Commit 36b701fa authored by Laura Garcia Liebana's avatar Laura Garcia Liebana Committed by Pablo Neira Ayuso

netfilter: nf_tables: validate maximum value of u32 netlink attributes

Fetch value and validate u32 netlink attribute. This validation is
usually required when the u32 netlink attributes are being stored in a
field whose size is smaller.

This patch revisits 4da449ae ("netfilter: nft_exthdr: Add size check
on u8 nft_exthdr attributes").

Fixes: 96518518 ("netfilter: add nftables")
Suggested-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarLaura Garcia Liebana <nevola@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 2b03bf73
...@@ -145,6 +145,7 @@ static inline enum nft_registers nft_type_to_reg(enum nft_data_types type) ...@@ -145,6 +145,7 @@ static inline enum nft_registers nft_type_to_reg(enum nft_data_types type)
return type == NFT_DATA_VERDICT ? NFT_REG_VERDICT : NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE; return type == NFT_DATA_VERDICT ? NFT_REG_VERDICT : NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE;
} }
unsigned int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest);
unsigned int nft_parse_register(const struct nlattr *attr); unsigned int nft_parse_register(const struct nlattr *attr);
int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg); int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg);
......
...@@ -4409,6 +4409,31 @@ static int nf_tables_check_loops(const struct nft_ctx *ctx, ...@@ -4409,6 +4409,31 @@ static int nf_tables_check_loops(const struct nft_ctx *ctx,
return 0; return 0;
} }
/**
* nft_parse_u32_check - fetch u32 attribute and check for maximum value
*
* @attr: netlink attribute to fetch value from
* @max: maximum value to be stored in dest
* @dest: pointer to the variable
*
* Parse, check and store a given u32 netlink attribute into variable.
* This function returns -ERANGE if the value goes over maximum value.
* Otherwise a 0 is returned and the attribute value is stored in the
* destination variable.
*/
unsigned int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
{
int val;
val = ntohl(nla_get_be32(attr));
if (val > max)
return -ERANGE;
*dest = val;
return 0;
}
EXPORT_SYMBOL_GPL(nft_parse_u32_check);
/** /**
* nft_parse_register - parse a register value from a netlink attribute * nft_parse_register - parse a register value from a netlink attribute
* *
......
...@@ -52,6 +52,7 @@ static int nft_bitwise_init(const struct nft_ctx *ctx, ...@@ -52,6 +52,7 @@ static int nft_bitwise_init(const struct nft_ctx *ctx,
{ {
struct nft_bitwise *priv = nft_expr_priv(expr); struct nft_bitwise *priv = nft_expr_priv(expr);
struct nft_data_desc d1, d2; struct nft_data_desc d1, d2;
u32 len;
int err; int err;
if (tb[NFTA_BITWISE_SREG] == NULL || if (tb[NFTA_BITWISE_SREG] == NULL ||
...@@ -61,7 +62,12 @@ static int nft_bitwise_init(const struct nft_ctx *ctx, ...@@ -61,7 +62,12 @@ static int nft_bitwise_init(const struct nft_ctx *ctx,
tb[NFTA_BITWISE_XOR] == NULL) tb[NFTA_BITWISE_XOR] == NULL)
return -EINVAL; return -EINVAL;
priv->len = ntohl(nla_get_be32(tb[NFTA_BITWISE_LEN])); err = nft_parse_u32_check(tb[NFTA_BITWISE_LEN], U8_MAX, &len);
if (err < 0)
return err;
priv->len = len;
priv->sreg = nft_parse_register(tb[NFTA_BITWISE_SREG]); priv->sreg = nft_parse_register(tb[NFTA_BITWISE_SREG]);
err = nft_validate_register_load(priv->sreg, priv->len); err = nft_validate_register_load(priv->sreg, priv->len);
if (err < 0) if (err < 0)
......
...@@ -99,6 +99,7 @@ static int nft_byteorder_init(const struct nft_ctx *ctx, ...@@ -99,6 +99,7 @@ static int nft_byteorder_init(const struct nft_ctx *ctx,
const struct nlattr * const tb[]) const struct nlattr * const tb[])
{ {
struct nft_byteorder *priv = nft_expr_priv(expr); struct nft_byteorder *priv = nft_expr_priv(expr);
u32 size, len;
int err; int err;
if (tb[NFTA_BYTEORDER_SREG] == NULL || if (tb[NFTA_BYTEORDER_SREG] == NULL ||
...@@ -117,7 +118,12 @@ static int nft_byteorder_init(const struct nft_ctx *ctx, ...@@ -117,7 +118,12 @@ static int nft_byteorder_init(const struct nft_ctx *ctx,
return -EINVAL; return -EINVAL;
} }
priv->size = ntohl(nla_get_be32(tb[NFTA_BYTEORDER_SIZE])); err = nft_parse_u32_check(tb[NFTA_BYTEORDER_SIZE], U8_MAX, &size);
if (err < 0)
return err;
priv->size = size;
switch (priv->size) { switch (priv->size) {
case 2: case 2:
case 4: case 4:
...@@ -128,7 +134,12 @@ static int nft_byteorder_init(const struct nft_ctx *ctx, ...@@ -128,7 +134,12 @@ static int nft_byteorder_init(const struct nft_ctx *ctx,
} }
priv->sreg = nft_parse_register(tb[NFTA_BYTEORDER_SREG]); priv->sreg = nft_parse_register(tb[NFTA_BYTEORDER_SREG]);
priv->len = ntohl(nla_get_be32(tb[NFTA_BYTEORDER_LEN])); err = nft_parse_u32_check(tb[NFTA_BYTEORDER_LEN], U8_MAX, &len);
if (err < 0)
return err;
priv->len = len;
err = nft_validate_register_load(priv->sreg, priv->len); err = nft_validate_register_load(priv->sreg, priv->len);
if (err < 0) if (err < 0)
return err; return err;
......
...@@ -84,6 +84,9 @@ static int nft_cmp_init(const struct nft_ctx *ctx, const struct nft_expr *expr, ...@@ -84,6 +84,9 @@ static int nft_cmp_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
if (err < 0) if (err < 0)
return err; return err;
if (desc.len > U8_MAX)
return -ERANGE;
priv->op = ntohl(nla_get_be32(tb[NFTA_CMP_OP])); priv->op = ntohl(nla_get_be32(tb[NFTA_CMP_OP]));
priv->len = desc.len; priv->len = desc.len;
return 0; return 0;
......
...@@ -59,7 +59,7 @@ static int nft_exthdr_init(const struct nft_ctx *ctx, ...@@ -59,7 +59,7 @@ static int nft_exthdr_init(const struct nft_ctx *ctx,
const struct nlattr * const tb[]) const struct nlattr * const tb[])
{ {
struct nft_exthdr *priv = nft_expr_priv(expr); struct nft_exthdr *priv = nft_expr_priv(expr);
u32 offset, len; u32 offset, len, err;
if (tb[NFTA_EXTHDR_DREG] == NULL || if (tb[NFTA_EXTHDR_DREG] == NULL ||
tb[NFTA_EXTHDR_TYPE] == NULL || tb[NFTA_EXTHDR_TYPE] == NULL ||
...@@ -67,11 +67,13 @@ static int nft_exthdr_init(const struct nft_ctx *ctx, ...@@ -67,11 +67,13 @@ static int nft_exthdr_init(const struct nft_ctx *ctx,
tb[NFTA_EXTHDR_LEN] == NULL) tb[NFTA_EXTHDR_LEN] == NULL)
return -EINVAL; return -EINVAL;
offset = ntohl(nla_get_be32(tb[NFTA_EXTHDR_OFFSET])); err = nft_parse_u32_check(tb[NFTA_EXTHDR_OFFSET], U8_MAX, &offset);
len = ntohl(nla_get_be32(tb[NFTA_EXTHDR_LEN])); if (err < 0)
return err;
if (offset > U8_MAX || len > U8_MAX) err = nft_parse_u32_check(tb[NFTA_EXTHDR_LEN], U8_MAX, &len);
return -ERANGE; if (err < 0)
return err;
priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]); priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
priv->offset = offset; priv->offset = offset;
......
...@@ -53,6 +53,10 @@ static int nft_immediate_init(const struct nft_ctx *ctx, ...@@ -53,6 +53,10 @@ static int nft_immediate_init(const struct nft_ctx *ctx,
tb[NFTA_IMMEDIATE_DATA]); tb[NFTA_IMMEDIATE_DATA]);
if (err < 0) if (err < 0)
return err; return err;
if (desc.len > U8_MAX)
return -ERANGE;
priv->dlen = desc.len; priv->dlen = desc.len;
priv->dreg = nft_parse_register(tb[NFTA_IMMEDIATE_DREG]); priv->dreg = nft_parse_register(tb[NFTA_IMMEDIATE_DREG]);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment