Commit cb81572e authored by Phil Sutter's avatar Phil Sutter Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: Make nft_meta expression more robust 



nft_meta_get_eval()'s tendency to bail out setting NFT_BREAK verdict in
situations where required data is missing leads to unexpected behaviour
with inverted checks like so:

| meta iifname != eth0 accept

This rule will never match if there is no input interface (or it is not
known) which is not intuitive and, what's worse, breaks consistency of
iptables-nft with iptables-legacy.

Fix this by falling back to placing a value in dreg which never matches
(avoiding accidental matches), i.e. zero for interface index and an
empty string for interface name.

Signed-off-by: default avatarPhil Sutter <phil@nwl.cc>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 15a78ba1

net/bridge/netfilter/nft_meta_bridge.c

+1 −5
Original line number Diff line number Diff line
@@ -30,13 +30,9 @@ static void nft_meta_bridge_get_eval(const struct nft_expr *expr, 
	switch (priv->key) {

	case NFT_META_BRI_IIFNAME:

		br_dev = nft_meta_get_bridge(in);

		if (!br_dev)

			goto err;

		break;

	case NFT_META_BRI_OIFNAME:

		br_dev = nft_meta_get_bridge(out);

		if (!br_dev)

			goto err;

		break;

	case NFT_META_BRI_IIFPVID: {

		u16 p_pvid;
@@ -64,7 +60,7 @@ static void nft_meta_bridge_get_eval(const struct nft_expr *expr, 
		goto out;

	}



	strncpy((char *)dest, br_dev->name, IFNAMSIZ);

	strncpy((char *)dest, br_dev ? br_dev->name : "", IFNAMSIZ);

	return;

out:

	return nft_meta_get_eval(expr, regs, pkt);

net/netfilter/nft_meta.c

+4 −12
Original line number Diff line number Diff line
@@ -60,24 +60,16 @@ void nft_meta_get_eval(const struct nft_expr *expr, 
		*dest = skb->mark;

		break;

	case NFT_META_IIF:

		if (in == NULL)

			goto err;

		*dest = in->ifindex;

		*dest = in ? in->ifindex : 0;

		break;

	case NFT_META_OIF:

		if (out == NULL)

			goto err;

		*dest = out->ifindex;

		*dest = out ? out->ifindex : 0;

		break;

	case NFT_META_IIFNAME:

		if (in == NULL)

			goto err;

		strncpy((char *)dest, in->name, IFNAMSIZ);

		strncpy((char *)dest, in ? in->name : "", IFNAMSIZ);

		break;

	case NFT_META_OIFNAME:

		if (out == NULL)

			goto err;

		strncpy((char *)dest, out->name, IFNAMSIZ);

		strncpy((char *)dest, out ? out->name : "", IFNAMSIZ);

		break;

	case NFT_META_IIFTYPE:

		if (in == NULL)

CRA Git | Maintained and supported by SUSTech CRA and CCSE