From: Phil Sutter <phil@nwl.cc>
Date: Thu, 22 Dec 2022 14:58:27 +0000 (+0100)
Subject: nft: Reject tcp/udp extension without proper protocol match
X-Git-Tag: v1.8.9~5
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=596f2e31ae7cee26e4f39f300cc69605f4ba512f;p=thirdparty%2Fiptables.git

nft: Reject tcp/udp extension without proper protocol match

Internally, 'th' expression is used, which works but matches both
protocols. Since users won't expect '-m tcp --dport 1' to match UDP
packets, catch missing/wrong '-p' argument.

Fixes: c034cf31dd1a9 ("nft: prefer native expressions instead of udp match")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---

diff --git a/extensions/libxt_tcp.t b/extensions/libxt_tcp.t
index b0e8006e..7a3bbd08 100644
--- a/extensions/libxt_tcp.t
+++ b/extensions/libxt_tcp.t
@@ -22,5 +22,8 @@
 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG SYN;=;OK
 -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,PSH,ACK,URG SYN;=;OK
 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG RST;=;OK
+-m tcp --dport 1;;FAIL
+-m tcp --dport 1 -p tcp;-p tcp -m tcp --dport 1;OK
+-m tcp --dport 1 -p 6;-p tcp -m tcp --dport 1;OK
 # should we accept this below?
 -p tcp -m tcp;=;OK
diff --git a/extensions/libxt_udp.t b/extensions/libxt_udp.t
index 1b4d3dd6..f5347701 100644
--- a/extensions/libxt_udp.t
+++ b/extensions/libxt_udp.t
@@ -18,5 +18,8 @@
 # -p udp -m udp --sport 65536;;FAIL
 -p udp -m udp --sport -1;;FAIL
 -p udp -m udp --dport -1;;FAIL
+-m udp --dport 1;;FAIL
+-m udp --dport 1 -p udp;-p udp -m udp --dport 1;OK
+-m udp --dport 1 -p 17;-p udp -m udp --dport 1;OK
 # should we accept this below?
 -p udp -m udp;=;OK
diff --git a/iptables/nft.c b/iptables/nft.c
index 430888e8..63468cf3 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -1360,6 +1360,9 @@ static int add_nft_udp(struct nft_handle *h, struct nftnl_rule *r,
 		return ret;
 	}
 
+	if (nftnl_rule_get_u32(r, NFTNL_RULE_COMPAT_PROTO) != IPPROTO_UDP)
+		xtables_error(PARAMETER_PROBLEM, "UDP match requires '-p udp'");
+
 	return add_nft_tcpudp(h, r, udp->spts, udp->invflags & XT_UDP_INV_SRCPT,
 			      udp->dpts, udp->invflags & XT_UDP_INV_DSTPT);
 }
@@ -1410,6 +1413,9 @@ static int add_nft_tcp(struct nft_handle *h, struct nftnl_rule *r,
 		return ret;
 	}
 
+	if (nftnl_rule_get_u32(r, NFTNL_RULE_COMPAT_PROTO) != IPPROTO_TCP)
+		xtables_error(PARAMETER_PROBLEM, "TCP match requires '-p tcp'");
+
 	if (tcp->flg_mask) {
 		int ret = add_nft_tcpflags(h, r, tcp->flg_cmp, tcp->flg_mask,
 					   tcp->invflags & XT_TCP_INV_FLAGS);