* [PATCH nf] netfilter: nft_dup: validate family and chains
@ 2022-08-21 10:38 Pablo Neira Ayuso
2022-08-21 10:38 ` [PATCH nf] netfilter: nft_fwd: really validate family Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: Pablo Neira Ayuso @ 2022-08-21 10:38 UTC (permalink / raw)
To: netfilter-devel
This only supports for netdev family and ingress and egress hooks.
Fixes: 502061f81d3e ("netfilter: nf_tables: add packet duplication to the netdev family")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nft_dup_netdev.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/net/netfilter/nft_dup_netdev.c b/net/netfilter/nft_dup_netdev.c
index 63507402716d..6c8cb7a04264 100644
--- a/net/netfilter/nft_dup_netdev.c
+++ b/net/netfilter/nft_dup_netdev.c
@@ -44,6 +44,17 @@ static int nft_dup_netdev_init(const struct nft_ctx *ctx,
sizeof(int));
}
+static int nft_dup_netdev_validate(const struct nft_ctx *ctx,
+ const struct nft_expr *expr,
+ const struct nft_data **data)
+{
+ if (ctx->family != NFPROTO_NETDEV)
+ return -EOPNOTSUPP;
+
+ return nft_chain_validate_hooks(ctx->chain, (1 << NF_NETDEV_INGRESS) |
+ (1 << NF_NETDEV_EGRESS));
+}
+
static int nft_dup_netdev_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
struct nft_dup_netdev *priv = nft_expr_priv(expr);
@@ -79,6 +90,7 @@ static const struct nft_expr_ops nft_dup_netdev_ops = {
.eval = nft_dup_netdev_eval,
.init = nft_dup_netdev_init,
.dump = nft_dup_netdev_dump,
+ .validate = nft_dup_netdev_validate,
.reduce = NFT_REDUCE_READONLY,
.offload = nft_dup_netdev_offload,
.offload_action = nft_dup_netdev_offload_action,
--
2.30.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH nf] netfilter: nft_fwd: really validate family
2022-08-21 10:38 [PATCH nf] netfilter: nft_dup: validate family and chains Pablo Neira Ayuso
@ 2022-08-21 10:38 ` Pablo Neira Ayuso
2022-08-21 14:00 ` Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: Pablo Neira Ayuso @ 2022-08-21 10:38 UTC (permalink / raw)
To: netfilter-devel
This only supports for the netdev family, report EOPNOTSUPP otherwise.
Fixes: 76a109fac206 ("netfilter: nft_fwd_netdev: validate family and chain type")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nft_fwd_netdev.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/netfilter/nft_fwd_netdev.c b/net/netfilter/nft_fwd_netdev.c
index 7c5876dc9ff2..138313123da6 100644
--- a/net/netfilter/nft_fwd_netdev.c
+++ b/net/netfilter/nft_fwd_netdev.c
@@ -205,6 +205,9 @@ static int nft_fwd_validate(const struct nft_ctx *ctx,
const struct nft_expr *expr,
const struct nft_data **data)
{
+ if (ctx->family != NFPROTO_NETDEV)
+ return -EOPNOTSUPP;
+
return nft_chain_validate_hooks(ctx->chain, (1 << NF_NETDEV_INGRESS) |
(1 << NF_NETDEV_EGRESS));
}
--
2.30.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH nf] netfilter: nft_fwd: really validate family
2022-08-21 10:38 ` [PATCH nf] netfilter: nft_fwd: really validate family Pablo Neira Ayuso
@ 2022-08-21 14:00 ` Pablo Neira Ayuso
0 siblings, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2022-08-21 14:00 UTC (permalink / raw)
To: netfilter-devel
On Sun, Aug 21, 2022 at 12:38:13PM +0200, Pablo Neira Ayuso wrote:
> This only supports for the netdev family, report EOPNOTSUPP otherwise.
Scratch this, this is already validated via .family field in
expression type.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-08-21 14:02 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-08-21 10:38 [PATCH nf] netfilter: nft_dup: validate family and chains Pablo Neira Ayuso
2022-08-21 10:38 ` [PATCH nf] netfilter: nft_fwd: really validate family Pablo Neira Ayuso
2022-08-21 14:00 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).