[PATCH nf] netfilter: nfnetlink_queue: reject verdict request from different portid

[PATCH nf] netfilter: nfnetlink_queue: reject verdict request from different portid

[Liping Zhang]

From: Liping Zhang <liping.zhang@spreadtrum.com>

Like NFQNL_MSG_VERDICT_BATCH do, we should also reject the verdict
request when the portid is not same with the initial portid(maybe
from another process).

Fixes: 97d32cf9440d ("netfilter: nfnetlink_queue: batch verdict support")
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
---
 net/netfilter/nfnetlink_queue.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 5d36a09..f49f450 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -1145,10 +1145,8 @@ static int nfqnl_recv_verdict(struct net *net, struct sock *ctnl,
 	struct nfnl_queue_net *q = nfnl_queue_pernet(net);
 	int err;
 
-	queue = instance_lookup(q, queue_num);
-	if (!queue)
-		queue = verdict_instance_lookup(q, queue_num,
-						NETLINK_CB(skb).portid);
+	queue = verdict_instance_lookup(q, queue_num,
+					NETLINK_CB(skb).portid);
 	if (IS_ERR(queue))
 		return PTR_ERR(queue);
 
-- 
2.5.5

Re: [PATCH nf] netfilter: nfnetlink_queue: reject verdict request from different portid

[Florian Westphal]

Liping Zhang <zlpnobody@163.com> wrote:
> From: Liping Zhang <liping.zhang@spreadtrum.com>
> 
> Like NFQNL_MSG_VERDICT_BATCH do, we should also reject the verdict
> request when the portid is not same with the initial portid(maybe
> from another process).
> 
> Fixes: 97d32cf9440d ("netfilter: nfnetlink_queue: batch verdict support")
> Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>

Good catch, thanks!

Reviewed-by: Florian Westphal <fw@strlen.de>

Re: [PATCH nf] netfilter: nfnetlink_queue: reject verdict request from different portid

[Pablo Neira Ayuso]

On Mon, Aug 08, 2016 at 10:07:27PM +0800, Liping Zhang wrote:
> From: Liping Zhang <liping.zhang@spreadtrum.com>
> 
> Like NFQNL_MSG_VERDICT_BATCH do, we should also reject the verdict
> request when the portid is not same with the initial portid(maybe
> from another process).

Applied, thanks.