korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-12-02 00:24:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

netfilter: nf_tables: reject unsupported chain flags

Browse Source 
Bail out if userspace sends unsupported chain flags.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso 2020-07-04 02:51:28 +02:00
parent d0e2c7de92
commit c1f79a2eef
2 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
include/uapi/linux/netfilter/nf_tables.h
View File

@ -189,6 +189,9 @@ enum nft_chain_flags {
NFT_CHAIN_HW_OFFLOAD = (1 << 1), NFT_CHAIN_HW_OFFLOAD = (1 << 1),
NFT_CHAIN_BINDING = (1 << 2), NFT_CHAIN_BINDING = (1 << 2),
}; };
#define NFT_CHAIN_FLAGS (NFT_CHAIN_BASE | \
NFT_CHAIN_HW_OFFLOAD | \
NFT_CHAIN_BINDING)
/** /**
* enum nft_chain_attributes - nf_tables chain netlink attributes * enum nft_chain_attributes - nf_tables chain netlink attributes

3
net/netfilter/nf_tables_api.c
View File

@ -2285,6 +2285,9 @@ static int nf_tables_newchain(struct net *net, struct sock *nlsk,
else if (chain) else if (chain)
flags = chain->flags; flags = chain->flags;
if (flags & ~NFT_CHAIN_FLAGS)
return -EOPNOTSUPP;
nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla); nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
if (chain != NULL) { if (chain != NULL) {