTO_NETDEV
+#endif
+#if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE)
+		|| family == NFPROTO_BRIDGE
+#endif
+#ifdef CONFIG_NF_TABLES_IPV6
+		|| family == NFPROTO_IPV6
+#endif
+		;
+}
+
 static int nf_tables_newtable(struct net *net, struct sock *nlsk,
 			      struct sk_buff *skb, const struct nlmsghdr *nlh,
 			      const struct nlattr * const nla[],
@@ -1201,6 +1225,9 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk,
 	u32 flags = 0;
 	int err;
 
+	if (!nft_supported_family(family))
+		return -EOPNOTSUPP;
+
 	lockdep_assert_held(&nft_net->commit_mutex);
 	attr = nla[NFTA_TABLE_NAME];
 	table = nft_table_lookup(net, attr, family, genmask);
-- 
2.40.1


^ permalink raw reply related	[flat|nested] 4+ messages in thread

* [PATCH 5.15.y] netfilter: nf_tables: Reject tables of unsupported family
  2024-01-12  1:54 [PATCH 5.4.y] netfilter: nf_tables: Reject tables of unsupported family Cengiz Can
  2024-01-12  1:54 ` [PATCH 5.10.y] " Cengiz Can
@ 2024-01-12  1:54 ` Cengiz Can
  2024-01-13  9:15 ` [PATCH 5.4.y] " Greg Kroah-Hartman
  2 siblings, 0 replies; 4+ messages in thread
From: Cengiz Can @ 2024-01-12  1:54 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: Phil Sutter, Pablo Neira Ayuso, Jozsef Kadlecsik,
	Florian Westphal, David S . Miller, stable

From: Phil Sutter <phil@nwl.cc>

commit f1082dd31fe461d482d69da2a8eccfeb7bf07ac2 upstream.

An nftables family is merely a hollow container, its family just a
number and such not reliant on compile-time options other than nftables
support itself. Add an artificial check so attempts at using a family
the kernel can't support fail as early as possible. This helps user
space detect kernels which lack e.g. NFPROTO_INET.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Cengiz Can <cengiz.can@canonical.com>
---
 net/netfilter/nf_tables_api.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 3ee0f632a942..3556818c7162 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1247,6 +1247,30 @@ static int nft_objname_hash_cmp(struct rhashtable_compare_arg *arg,
 	return strcmp(obj->key.name, k->name);
 }
 
+static bool nft_supported_family(u8 family)
+{
+	return false
+#ifdef CONFIG_NF_TABLES_INET
+		|| family == NFPROTO_INET
+#endif
+#ifdef CONFIG_NF_TABLES_IPV4
+		|| family == NFPROTO_IPV4
+#endif
+#ifdef CONFIG_NF_TABLES_ARP
+		|| family == NFPROTO_ARP
+#endif
+#ifdef CONFIG_NF_TABLES_NETDEV
+		|| family == NFPROTO_NETDEV
+#endif
+#if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE)
+		|| family == NFPROTO_BRIDGE
+#endif
+#ifdef CONFIG_NF_TABLES_IPV6
+		|| family == NFPROTO_IPV6
+#endif
+		;
+}
+
 static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info,
 			      const struct nlattr * const nla[])
 {
@@ -1261,6 +1285,9 @@ static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info,
 	u32 flags = 0;
 	int err;
 
+	if (!nft_supported_family(family))
+		return -EOPNOTSUPP;
+
 	lockdep_assert_held(&nft_net->commit_mutex);
 	attr = nla[NFTA_TABLE_NAME];
 	table = nft_table_lookup(net, attr, family, genmask,
-- 
2.40.1


^ permalink raw reply related	[flat|nested] 4+ messages in thread

* Re: [PATCH 5.4.y] netfilter: nf_tables: Reject tables of unsupported family
  2024-01-12  1:54 [PATCH 5.4.y] netfilter: nf_tables: Reject tables of unsupported family Cengiz Can
  2024-01-12  1:54 ` [PATCH 5.10.y] " Cengiz Can
  2024-01-12  1:54 ` [PATCH 5.15.y] " Cengiz Can
@ 2024-01-13  9:15 ` Greg Kroah-Hartman
  2 siblings, 0 replies; 4+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-13  9:15 UTC (permalink / raw)
  To: Cengiz Can
  Cc: Phil Sutter, Pablo Neira Ayuso, Jozsef Kadlecsik,
	Florian Westphal, David S . Miller, stable

On Fri, Jan 12, 2024 at 04:54:35AM +0300, Cengiz Can wrote:
> From: Phil Sutter <phil@nwl.cc>
> 
> commit f1082dd31fe461d482d69da2a8eccfeb7bf07ac2 upstream.
> 
> An nftables family is merely a hollow container, its family just a
> number and such not reliant on compile-time options other than nftables
> support itself. Add an artificial check so attempts at using a family
> the kernel can't support fail as early as possible. This helps user
> space detect kernels which lack e.g. NFPROTO_INET.
> 
> Signed-off-by: Phil Sutter <phil@nwl.cc>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> Signed-off-by: Cengiz Can <cengiz.can@canonical.com>
> ---
>  net/netfilter/nf_tables_api.c | 27 +++++++++++++++++++++++++++
>  1 file changed, 27 insertions(+)

Any specific reason you sent this to us for inclusion _AFTER_ you posted
to oss-security, notifying the world of the issue?

Anyway, I have queued them up already from that report, and just now got
to these patches in my queue, making me a little bit less grumpy, but
not a lot.  Please be more considerate next time.

greg k-h

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2024-01-13  9:15 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-01-12  1:54 [PATCH 5.4.y] netfilter: nf_tables: Reject tables of unsupported family Cengiz Can
2024-01-12  1:54 ` [PATCH 5.10.y] " Cengiz Can
2024-01-12  1:54 ` [PATCH 5.15.y] " Cengiz Can
2024-01-13  9:15 ` [PATCH 5.4.y] " Greg Kroah-Hartman

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox