netfilter: nf_tables: add netlink policy based cap on registers

Should have no effect in practice; all of these use the
nft_parse_register_load/store apis which is mandatory anyway due
to the need to further validate the register load/store, e.g.
that the size argument doesn't result in out-of-bounds load/store.

OTOH this is a simple method to reject obviously wrong input
at earlier stage.

Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index dca9e72b0558ad1c4af93c8251d7a4fe58e15ec4..0b708153469c011d66d0e4d8515e93d66592b4d1 100644 (file)
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -46,6 +46,10 @@ enum nft_registers {
 };
 #define NFT_REG_MAX    (__NFT_REG_MAX - 1)
 
+#ifdef __KERNEL__
+#define NFT_REG32_MAX  NFT_REG32_15
+#endif
+
 #define NFT_REG_SIZE   16
 #define NFT_REG32_SIZE 4
 #define NFT_REG32_COUNT        (NFT_REG32_15 - NFT_REG32_00 + 1)

diff --git a/net/netfilter/nft_bitwise.c b/net/netfilter/nft_bitwise.c
index a4ff781f334d41f1418bf87815b4f7e4b635d3aa..13808e9cd999335a374b864d134e24a2373809e1 100644 (file)
--- a/net/netfilter/nft_bitwise.c
+++ b/net/netfilter/nft_bitwise.c
@@ -125,9 +125,9 @@ void nft_bitwise_eval(const struct nft_expr *expr,
 }
 
 static const struct nla_policy nft_bitwise_policy[NFTA_BITWISE_MAX + 1] = {
-       [NFTA_BITWISE_SREG]     = { .type = NLA_U32 },
-       [NFTA_BITWISE_SREG2]    = { .type = NLA_U32 },
-       [NFTA_BITWISE_DREG]     = { .type = NLA_U32 },
+       [NFTA_BITWISE_SREG]     = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
+       [NFTA_BITWISE_SREG2]    = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
+       [NFTA_BITWISE_DREG]     = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
        [NFTA_BITWISE_LEN]      = { .type = NLA_U32 },
        [NFTA_BITWISE_MASK]     = { .type = NLA_NESTED },
        [NFTA_BITWISE_XOR]      = { .type = NLA_NESTED },

diff --git a/net/netfilter/nft_byteorder.c b/net/netfilter/nft_byteorder.c
index 744878773dac0af0baa8ad95f6b7551d814fbfb9..e00dddfa2fc0abd9ac782d945592ebe9b517e8f1 100644 (file)
--- a/net/netfilter/nft_byteorder.c
+++ b/net/netfilter/nft_byteorder.c
@@ -87,8 +87,8 @@ void nft_byteorder_eval(const struct nft_expr *expr,
 }
 
 static const struct nla_policy nft_byteorder_policy[NFTA_BYTEORDER_MAX + 1] = {
-       [NFTA_BYTEORDER_SREG]   = { .type = NLA_U32 },
-       [NFTA_BYTEORDER_DREG]   = { .type = NLA_U32 },
+       [NFTA_BYTEORDER_SREG]   = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
+       [NFTA_BYTEORDER_DREG]   = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
        [NFTA_BYTEORDER_OP]     = NLA_POLICY_MAX(NLA_BE32, 255),
        [NFTA_BYTEORDER_LEN]    = NLA_POLICY_MAX(NLA_BE32, 255),
        [NFTA_BYTEORDER_SIZE]   = NLA_POLICY_MAX(NLA_BE32, 255),

diff --git a/net/netfilter/nft_cmp.c b/net/netfilter/nft_cmp.c
index b61dc9c3383ee172d7a0da36bc23607aae38dbed..e085c2a00b7057b3f5be4486ada463516e88672c 100644 (file)
--- a/net/netfilter/nft_cmp.c
+++ b/net/netfilter/nft_cmp.c
@@ -64,7 +64,7 @@ mismatch:
 }
 
 static const struct nla_policy nft_cmp_policy[NFTA_CMP_MAX + 1] = {
-       [NFTA_CMP_SREG]         = { .type = NLA_U32 },
+       [NFTA_CMP_SREG]         = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
        [NFTA_CMP_OP]           = { .type = NLA_U32 },
        [NFTA_CMP_DATA]         = { .type = NLA_NESTED },
 };

diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index 00dabd985883f0ee8cc7dc44bb22fdb9c7d0803d..afa7142c529a16c7fa8798105ca3565fcfb7944a 100644 (file)
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -336,10 +336,10 @@ static void nft_ct_set_eval(const struct nft_expr *expr,
 }
 
 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
-       [NFTA_CT_DREG]          = { .type = NLA_U32 },
+       [NFTA_CT_DREG]          = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
        [NFTA_CT_KEY]           = NLA_POLICY_MAX(NLA_BE32, 255),
        [NFTA_CT_DIRECTION]     = NLA_POLICY_MAX(NLA_U8, IP_CT_DIR_REPLY),
-       [NFTA_CT_SREG]          = { .type = NLA_U32 },
+       [NFTA_CT_SREG]          = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
 };
 
 #ifdef CONFIG_NF_CONNTRACK_ZONES

diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
index b997307d94f9f7bf81c30341f16ece9c4c16521e..0407d6f708ae9e82ff1dd7d33ef10508240aaea5 100644 (file)
--- a/net/netfilter/nft_exthdr.c
+++ b/net/netfilter/nft_exthdr.c
@@ -486,13 +486,13 @@ err:
 #endif
 
 static const struct nla_policy nft_exthdr_policy[NFTA_EXTHDR_MAX + 1] = {
-       [NFTA_EXTHDR_DREG]              = { .type = NLA_U32 },
+       [NFTA_EXTHDR_DREG]              = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
        [NFTA_EXTHDR_TYPE]              = { .type = NLA_U8 },
        [NFTA_EXTHDR_OFFSET]            = { .type = NLA_U32 },
        [NFTA_EXTHDR_LEN]               = NLA_POLICY_MAX(NLA_BE32, 255),
        [NFTA_EXTHDR_FLAGS]             = NLA_POLICY_MASK(NLA_BE32, NFT_EXTHDR_F_PRESENT),
        [NFTA_EXTHDR_OP]                = NLA_POLICY_MAX(NLA_BE32, 255),
-       [NFTA_EXTHDR_SREG]              = { .type = NLA_U32 },
+       [NFTA_EXTHDR_SREG]              = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
 };
 
 static int nft_exthdr_init(const struct nft_ctx *ctx,

diff --git a/net/netfilter/nft_fib.c b/net/netfilter/nft_fib.c
index f7dc0e54375f0810c06c9cd54620437d4253372a..327a5f33659cd79da08a430ed5676c25df72e58b 100644 (file)
--- a/net/netfilter/nft_fib.c
+++ b/net/netfilter/nft_fib.c
@@ -19,7 +19,7 @@
                        NFTA_FIB_F_PRESENT)
 
 const struct nla_policy nft_fib_policy[NFTA_FIB_MAX + 1] = {
-       [NFTA_FIB_DREG]         = { .type = NLA_U32 },
+       [NFTA_FIB_DREG]         = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
        [NFTA_FIB_RESULT]       = { .type = NLA_U32 },
        [NFTA_FIB_FLAGS]        =
                NLA_POLICY_MASK(NLA_BE32, NFTA_FIB_F_ALL),

diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
index 1cf41e0a0e0c8c04f97b52811c20b9f7db9c74ae..3bacc9b53789898f7e3d8ca8c578584e48f08ad4 100644 (file)
--- a/net/netfilter/nft_hash.c
+++ b/net/netfilter/nft_hash.c
@@ -58,8 +58,8 @@ static void nft_symhash_eval(const struct nft_expr *expr,
 }
 
 static const struct nla_policy nft_hash_policy[NFTA_HASH_MAX + 1] = {
-       [NFTA_HASH_SREG]        = { .type = NLA_U32 },
-       [NFTA_HASH_DREG]        = { .type = NLA_U32 },
+       [NFTA_HASH_SREG]        = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
+       [NFTA_HASH_DREG]        = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
        [NFTA_HASH_LEN]         = NLA_POLICY_MAX(NLA_BE32, 255),
        [NFTA_HASH_MODULUS]     = { .type = NLA_U32 },
        [NFTA_HASH_SEED]        = { .type = NLA_U32 },

diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c
index 37c29947b380b4d85e9cf497b16d08300665c7b7..1b733c7b1b0e7c92d2933c56f62653e6a4d3d72f 100644 (file)
--- a/net/netfilter/nft_immediate.c
+++ b/net/netfilter/nft_immediate.c
@@ -25,7 +25,7 @@ void nft_immediate_eval(const struct nft_expr *expr,
 }
 
 static const struct nla_policy nft_immediate_policy[NFTA_IMMEDIATE_MAX + 1] = {
-       [NFTA_IMMEDIATE_DREG]   = { .type = NLA_U32 },
+       [NFTA_IMMEDIATE_DREG]   = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
        [NFTA_IMMEDIATE_DATA]   = { .type = NLA_NESTED },
 };
 

diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c
index e4e6190275429a3856891160bd697a5fdb632eb2..9fafe5afc490e0f4b2df7aa7eae90cb1b30538dd 100644 (file)
--- a/net/netfilter/nft_lookup.c
+++ b/net/netfilter/nft_lookup.c
@@ -125,8 +125,8 @@ static const struct nla_policy nft_lookup_policy[NFTA_LOOKUP_MAX + 1] = {
        [NFTA_LOOKUP_SET]       = { .type = NLA_STRING,
                                    .len = NFT_SET_MAXNAMELEN - 1 },
        [NFTA_LOOKUP_SET_ID]    = { .type = NLA_U32 },
-       [NFTA_LOOKUP_SREG]      = { .type = NLA_U32 },
-       [NFTA_LOOKUP_DREG]      = { .type = NLA_U32 },
+       [NFTA_LOOKUP_SREG]      = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
+       [NFTA_LOOKUP_DREG]      = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
        [NFTA_LOOKUP_FLAGS]     =
                NLA_POLICY_MASK(NLA_BE32, NFT_LOOKUP_F_INV),
 };

diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index d0df6cf374d1abe83ce2a02d93fb366e12b3d8d2..7478063339d4dd3adcb950ded542c4eeb9121e0e 100644 (file)
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -460,9 +460,9 @@ void nft_meta_set_eval(const struct nft_expr *expr,
 EXPORT_SYMBOL_GPL(nft_meta_set_eval);
 
 const struct nla_policy nft_meta_policy[NFTA_META_MAX + 1] = {
-       [NFTA_META_DREG]        = { .type = NLA_U32 },
+       [NFTA_META_DREG]        = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
        [NFTA_META_KEY]         = NLA_POLICY_MAX(NLA_BE32, 255),
-       [NFTA_META_SREG]        = { .type = NLA_U32 },
+       [NFTA_META_SREG]        = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
 };
 EXPORT_SYMBOL_GPL(nft_meta_policy);
 

diff --git a/net/netfilter/nft_numgen.c b/net/netfilter/nft_numgen.c
index 4d69b339919568c97079cf32db7eb9a60beaffc3..b0c802370159720da9d69495258b7131a2ce262c 100644 (file)
--- a/net/netfilter/nft_numgen.c
+++ b/net/netfilter/nft_numgen.c
@@ -43,7 +43,7 @@ static void nft_ng_inc_eval(const struct nft_expr *expr,
 }
 
 static const struct nla_policy nft_ng_policy[NFTA_NG_MAX + 1] = {
-       [NFTA_NG_DREG]          = { .type = NLA_U32 },
+       [NFTA_NG_DREG]          = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
        [NFTA_NG_MODULUS]       = { .type = NLA_U32 },
        [NFTA_NG_TYPE]          = { .type = NLA_U32 },
        [NFTA_NG_OFFSET]        = { .type = NLA_U32 },

diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c
index 633cce69568f137f28bad81d4be9dea65427b4e7..249ded517446981c9849941ad791ceeed86bbdbf 100644 (file)
--- a/net/netfilter/nft_objref.c
+++ b/net/netfilter/nft_objref.c
@@ -265,7 +265,7 @@ static const struct nla_policy nft_objref_policy[NFTA_OBJREF_MAX + 1] = {
        [NFTA_OBJREF_IMM_NAME]  = { .type = NLA_STRING,
                                    .len = NFT_OBJ_MAXNAMELEN - 1 },
        [NFTA_OBJREF_IMM_TYPE]  = { .type = NLA_U32 },
-       [NFTA_OBJREF_SET_SREG]  = { .type = NLA_U32 },
+       [NFTA_OBJREF_SET_SREG]  = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
        [NFTA_OBJREF_SET_NAME]  = { .type = NLA_STRING,
                                    .len = NFT_SET_MAXNAMELEN - 1 },
        [NFTA_OBJREF_SET_ID]    = { .type = NLA_U32 },

diff --git a/net/netfilter/nft_osf.c b/net/netfilter/nft_osf.c
index b2f44bc6bd3fccfdf73e6fdbd03dc6dc7bf48409..18003433476cdaf37fe293bc265c67da3dbf6fd4 100644 (file)
--- a/net/netfilter/nft_osf.c
+++ b/net/netfilter/nft_osf.c
@@ -12,7 +12,7 @@ struct nft_osf {
 };
 
 static const struct nla_policy nft_osf_policy[NFTA_OSF_MAX + 1] = {
-       [NFTA_OSF_DREG]         = { .type = NLA_U32 },
+       [NFTA_OSF_DREG]         = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
        [NFTA_OSF_TTL]          = { .type = NLA_U8 },
        [NFTA_OSF_FLAGS]        = NLA_POLICY_MASK(NLA_BE32, NFT_OSF_F_VERSION),
 };

diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index 91b62083d9427e1a640bf1f3e5a5045673bff484..3fa3c6c835be0fc16721a7ffad072de61ac51c76 100644 (file)
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -209,8 +209,8 @@ err:
 }
 
 static const struct nla_policy nft_payload_policy[NFTA_PAYLOAD_MAX + 1] = {
-       [NFTA_PAYLOAD_SREG]             = { .type = NLA_U32 },
-       [NFTA_PAYLOAD_DREG]             = { .type = NLA_U32 },
+       [NFTA_PAYLOAD_SREG]             = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
+       [NFTA_PAYLOAD_DREG]             = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
        [NFTA_PAYLOAD_BASE]             = { .type = NLA_U32 },
        [NFTA_PAYLOAD_OFFSET]           = { .type = NLA_BE32 },
        [NFTA_PAYLOAD_LEN]              = NLA_POLICY_MAX(NLA_BE32, 255),

diff --git a/net/netfilter/nft_range.c b/net/netfilter/nft_range.c
index cbb02644b836267c189b08471d42c8d21d059b86..f8a1641afccf315e91a5146dd65227b6c724e558 100644 (file)
--- a/net/netfilter/nft_range.c
+++ b/net/netfilter/nft_range.c
@@ -41,7 +41,7 @@ void nft_range_eval(const struct nft_expr *expr,
 }
 
 static const struct nla_policy nft_range_policy[NFTA_RANGE_MAX + 1] = {
-       [NFTA_RANGE_SREG]               = { .type = NLA_U32 },
+       [NFTA_RANGE_SREG]               = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
        [NFTA_RANGE_OP]                 = NLA_POLICY_MAX(NLA_BE32, 255),
        [NFTA_RANGE_FROM_DATA]          = { .type = NLA_NESTED },
        [NFTA_RANGE_TO_DATA]            = { .type = NLA_NESTED },

diff --git a/net/netfilter/nft_rt.c b/net/netfilter/nft_rt.c
index ad527f3596c03a84917aa2b406c1c5dc76bc7670..e23cd47598514e31e3638d47ce4bf6a61ed78455 100644 (file)
--- a/net/netfilter/nft_rt.c
+++ b/net/netfilter/nft_rt.c
@@ -103,7 +103,7 @@ err:
 }
 
 static const struct nla_policy nft_rt_policy[NFTA_RT_MAX + 1] = {
-       [NFTA_RT_DREG]          = { .type = NLA_U32 },
+       [NFTA_RT_DREG]          = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
        [NFTA_RT_KEY]           = NLA_POLICY_MAX(NLA_BE32, 255),
 };
 

diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c
index c55a1310226a43e8d52bf305ceb5448c8e94b874..a146a45d7531eb3ac1ae9bfaec62e71d0964f107 100644 (file)
--- a/net/netfilter/nft_socket.c
+++ b/net/netfilter/nft_socket.c
@@ -163,7 +163,7 @@ out_put_sk:
 
 static const struct nla_policy nft_socket_policy[NFTA_SOCKET_MAX + 1] = {
        [NFTA_SOCKET_KEY]               = NLA_POLICY_MAX(NLA_BE32, 255),
-       [NFTA_SOCKET_DREG]              = { .type = NLA_U32 },
+       [NFTA_SOCKET_DREG]              = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
        [NFTA_SOCKET_LEVEL]             = NLA_POLICY_MAX(NLA_BE32, 255),
 };
 

diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c
index 65d06300f48a1bdbbc029297cb466972a412c376..0b987bc2132aeeaf7750d5377290308862d6578f 100644 (file)
--- a/net/netfilter/nft_tunnel.c
+++ b/net/netfilter/nft_tunnel.c
@@ -67,7 +67,7 @@ static void nft_tunnel_get_eval(const struct nft_expr *expr,
 
 static const struct nla_policy nft_tunnel_policy[NFTA_TUNNEL_MAX + 1] = {
        [NFTA_TUNNEL_KEY]       = NLA_POLICY_MAX(NLA_BE32, 255),
-       [NFTA_TUNNEL_DREG]      = { .type = NLA_U32 },
+       [NFTA_TUNNEL_DREG]      = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
        [NFTA_TUNNEL_MODE]      = NLA_POLICY_MAX(NLA_BE32, NFT_TUNNEL_MODE_MAX),
 };
 

diff --git a/net/netfilter/nft_xfrm.c b/net/netfilter/nft_xfrm.c
index 6858cd2d16a4aff73ba9e7e21b752462cc29a0ed..65a75d88e5f0fed8a7327b2b937923199b2a292d 100644 (file)
--- a/net/netfilter/nft_xfrm.c
+++ b/net/netfilter/nft_xfrm.c
@@ -19,7 +19,7 @@ static const struct nla_policy nft_xfrm_policy[NFTA_XFRM_MAX + 1] = {
        [NFTA_XFRM_KEY]         = NLA_POLICY_MAX(NLA_BE32, 255),
        [NFTA_XFRM_DIR]         = NLA_POLICY_MAX(NLA_U8, XFRM_POLICY_OUT),
        [NFTA_XFRM_SPNUM]       = NLA_POLICY_MAX(NLA_BE32, XFRM_MAX_DEPTH - 1),
-       [NFTA_XFRM_DREG]        = { .type = NLA_U32 },
+       [NFTA_XFRM_DREG]        = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
 };
 
 struct nft_xfrm {