* [nf-next PATCH v3] netfilter: nf_tables: Reject tables of unsupported family
@ 2022-02-16 14:55 Phil Sutter
2022-03-02 23:26 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: Phil Sutter @ 2022-02-16 14:55 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, Florian Westphal
An nftables family is merely a hollow container, its family just a
number and such not reliant on compile-time options other than nftables
support itself. Add an artificial check so attempts at using a family
the kernel can't support fail as early as possible. This helps user
space detect kernels which lack e.g. NFPROTO_INET.
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
Changes since v2:
- Casting family from u8 to int via parameter resulted in an always
negative result. Pass it as u8 to nft_supported_family().
- Fix typo: CONIFG_NF_TABLES_BRIDGE -> CONFIG_NF_TABLES_BRIDGE
- Reduce the function to a single statement instead of if/else
conditional.
- Use 'false' instead of '0' for the standard term.
Changes since v1:
- Avoid a compiler warning if none of the tested symbols are enabled.
---
net/netfilter/nf_tables_api.c | 27 +++++++++++++++++++++++++++
1 file changed, 27 insertions(+)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 5fa16990da951..ac33ca9f8d88b 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1072,6 +1072,30 @@ static int nft_objname_hash_cmp(struct rhashtable_compare_arg *arg,
return strcmp(obj->key.name, k->name);
}
+static bool nft_supported_family(u8 family)
+{
+ return false
+#ifdef CONFIG_NF_TABLES_INET
+ || family == NFPROTO_INET
+#endif
+#ifdef CONFIG_NF_TABLES_IPV4
+ || family == NFPROTO_IPV4
+#endif
+#ifdef CONFIG_NF_TABLES_ARP
+ || family == NFPROTO_ARP
+#endif
+#ifdef CONFIG_NF_TABLES_NETDEV
+ || family == NFPROTO_NETDEV
+#endif
+#if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE)
+ || family == NFPROTO_BRIDGE
+#endif
+#ifdef CONFIG_NF_TABLES_IPV6
+ || family == NFPROTO_IPV6
+#endif
+ ;
+}
+
static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info,
const struct nlattr * const nla[])
{
@@ -1086,6 +1110,9 @@ static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info,
u32 flags = 0;
int err;
+ if (!nft_supported_family(family))
+ return -EOPNOTSUPP;
+
lockdep_assert_held(&nft_net->commit_mutex);
attr = nla[NFTA_TABLE_NAME];
table = nft_table_lookup(net, attr, family, genmask,
--
2.34.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [nf-next PATCH v3] netfilter: nf_tables: Reject tables of unsupported family
2022-02-16 14:55 [nf-next PATCH v3] netfilter: nf_tables: Reject tables of unsupported family Phil Sutter
@ 2022-03-02 23:26 ` Pablo Neira Ayuso
0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2022-03-02 23:26 UTC (permalink / raw)
To: Phil Sutter; +Cc: netfilter-devel, Florian Westphal
On Wed, Feb 16, 2022 at 03:55:38PM +0100, Phil Sutter wrote:
> An nftables family is merely a hollow container, its family just a
> number and such not reliant on compile-time options other than nftables
> support itself. Add an artificial check so attempts at using a family
> the kernel can't support fail as early as possible. This helps user
> space detect kernels which lack e.g. NFPROTO_INET.
Applied, thanks
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-03-03 0:02 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-02-16 14:55 [nf-next PATCH v3] netfilter: nf_tables: Reject tables of unsupported family Phil Sutter
2022-03-02 23:26 ` Pablo Neira Ayuso
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.