mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-29 22:02:02 +00:00
netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations
[ Upstream commit8059918a13
] - Disallow families other than NFPROTO_{IPV4,IPV6,INET}. - Disallow layer 4 protocol with no ports, since destination port is a mandatory attribute for this object. Fixes:857b46027d
("netfilter: nft_ct: add ct expectations support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
9ff981cd65
commit
0f501dae16
1 changed files with 24 additions and 0 deletions
|
@ -1231,7 +1231,31 @@ static int nft_ct_expect_obj_init(const struct nft_ctx *ctx,
|
|||
if (tb[NFTA_CT_EXPECT_L3PROTO])
|
||||
priv->l3num = ntohs(nla_get_be16(tb[NFTA_CT_EXPECT_L3PROTO]));
|
||||
|
||||
switch (priv->l3num) {
|
||||
case NFPROTO_IPV4:
|
||||
case NFPROTO_IPV6:
|
||||
if (priv->l3num != ctx->family)
|
||||
return -EINVAL;
|
||||
|
||||
fallthrough;
|
||||
case NFPROTO_INET:
|
||||
break;
|
||||
default:
|
||||
return -EOPNOTSUPP;
|
||||
}
|
||||
|
||||
priv->l4proto = nla_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]);
|
||||
switch (priv->l4proto) {
|
||||
case IPPROTO_TCP:
|
||||
case IPPROTO_UDP:
|
||||
case IPPROTO_UDPLITE:
|
||||
case IPPROTO_DCCP:
|
||||
case IPPROTO_SCTP:
|
||||
break;
|
||||
default:
|
||||
return -EOPNOTSUPP;
|
||||
}
|
||||
|
||||
priv->dport = nla_get_be16(tb[NFTA_CT_EXPECT_DPORT]);
|
||||
priv->timeout = nla_get_u32(tb[NFTA_CT_EXPECT_TIMEOUT]);
|
||||
priv->size = nla_get_u8(tb[NFTA_CT_EXPECT_SIZE]);
|
||||
|
|
Loading…
Reference in a new issue