mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-30 06:10:56 +00:00
netfilter: nf_tables: Reject tables of unsupported family
commit f1082dd31f
upstream.
An nftables family is merely a hollow container, its family just a
number and such not reliant on compile-time options other than nftables
support itself. Add an artificial check so attempts at using a family
the kernel can't support fail as early as possible. This helps user
space detect kernels which lack e.g. NFPROTO_INET.
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
0eb556b238
commit
ab3a3aadb3
1 changed files with 27 additions and 0 deletions
|
@ -1247,6 +1247,30 @@ static int nft_objname_hash_cmp(struct rhashtable_compare_arg *arg,
|
|||
return strcmp(obj->key.name, k->name);
|
||||
}
|
||||
|
||||
static bool nft_supported_family(u8 family)
|
||||
{
|
||||
return false
|
||||
#ifdef CONFIG_NF_TABLES_INET
|
||||
|| family == NFPROTO_INET
|
||||
#endif
|
||||
#ifdef CONFIG_NF_TABLES_IPV4
|
||||
|| family == NFPROTO_IPV4
|
||||
#endif
|
||||
#ifdef CONFIG_NF_TABLES_ARP
|
||||
|| family == NFPROTO_ARP
|
||||
#endif
|
||||
#ifdef CONFIG_NF_TABLES_NETDEV
|
||||
|| family == NFPROTO_NETDEV
|
||||
#endif
|
||||
#if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE)
|
||||
|| family == NFPROTO_BRIDGE
|
||||
#endif
|
||||
#ifdef CONFIG_NF_TABLES_IPV6
|
||||
|| family == NFPROTO_IPV6
|
||||
#endif
|
||||
;
|
||||
}
|
||||
|
||||
static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info,
|
||||
const struct nlattr * const nla[])
|
||||
{
|
||||
|
@ -1261,6 +1285,9 @@ static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info,
|
|||
u32 flags = 0;
|
||||
int err;
|
||||
|
||||
if (!nft_supported_family(family))
|
||||
return -EOPNOTSUPP;
|
||||
|
||||
lockdep_assert_held(&nft_net->commit_mutex);
|
||||
attr = nla[NFTA_TABLE_NAME];
|
||||
table = nft_table_lookup(net, attr, family, genmask,
|
||||
|
|
Loading…
Reference in a new issue