netfilter: add more netlink-based policy range checks

These spots either already check the attribute range manually
before use or the consuming functions tolerate unexpected values.

Nevertheless, add more range checks via netlink policy so we gain
more users and avoid possible re-use in other places that might
not have the required manual checks.  This also improves error
reporting: netlink core can generate extack errors.

Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index d0c9fe59c67d2a81ef498e2340b5d7f79c31a883..c5a26236a0bb847c4b5c4731aa43c601c6dea26a 100644 (file)
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -985,7 +985,7 @@ static const struct nla_policy ip_set_create_policy[IPSET_ATTR_CMD_MAX + 1] = {
                                    .len = IPSET_MAXNAMELEN - 1 },
        [IPSET_ATTR_TYPENAME]   = { .type = NLA_NUL_STRING,
                                    .len = IPSET_MAXNAMELEN - 1},
-       [IPSET_ATTR_REVISION]   = { .type = NLA_U8 },
+       [IPSET_ATTR_REVISION]   = NLA_POLICY_MAX(NLA_U8, IPSET_REVISION_MAX),
        [IPSET_ATTR_FAMILY]     = { .type = NLA_U8 },
        [IPSET_ATTR_DATA]       = { .type = NLA_NESTED },
 };

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 8ed8d5384b970125d2b6b9f37bb40cd5e5e62f21..8537b94653d374f9a82e7e377650a30578e62749 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1112,7 +1112,7 @@ static __be16 nft_base_seq_be16(const struct net *net)
 static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
        [NFTA_TABLE_NAME]       = { .type = NLA_STRING,
                                    .len = NFT_TABLE_MAXNAMELEN - 1 },
-       [NFTA_TABLE_FLAGS]      = { .type = NLA_U32 },
+       [NFTA_TABLE_FLAGS]      = NLA_POLICY_MASK(NLA_BE32, NFT_TABLE_F_MASK),
        [NFTA_TABLE_HANDLE]     = { .type = NLA_U64 },
        [NFTA_TABLE_USERDATA]   = { .type = NLA_BINARY,
                                    .len = NFT_USERDATA_MAXLEN }
@@ -1878,7 +1878,7 @@ static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
        [NFTA_CHAIN_TYPE]       = { .type = NLA_STRING,
                                    .len = NFT_MODULE_AUTOLOAD_LIMIT },
        [NFTA_CHAIN_COUNTERS]   = { .type = NLA_NESTED },
-       [NFTA_CHAIN_FLAGS]      = { .type = NLA_U32 },
+       [NFTA_CHAIN_FLAGS]      = NLA_POLICY_MASK(NLA_BE32, NFT_CHAIN_FLAGS),
        [NFTA_CHAIN_ID]         = { .type = NLA_U32 },
        [NFTA_CHAIN_USERDATA]   = { .type = NLA_BINARY,
                                    .len = NFT_USERDATA_MAXLEN },
@@ -4597,7 +4597,16 @@ static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
                                            .len = NFT_TABLE_MAXNAMELEN - 1 },
        [NFTA_SET_NAME]                 = { .type = NLA_STRING,
                                            .len = NFT_SET_MAXNAMELEN - 1 },
-       [NFTA_SET_FLAGS]                = { .type = NLA_U32 },
+       [NFTA_SET_FLAGS]                = NLA_POLICY_MASK(NLA_BE32,
+                                                         NFT_SET_ANONYMOUS |
+                                                         NFT_SET_CONSTANT |
+                                                         NFT_SET_INTERVAL |
+                                                         NFT_SET_MAP |
+                                                         NFT_SET_TIMEOUT |
+                                                         NFT_SET_EVAL |
+                                                         NFT_SET_OBJECT |
+                                                         NFT_SET_CONCAT |
+                                                         NFT_SET_EXPR),
        [NFTA_SET_KEY_TYPE]             = { .type = NLA_U32 },
        [NFTA_SET_KEY_LEN]              = { .type = NLA_U32 },
        [NFTA_SET_DATA_TYPE]            = { .type = NLA_U32 },
@@ -5929,7 +5938,8 @@ const struct nft_set_ext_type nft_set_ext_types[] = {
 static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
        [NFTA_SET_ELEM_KEY]             = { .type = NLA_NESTED },
        [NFTA_SET_ELEM_DATA]            = { .type = NLA_NESTED },
-       [NFTA_SET_ELEM_FLAGS]           = { .type = NLA_U32 },
+       [NFTA_SET_ELEM_FLAGS]           = NLA_POLICY_MASK(NLA_BE32, NFT_SET_ELEM_INTERVAL_END |
+                                                                   NFT_SET_ELEM_CATCHALL),
        [NFTA_SET_ELEM_TIMEOUT]         = { .type = NLA_U64 },
        [NFTA_SET_ELEM_EXPIRATION]      = { .type = NLA_U64 },
        [NFTA_SET_ELEM_USERDATA]        = { .type = NLA_BINARY,
@@ -8649,7 +8659,7 @@ static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = {
                                            .len = NFT_NAME_MAXLEN - 1 },
        [NFTA_FLOWTABLE_HOOK]           = { .type = NLA_NESTED },
        [NFTA_FLOWTABLE_HANDLE]         = { .type = NLA_U64 },
-       [NFTA_FLOWTABLE_FLAGS]          = { .type = NLA_U32 },
+       [NFTA_FLOWTABLE_FLAGS]          = NLA_POLICY_MASK(NLA_BE32, NFT_FLOWTABLE_MASK),
 };
 
 struct nft_flowtable *nft_flowtable_lookup(const struct net *net,

diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
index 2bfaa773d82ffbcc208ed5be0e2a29a473fef456..8ff1e0ad5cb0d4c8d3d61a10a464c6e6739a5e09 100644 (file)
--- a/net/netfilter/nfnetlink_acct.c
+++ b/net/netfilter/nfnetlink_acct.c
@@ -373,7 +373,7 @@ static const struct nla_policy nfnl_acct_policy[NFACCT_MAX+1] = {
        [NFACCT_NAME] = { .type = NLA_NUL_STRING, .len = NFACCT_NAME_MAX-1 },
        [NFACCT_BYTES] = { .type = NLA_U64 },
        [NFACCT_PKTS] = { .type = NLA_U64 },
-       [NFACCT_FLAGS] = { .type = NLA_U32 },
+       [NFACCT_FLAGS] = NLA_POLICY_MASK(NLA_BE32, NFACCT_F_QUOTA),
        [NFACCT_QUOTA] = { .type = NLA_U64 },
        [NFACCT_FILTER] = {.type = NLA_NESTED },
 };

diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index d545fa4594558ba7b1611a87d3bcce54e528dd31..0d16ad82d70c0157804dc27359ba38ddfa261e0c 100644 (file)
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -165,7 +165,7 @@ nfnl_cthelper_expect_policy(struct nf_conntrack_expect_policy *expect_policy,
 
 static const struct nla_policy
 nfnl_cthelper_expect_policy_set[NFCTH_POLICY_SET_MAX+1] = {
-       [NFCTH_POLICY_SET_NUM] = { .type = NLA_U32, },
+       [NFCTH_POLICY_SET_NUM] = NLA_POLICY_MAX(NLA_BE32, NF_CT_MAX_EXPECT_CLASSES),
 };
 
 static int

diff --git a/net/netfilter/nfnetlink_hook.c b/net/netfilter/nfnetlink_hook.c
index 531706982859089a03226848fb68800bef007b9e..5623c18fcd12f09acb3b30668d18797304898a7d 100644 (file)
--- a/net/netfilter/nfnetlink_hook.c
+++ b/net/netfilter/nfnetlink_hook.c
@@ -24,7 +24,7 @@
 #include <net/sock.h>
 
 static const struct nla_policy nfnl_hook_nla_policy[NFNLA_HOOK_MAX + 1] = {
-       [NFNLA_HOOK_HOOKNUM]    = { .type = NLA_U32 },
+       [NFNLA_HOOK_HOOKNUM]    = NLA_POLICY_MAX(NLA_BE32, 255),
        [NFNLA_HOOK_PRIORITY]   = { .type = NLA_U32 },
        [NFNLA_HOOK_DEV]        = { .type = NLA_STRING,
                                    .len = IFNAMSIZ - 1 },

diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 91aa210b3e53eb4d5a266acbff8b4fab8bd876f0..9497ebeedd55fbad004a9db1801b8b0c632f4e6c 100644 (file)
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -879,7 +879,9 @@ static const struct nla_policy nfula_cfg_policy[NFULA_CFG_MAX+1] = {
        [NFULA_CFG_TIMEOUT]     = { .type = NLA_U32 },
        [NFULA_CFG_QTHRESH]     = { .type = NLA_U32 },
        [NFULA_CFG_NLBUFSIZ]    = { .type = NLA_U32 },
-       [NFULA_CFG_FLAGS]       = { .type = NLA_U16 },
+       [NFULA_CFG_FLAGS]       = NLA_POLICY_MASK(NLA_BE16, NFULNL_CFG_F_SEQ |
+                                                 NFULNL_CFG_F_SEQ_GLOBAL |
+                                                 NFULNL_CFG_F_CONNTRACK),
 };
 
 static int nfulnl_recv_config(struct sk_buff *skb, const struct nfnl_info *info,

diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c
index 45d9ad231a92042e8aa83592274c48f10ccde47e..d64ce21c7b554209093ea27f762f525b567a602a 100644 (file)
--- a/net/netfilter/nfnetlink_osf.c
+++ b/net/netfilter/nfnetlink_osf.c
@@ -293,7 +293,7 @@ bool nf_osf_find(const struct sk_buff *skb,
 EXPORT_SYMBOL_GPL(nf_osf_find);
 
 static const struct nla_policy nfnl_osf_policy[OSF_ATTR_MAX + 1] = {
-       [OSF_ATTR_FINGER]       = { .len = sizeof(struct nf_osf_user_finger) },
+       [OSF_ATTR_FINGER]       = NLA_POLICY_EXACT_LEN(sizeof(struct nf_osf_user_finger)),
 };
 
 static int nfnl_osf_add_callback(struct sk_buff *skb,

diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 2aa2380d976afa994b9fe9d648d5232dadfddaa8..ac0c192336812b07926eeb72133e49679ab12601 100644 (file)
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -1599,7 +1599,7 @@ static const struct nla_policy nfqa_cfg_policy[NFQA_CFG_MAX+1] = {
        [NFQA_CFG_PARAMS]       = { .len = sizeof(struct nfqnl_msg_config_params) },
        [NFQA_CFG_QUEUE_MAXLEN] = { .type = NLA_U32 },
        [NFQA_CFG_MASK]         = { .type = NLA_U32 },
-       [NFQA_CFG_FLAGS]        = { .type = NLA_U32 },
+       [NFQA_CFG_FLAGS]        = NLA_POLICY_MASK(NLA_BE32, NFQA_CFG_F_MAX - 1),
 };
 
 static const struct nf_queue_handler nfqh = {

diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 53a614a0e3cdf775fd9bccced40c62adfbf46f3c..decc725a33c251f73d8e8370ef8ea666d4aca033 100644 (file)
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -195,7 +195,7 @@ static void target_compat_from_user(struct xt_target *t, void *in, void *out)
 
 static const struct nla_policy nft_rule_compat_policy[NFTA_RULE_COMPAT_MAX + 1] = {
        [NFTA_RULE_COMPAT_PROTO]        = { .type = NLA_U32 },
-       [NFTA_RULE_COMPAT_FLAGS]        = { .type = NLA_U32 },
+       [NFTA_RULE_COMPAT_FLAGS]        = NLA_POLICY_MASK(NLA_BE32, NFT_RULE_COMPAT_F_MASK),
 };
 
 static int nft_parse_compat(const struct nlattr *attr, u16 *proto, bool *inv)

diff --git a/net/netfilter/nft_connlimit.c b/net/netfilter/nft_connlimit.c
index 09ac4f77e3899e26daa5185d1db4810d6d8b184f..46b31d78abc6dbbe46c5007ff91d8e50f4d5506e 100644 (file)
--- a/net/netfilter/nft_connlimit.c
+++ b/net/netfilter/nft_connlimit.c
@@ -159,7 +159,7 @@ static int nft_connlimit_obj_dump(struct sk_buff *skb,
 
 static const struct nla_policy nft_connlimit_policy[NFTA_CONNLIMIT_MAX + 1] = {
        [NFTA_CONNLIMIT_COUNT]  = { .type = NLA_U32 },
-       [NFTA_CONNLIMIT_FLAGS]  = { .type = NLA_U32 },
+       [NFTA_CONNLIMIT_FLAGS]  = NLA_POLICY_MASK(NLA_BE32, NFT_CONNLIMIT_F_INV),
 };
 
 static struct nft_object_type nft_connlimit_obj_type;

diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index a8fcb4b6ea1a44b0ff89ec739491eb1f4db0f0ed..00dabd985883f0ee8cc7dc44bb22fdb9c7d0803d 100644 (file)
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -338,7 +338,7 @@ static void nft_ct_set_eval(const struct nft_expr *expr,
 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
        [NFTA_CT_DREG]          = { .type = NLA_U32 },
        [NFTA_CT_KEY]           = NLA_POLICY_MAX(NLA_BE32, 255),
-       [NFTA_CT_DIRECTION]     = { .type = NLA_U8 },
+       [NFTA_CT_DIRECTION]     = NLA_POLICY_MAX(NLA_U8, IP_CT_DIR_REPLY),
        [NFTA_CT_SREG]          = { .type = NLA_U32 },
 };
 

diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
index 57bf94ae8724a9a7aeeab433953b881091d0ed29..ee9d3e7b1ecf1ae3de44b5bbaf90156721c66a8f 100644 (file)
--- a/net/netfilter/nft_dynset.c
+++ b/net/netfilter/nft_dynset.c
@@ -163,7 +163,8 @@ static const struct nla_policy nft_dynset_policy[NFTA_DYNSET_MAX + 1] = {
        [NFTA_DYNSET_SREG_DATA] = { .type = NLA_U32 },
        [NFTA_DYNSET_TIMEOUT]   = { .type = NLA_U64 },
        [NFTA_DYNSET_EXPR]      = { .type = NLA_NESTED },
-       [NFTA_DYNSET_FLAGS]     = { .type = NLA_U32 },
+       [NFTA_DYNSET_FLAGS]     = NLA_POLICY_MASK(NLA_BE32, NFT_DYNSET_F_INV |
+                                                 NFT_DYNSET_F_EXPR),
        [NFTA_DYNSET_EXPRESSIONS] = { .type = NLA_NESTED },
 };
 

diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
index 14d4ad7f518cfdac70ab7e9438ac030a2830a79f..b997307d94f9f7bf81c30341f16ece9c4c16521e 100644 (file)
--- a/net/netfilter/nft_exthdr.c
+++ b/net/netfilter/nft_exthdr.c
@@ -490,7 +490,7 @@ static const struct nla_policy nft_exthdr_policy[NFTA_EXTHDR_MAX + 1] = {
        [NFTA_EXTHDR_TYPE]              = { .type = NLA_U8 },
        [NFTA_EXTHDR_OFFSET]            = { .type = NLA_U32 },
        [NFTA_EXTHDR_LEN]               = NLA_POLICY_MAX(NLA_BE32, 255),
-       [NFTA_EXTHDR_FLAGS]             = { .type = NLA_U32 },
+       [NFTA_EXTHDR_FLAGS]             = NLA_POLICY_MASK(NLA_BE32, NFT_EXTHDR_F_PRESENT),
        [NFTA_EXTHDR_OP]                = NLA_POLICY_MAX(NLA_BE32, 255),
        [NFTA_EXTHDR_SREG]              = { .type = NLA_U32 },
 };

diff --git a/net/netfilter/nft_inner.c b/net/netfilter/nft_inner.c
index c4569d4b92285338b903b7d876efcba09238f0ca..03ffb1159fc183f5aa85a149fedbe135a89b9126 100644 (file)
--- a/net/netfilter/nft_inner.c
+++ b/net/netfilter/nft_inner.c
@@ -321,7 +321,7 @@ err:
 
 static const struct nla_policy nft_inner_policy[NFTA_INNER_MAX + 1] = {
        [NFTA_INNER_NUM]        = { .type = NLA_U32 },
-       [NFTA_INNER_FLAGS]      = { .type = NLA_U32 },
+       [NFTA_INNER_FLAGS]      = NLA_POLICY_MASK(NLA_BE32, NFT_INNER_MASK),
        [NFTA_INNER_HDRSIZE]    = { .type = NLA_U32 },
        [NFTA_INNER_TYPE]       = { .type = NLA_U32 },
        [NFTA_INNER_EXPR]       = { .type = NLA_NESTED },

diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c
index f6830621c471c06f66af1eb767d8f0eed641ba18..167d99b1447fa23e865832dea543fb19b75cb56c 100644 (file)
--- a/net/netfilter/nft_limit.c
+++ b/net/netfilter/nft_limit.c
@@ -189,7 +189,7 @@ static const struct nla_policy nft_limit_policy[NFTA_LIMIT_MAX + 1] = {
        [NFTA_LIMIT_UNIT]       = { .type = NLA_U64 },
        [NFTA_LIMIT_BURST]      = { .type = NLA_U32 },
        [NFTA_LIMIT_TYPE]       = { .type = NLA_U32 },
-       [NFTA_LIMIT_FLAGS]      = { .type = NLA_U32 },
+       [NFTA_LIMIT_FLAGS]      = NLA_POLICY_MASK(NLA_BE32, NFT_LIMIT_F_INV),
 };
 
 static int nft_limit_pkts_init(const struct nft_ctx *ctx,

diff --git a/net/netfilter/nft_log.c b/net/netfilter/nft_log.c
index da0c0d1c9cea2883d69293bec2074181f837791c..0d868eea6257d2c75f8851a2b28d139e198d7f9f 100644 (file)
--- a/net/netfilter/nft_log.c
+++ b/net/netfilter/nft_log.c
@@ -69,7 +69,7 @@ static const struct nla_policy nft_log_policy[NFTA_LOG_MAX + 1] = {
        [NFTA_LOG_SNAPLEN]      = { .type = NLA_U32 },
        [NFTA_LOG_QTHRESHOLD]   = { .type = NLA_U16 },
        [NFTA_LOG_LEVEL]        = { .type = NLA_U32 },
-       [NFTA_LOG_FLAGS]        = { .type = NLA_U32 },
+       [NFTA_LOG_FLAGS]        = NLA_POLICY_MASK(NLA_BE32, NF_LOG_MASK),
 };
 
 static int nft_log_modprobe(struct net *net, enum nf_log_type t)

diff --git a/net/netfilter/nft_osf.c b/net/netfilter/nft_osf.c
index 39ccd67ed265ab53a5529292ac826ca9fbe498e3..b2f44bc6bd3fccfdf73e6fdbd03dc6dc7bf48409 100644 (file)
--- a/net/netfilter/nft_osf.c
+++ b/net/netfilter/nft_osf.c
@@ -14,7 +14,7 @@ struct nft_osf {
 static const struct nla_policy nft_osf_policy[NFTA_OSF_MAX + 1] = {
        [NFTA_OSF_DREG]         = { .type = NLA_U32 },
        [NFTA_OSF_TTL]          = { .type = NLA_U8 },
-       [NFTA_OSF_FLAGS]        = { .type = NLA_U32 },
+       [NFTA_OSF_FLAGS]        = NLA_POLICY_MASK(NLA_BE32, NFT_OSF_F_VERSION),
 };
 
 static void nft_osf_eval(const struct nft_expr *expr, struct nft_regs *regs,

diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index 973d56af03ff2a49c0a2bbaa35a12f8ed2ba7355..91b62083d9427e1a640bf1f3e5a5045673bff484 100644 (file)
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -216,7 +216,7 @@ static const struct nla_policy nft_payload_policy[NFTA_PAYLOAD_MAX + 1] = {
        [NFTA_PAYLOAD_LEN]              = NLA_POLICY_MAX(NLA_BE32, 255),
        [NFTA_PAYLOAD_CSUM_TYPE]        = { .type = NLA_U32 },
        [NFTA_PAYLOAD_CSUM_OFFSET]      = NLA_POLICY_MAX(NLA_BE32, 255),
-       [NFTA_PAYLOAD_CSUM_FLAGS]       = { .type = NLA_U32 },
+       [NFTA_PAYLOAD_CSUM_FLAGS]       = NLA_POLICY_MASK(NLA_BE32, NFT_PAYLOAD_L4CSUM_PSEUDOHDR),
 };
 
 static int nft_payload_init(const struct nft_ctx *ctx,

diff --git a/net/netfilter/nft_queue.c b/net/netfilter/nft_queue.c
index 8eb13a02942ed3cdabd1588a0e0b1117f93e8ca5..b83d209db8864e1f2474fea226169c99c30ab510 100644 (file)
--- a/net/netfilter/nft_queue.c
+++ b/net/netfilter/nft_queue.c
@@ -95,7 +95,7 @@ static int nft_queue_validate(const struct nft_ctx *ctx,
 static const struct nla_policy nft_queue_policy[NFTA_QUEUE_MAX + 1] = {
        [NFTA_QUEUE_NUM]        = { .type = NLA_U16 },
        [NFTA_QUEUE_TOTAL]      = { .type = NLA_U16 },
-       [NFTA_QUEUE_FLAGS]      = { .type = NLA_U16 },
+       [NFTA_QUEUE_FLAGS]      = NLA_POLICY_MASK(NLA_BE16, NFT_QUEUE_FLAG_MASK),
        [NFTA_QUEUE_SREG_QNUM]  = { .type = NLA_U32 },
 };
 

diff --git a/net/netfilter/nft_quota.c b/net/netfilter/nft_quota.c
index 3be788e5223c364298a54c9f195f38aa9b26c6fe..6ed7c4409706bddc5539c906a68d80fc02d02086 100644 (file)
--- a/net/netfilter/nft_quota.c
+++ b/net/netfilter/nft_quota.c
@@ -46,7 +46,7 @@ static inline void nft_quota_do_eval(struct nft_quota *priv,
 
 static const struct nla_policy nft_quota_policy[NFTA_QUOTA_MAX + 1] = {
        [NFTA_QUOTA_BYTES]      = { .type = NLA_U64 },
-       [NFTA_QUOTA_FLAGS]      = { .type = NLA_U32 },
+       [NFTA_QUOTA_FLAGS]      = NLA_POLICY_MASK(NLA_BE32, NFT_QUOTA_F_INV),
        [NFTA_QUOTA_CONSUMED]   = { .type = NLA_U64 },
 };
 

diff --git a/net/netfilter/nft_synproxy.c b/net/netfilter/nft_synproxy.c
index 8e452a8749693f4e51aa3a31ee0ebfa8a04bb24a..7641f249614c9728846aeaecd8eb988037c315c3 100644 (file)
--- a/net/netfilter/nft_synproxy.c
+++ b/net/netfilter/nft_synproxy.c
@@ -17,8 +17,8 @@ struct nft_synproxy {
 
 static const struct nla_policy nft_synproxy_policy[NFTA_SYNPROXY_MAX + 1] = {
        [NFTA_SYNPROXY_MSS]             = { .type = NLA_U16 },
-       [NFTA_SYNPROXY_WSCALE]          = { .type = NLA_U8 },
-       [NFTA_SYNPROXY_FLAGS]           = { .type = NLA_U32 },
+       [NFTA_SYNPROXY_WSCALE]          = NLA_POLICY_MAX(NLA_U8, TCP_MAX_WSCALE),
+       [NFTA_SYNPROXY_FLAGS]           = NLA_POLICY_MASK(NLA_BE32, NF_SYNPROXY_OPT_MASK),
 };
 
 static void nft_synproxy_tcp_options(struct synproxy_options *opts,

diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c
index f5cadba91417ae5cf3c666398eee493ae016204b..65d06300f48a1bdbbc029297cb466972a412c376 100644 (file)
--- a/net/netfilter/nft_tunnel.c
+++ b/net/netfilter/nft_tunnel.c
@@ -68,7 +68,7 @@ static void nft_tunnel_get_eval(const struct nft_expr *expr,
 static const struct nla_policy nft_tunnel_policy[NFTA_TUNNEL_MAX + 1] = {
        [NFTA_TUNNEL_KEY]       = NLA_POLICY_MAX(NLA_BE32, 255),
        [NFTA_TUNNEL_DREG]      = { .type = NLA_U32 },
-       [NFTA_TUNNEL_MODE]      = NLA_POLICY_MAX(NLA_BE32, 255),
+       [NFTA_TUNNEL_MODE]      = NLA_POLICY_MAX(NLA_BE32, NFT_TUNNEL_MODE_MAX),
 };
 
 static int nft_tunnel_get_init(const struct nft_ctx *ctx,
@@ -408,7 +408,7 @@ static const struct nla_policy nft_tunnel_key_policy[NFTA_TUNNEL_KEY_MAX + 1] =
        [NFTA_TUNNEL_KEY_IP]    = { .type = NLA_NESTED, },
        [NFTA_TUNNEL_KEY_IP6]   = { .type = NLA_NESTED, },
        [NFTA_TUNNEL_KEY_ID]    = { .type = NLA_U32, },
-       [NFTA_TUNNEL_KEY_FLAGS] = { .type = NLA_U32, },
+       [NFTA_TUNNEL_KEY_FLAGS] = NLA_POLICY_MASK(NLA_BE32, NFT_TUNNEL_F_MASK),
        [NFTA_TUNNEL_KEY_TOS]   = { .type = NLA_U8, },
        [NFTA_TUNNEL_KEY_TTL]   = { .type = NLA_U8, },
        [NFTA_TUNNEL_KEY_SPORT] = { .type = NLA_U16, },

diff --git a/net/netfilter/nft_xfrm.c b/net/netfilter/nft_xfrm.c
index 7ffe6a2690d13d6cfa066645da7a9ce1ba6ca0d6..6858cd2d16a4aff73ba9e7e21b752462cc29a0ed 100644 (file)
--- a/net/netfilter/nft_xfrm.c
+++ b/net/netfilter/nft_xfrm.c
@@ -17,8 +17,8 @@
 
 static const struct nla_policy nft_xfrm_policy[NFTA_XFRM_MAX + 1] = {
        [NFTA_XFRM_KEY]         = NLA_POLICY_MAX(NLA_BE32, 255),
-       [NFTA_XFRM_DIR]         = { .type = NLA_U8 },
-       [NFTA_XFRM_SPNUM]       = NLA_POLICY_MAX(NLA_BE32, 255),
+       [NFTA_XFRM_DIR]         = NLA_POLICY_MAX(NLA_U8, XFRM_POLICY_OUT),
+       [NFTA_XFRM_SPNUM]       = NLA_POLICY_MAX(NLA_BE32, XFRM_MAX_DEPTH - 1),
        [NFTA_XFRM_DREG]        = { .type = NLA_U32 },
 };