Received: by 2002:a17:90a:1609:0:0:0:0 with SMTP id n9csp847820pja; Wed, 1 Apr 2020 09:46:48 -0700 (PDT) X-Google-Smtp-Source: APiQypIQwbMZsxzrUpX1dmLNiwUGYRS4Go4PHmXhI5rzyZNZrM+hg6LA8jl3kOTRNuKoQHkzlrZa X-Received: by 2002:aca:dd55:: with SMTP id u82mr3495200oig.27.1585759608458; Wed, 01 Apr 2020 09:46:48 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1585759608; cv=none; d=google.com; s=arc-20160816; b=BnIWvoPOUxORa1R6TAJAwPz6MBpFbEPjDr49ZboGlRn2uOZSgzfVhD/sVf0nHkW4Ms iWCr52zi9lK2Qh2QYLc6AtbU8jwRTSiO0N5tPm+LH6OLv8yCqQtxtKrZNovOID8tDbTM IWB/idPx2YOvv0nRAnRYa2knTIeeIECYQbighOxzKP18CJfRb8E9b8XWs6lFGpLlJzCH 8ZFDZ+uM/IKj9soXieRZzFQGKIUgbw99Pi6BcTXMMllKg5MiwZe6F4izzmxuYDDKipbo jHP+FvP5RTy//L+A75MQbdGywABLXgoTgjsGd0doNKoiGcVDFWla7Lb6Iv9rILDfKVTl iQww== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=p71nA+dCrjrGgkTstlGCNzmVgggCnlNGWEBlvVGWR04=; b=XwN48F7+s6U/XM7NDPnbF3PYfEl0BuLJ1vdhEr9xmx8FPEfDI1jHcIvB9qTRkCjhNd vzzVlfjeQ7chnsLgtJriZHzitk0yrTtEmuIpkbiGy6xZCoeNNzXOMLH51E+La8Ghe48v YSG9mjIVlhLvXZilMBwt8guuott1g6VAuNsUZ+buum0x5E/Ufg8QvOHdqu4TV81W1AZA rePT9uH1VboU3IM6yLM/MvUmCDtkp96UAyuUANVt5DBgq6WD1RJ3XQIV3yHjC+Qz4cw5 kQulANIrAqF6AEEKsXTlv10iLy9GvYrcP3BppcbSolz8WbsQ5n5rwgdLFMHueW6/5nkl tjog== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=g5GEzTVl; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id y123si1078612oia.141.2020.04.01.09.46.35; Wed, 01 Apr 2020 09:46:48 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=g5GEzTVl; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389862AbgDAQpk (ORCPT + 99 others); Wed, 1 Apr 2020 12:45:40 -0400 Received: from mail.kernel.org ([198.145.29.99]:46828 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389853AbgDAQpg (ORCPT ); Wed, 1 Apr 2020 12:45:36 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 2F5C720719; Wed, 1 Apr 2020 16:45:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759535; bh=IpskLDqHHZRm9edhwLu30IHxKAr24vBmtaA+c2F/oaA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=g5GEzTVlcRPUCaG7dcH4QeS0vjTsEIXR27Er+tg7L9+DlcZUb1q2XOiUsJR062rq3 b0a9ex/hMgE1R1XlCXL7FJPSYIhUXq7kVJX4Aljk9UtKCkf7Zza+rMAds4u1ip1LQo 8Mlp6Im8MQj6RsUYJgNH+3wF2gheba1z4PCWutHM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pablo Neira Ayuso Subject: [PATCH 4.14 109/148] netfilter: nft_fwd_netdev: validate family and chain type Date: Wed, 1 Apr 2020 18:18:21 +0200 Message-Id: <20200401161603.061574431@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161552.245876366@linuxfoundation.org> References: <20200401161552.245876366@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Pablo Neira Ayuso commit 76a109fac206e158eb3c967af98c178cff738e6a upstream. Make sure the forward action is only used from ingress. Fixes: 39e6dea28adc ("netfilter: nf_tables: add forward expression to the netdev family") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Greg Kroah-Hartman --- net/netfilter/nft_fwd_netdev.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/net/netfilter/nft_fwd_netdev.c +++ b/net/netfilter/nft_fwd_netdev.c @@ -62,6 +62,13 @@ nla_put_failure: return -1; } +static int nft_fwd_validate(const struct nft_ctx *ctx, + const struct nft_expr *expr, + const struct nft_data **data) +{ + return nft_chain_validate_hooks(ctx->chain, (1 << NF_NETDEV_INGRESS)); +} + static struct nft_expr_type nft_fwd_netdev_type; static const struct nft_expr_ops nft_fwd_netdev_ops = { .type = &nft_fwd_netdev_type, @@ -69,6 +76,7 @@ static const struct nft_expr_ops nft_fwd .eval = nft_fwd_netdev_eval, .init = nft_fwd_netdev_init, .dump = nft_fwd_netdev_dump, + .validate = nft_fwd_validate, }; static struct nft_expr_type nft_fwd_netdev_type __read_mostly = {