[PATCH] netfilter: No increment ctx->level for NFT_GOTO

[PATCH] netfilter: No increment ctx->level for NFT_GOTO

[Steve Hill]

[-- Attachment #1: Type: text/plain, Size: 2148 bytes --]

nft_immediate_validate() and nft_lookup_validate_setelem() treat 
NFT_GOTO and NFT_JUMP identically, incrementing pctx->level for both. 
This results in a -EMLINK ("Too many links") being unexpectedly returned 
for rulesets that use lots of gotos.

This fixes this problem by not incrementing pctx->level when following 
gotos.

Fixes: https://bugzilla.netfilter.org/show_bug.cgi?id=1459
Signed-off-by: Steve Hill <steve@opendium.com>
---
diff -urN 
linux-4.18.0-193.14.2.el8.x86_64.vanilla/net/netfilter/nft_immediate.c 
linux-4.18.0-193.14.2.el8.x86_64.opendium/net/netfilter/nft_immediate.c
--- 
linux-4.18.0-193.14.2.el8.x86_64.vanilla/net/netfilter/nft_immediate.c 
2020-07-19 15:03:44.000000000 +0100
+++ 
linux-4.18.0-193.14.2.el8.x86_64.opendium/net/netfilter/nft_immediate.c 
2020-08-26 15:39:47.004754668 +0100
@@ -113,13 +113,19 @@

      switch (data->verdict.code) {
      case NFT_JUMP:
-    case NFT_GOTO:
          pctx->level++;
          err = nft_chain_validate(ctx, data->verdict.chain);
          if (err < 0)
              return err;
          pctx->level--;
          break;
+    case NFT_GOTO:
+        err = nft_chain_validate(ctx, data->verdict.chain);
+        if (err < 0)
+            return err;
+        break;
      default:
          break;
      }
diff -urN 
linux-4.18.0-193.14.2.el8.x86_64.vanilla/net/netfilter/nft_lookup.c 
linux-4.18.0-193.14.2.el8.x86_64.opendium/net/netfilter/nft_lookup.c
--- linux-4.18.0-193.14.2.el8.x86_64.vanilla/net/netfilter/nft_lookup.c 
2020-07-19 15:03:44.000000000 +0100
+++ linux-4.18.0-193.14.2.el8.x86_64.opendium/net/netfilter/nft_lookup.c 
2020-08-26 15:42:35.885223417 +0100
@@ -176,13 +176,19 @@
      data = nft_set_ext_data(ext);
      switch (data->verdict.code) {
      case NFT_JUMP:
-    case NFT_GOTO:
          pctx->level++;
          err = nft_chain_validate(ctx, data->verdict.chain);
          if (err < 0)
              return err;
          pctx->level--;
          break;
+    case NFT_GOTO:
+        err = nft_chain_validate(ctx, data->verdict.chain);
+        if (err < 0)
+            return err;
+        break;
      default:
          break;
      }

[-- Attachment #2: steve.vcf --]
[-- Type: text/x-vcard, Size: 259 bytes --]

begin:vcard
fn:Steve Hill
n:Hill;Steve
org:Opendium Limited
adr:1 Brue Close;;Highfield House;Bruton;Somerset;BA10 0HY;England
email;internet:steve@opendium.com
title:Technical Director
x-mozilla-html:FALSE
url:https://www.opendium.com
version:2.1
end:vcard