Skip to content

Commit

Permalink
netfilter: nft_compat: relax chain type validation
Browse files Browse the repository at this point in the history
Check for nat chain dependency only, which is the one that can
actually crash the kernel. Don't care if mangle, filter and security
specific match and targets are used out of their scope, they are
harmless.

This restores iptables-compat with mangle specific match/target when
used out of the OUTPUT chain, that are actually emulated through filter
chains, which broke when performing strict validation.

Fixes: f3f5dde ("netfilter: nft_compat: validate chain type in match/target")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  • Loading branch information
Pablo Neira Ayuso committed Nov 12, 2014
1 parent 2daf1b4 commit c918687
Showing 1 changed file with 2 additions and 30 deletions.
32 changes: 2 additions & 30 deletions net/netfilter/nft_compat.c
Original file line number Diff line number Diff line change
Expand Up @@ -21,45 +21,17 @@
#include <linux/netfilter_ipv6/ip6_tables.h>
#include <net/netfilter/nf_tables.h>

static const struct {
const char *name;
u8 type;
} table_to_chaintype[] = {
{ "filter", NFT_CHAIN_T_DEFAULT },
{ "raw", NFT_CHAIN_T_DEFAULT },
{ "security", NFT_CHAIN_T_DEFAULT },
{ "mangle", NFT_CHAIN_T_ROUTE },
{ "nat", NFT_CHAIN_T_NAT },
{ },
};

static int nft_compat_table_to_chaintype(const char *table)
{
int i;

for (i = 0; table_to_chaintype[i].name != NULL; i++) {
if (strcmp(table_to_chaintype[i].name, table) == 0)
return table_to_chaintype[i].type;
}

return -1;
}

static int nft_compat_chain_validate_dependency(const char *tablename,
const struct nft_chain *chain)
{
enum nft_chain_type type;
const struct nft_base_chain *basechain;

if (!tablename || !(chain->flags & NFT_BASE_CHAIN))
return 0;

type = nft_compat_table_to_chaintype(tablename);
if (type < 0)
return -EINVAL;

basechain = nft_base_chain(chain);
if (basechain->type->type != type)
if (strcmp(tablename, "nat") == 0 &&
basechain->type->type != NFT_CHAIN_T_NAT)
return -EINVAL;

return 0;
Expand Down

0 comments on commit c918687

Please sign in to comment.