Commit 36b701fa authored by Laura Garcia Liebana's avatar Laura Garcia Liebana Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: validate maximum value of u32 netlink attributes 



Fetch value and validate u32 netlink attribute. This validation is
usually required when the u32 netlink attributes are being stored in a
field whose size is smaller.

This patch revisits 4da449ae ("netfilter: nft_exthdr: Add size check
on u8 nft_exthdr attributes").

Fixes: 96518518 ("netfilter: add nftables")
Suggested-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarLaura Garcia Liebana <nevola@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 2b03bf73

include/net/netfilter/nf_tables.h

+1 −0
Original line number Original line Diff line number Diff line
@@ -145,6 +145,7 @@ static inline enum nft_registers nft_type_to_reg(enum nft_data_types type) 
	return type == NFT_DATA_VERDICT ? NFT_REG_VERDICT : NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE;

	return type == NFT_DATA_VERDICT ? NFT_REG_VERDICT : NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE;

}

}





unsigned int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest);

unsigned int nft_parse_register(const struct nlattr *attr);

unsigned int nft_parse_register(const struct nlattr *attr);

int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg);

int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg);

net/netfilter/nf_tables_api.c

+25 −0
Original line number Original line Diff line number Diff line
@@ -4409,6 +4409,31 @@ static int nf_tables_check_loops(const struct nft_ctx *ctx, 
	return 0;

	return 0;

}

}





/**

 *	nft_parse_u32_check - fetch u32 attribute and check for maximum value

 *

 *	@attr: netlink attribute to fetch value from

 *	@max: maximum value to be stored in dest

 *	@dest: pointer to the variable

 *

 *	Parse, check and store a given u32 netlink attribute into variable.

 *	This function returns -ERANGE if the value goes over maximum value.

 *	Otherwise a 0 is returned and the attribute value is stored in the

 *	destination variable.

 */

unsigned int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)

{

	int val;



	val = ntohl(nla_get_be32(attr));

	if (val > max)

		return -ERANGE;



	*dest = val;

	return 0;

}

EXPORT_SYMBOL_GPL(nft_parse_u32_check);



/**

/**

 *	nft_parse_register - parse a register value from a netlink attribute

 *	nft_parse_register - parse a register value from a netlink attribute

 *

 *

net/netfilter/nft_bitwise.c

+7 −1
Original line number Original line Diff line number Diff line
@@ -52,6 +52,7 @@ static int nft_bitwise_init(const struct nft_ctx *ctx, 
{

{

	struct nft_bitwise *priv = nft_expr_priv(expr);

	struct nft_bitwise *priv = nft_expr_priv(expr);

	struct nft_data_desc d1, d2;

	struct nft_data_desc d1, d2;

	u32 len;

	int err;

	int err;





	if (tb[NFTA_BITWISE_SREG] == NULL ||

	if (tb[NFTA_BITWISE_SREG] == NULL ||
@@ -61,7 +62,12 @@ static int nft_bitwise_init(const struct nft_ctx *ctx, 
	    tb[NFTA_BITWISE_XOR] == NULL)

	    tb[NFTA_BITWISE_XOR] == NULL)

		return -EINVAL;

		return -EINVAL;





	priv->len  = ntohl(nla_get_be32(tb[NFTA_BITWISE_LEN]));

	err = nft_parse_u32_check(tb[NFTA_BITWISE_LEN], U8_MAX, &len);

	if (err < 0)

		return err;



	priv->len = len;



	priv->sreg = nft_parse_register(tb[NFTA_BITWISE_SREG]);

	priv->sreg = nft_parse_register(tb[NFTA_BITWISE_SREG]);

	err = nft_validate_register_load(priv->sreg, priv->len);

	err = nft_validate_register_load(priv->sreg, priv->len);

	if (err < 0)

	if (err < 0)

net/netfilter/nft_byteorder.c

+13 −2
Original line number Original line Diff line number Diff line
@@ -99,6 +99,7 @@ static int nft_byteorder_init(const struct nft_ctx *ctx, 
			      const struct nlattr * const tb[])

			      const struct nlattr * const tb[])

{

{

	struct nft_byteorder *priv = nft_expr_priv(expr);

	struct nft_byteorder *priv = nft_expr_priv(expr);

	u32 size, len;

	int err;

	int err;





	if (tb[NFTA_BYTEORDER_SREG] == NULL ||

	if (tb[NFTA_BYTEORDER_SREG] == NULL ||
@@ -117,7 +118,12 @@ static int nft_byteorder_init(const struct nft_ctx *ctx, 
		return -EINVAL;

		return -EINVAL;

	}

	}





	priv->size = ntohl(nla_get_be32(tb[NFTA_BYTEORDER_SIZE]));

	err = nft_parse_u32_check(tb[NFTA_BYTEORDER_SIZE], U8_MAX, &size);

	if (err < 0)

		return err;



	priv->size = size;



	switch (priv->size) {

	switch (priv->size) {

	case 2:

	case 2:

	case 4:

	case 4:
@@ -128,7 +134,12 @@ static int nft_byteorder_init(const struct nft_ctx *ctx, 
	}

	}





	priv->sreg = nft_parse_register(tb[NFTA_BYTEORDER_SREG]);

	priv->sreg = nft_parse_register(tb[NFTA_BYTEORDER_SREG]);

	priv->len  = ntohl(nla_get_be32(tb[NFTA_BYTEORDER_LEN]));

	err = nft_parse_u32_check(tb[NFTA_BYTEORDER_LEN], U8_MAX, &len);

	if (err < 0)

		return err;



	priv->len = len;



	err = nft_validate_register_load(priv->sreg, priv->len);

	err = nft_validate_register_load(priv->sreg, priv->len);

	if (err < 0)

	if (err < 0)

		return err;

		return err;

net/netfilter/nft_cmp.c

+3 −0
Original line number Original line Diff line number Diff line
@@ -84,6 +84,9 @@ static int nft_cmp_init(const struct nft_ctx *ctx, const struct nft_expr *expr, 
	if (err < 0)

	if (err < 0)

		return err;

		return err;





	if (desc.len > U8_MAX)

		return -ERANGE;



	priv->op  = ntohl(nla_get_be32(tb[NFTA_CMP_OP]));

	priv->op  = ntohl(nla_get_be32(tb[NFTA_CMP_OP]));

	priv->len = desc.len;

	priv->len = desc.len;

	return 0;

	return 0;

CRA Git | Maintained and supported by SUSTech CRA and CCSE