| From 1bcc51ac0731aab1b109b2cd5c3d495f1884e5ca Mon Sep 17 00:00:00 2001 |
| From: wenxu <wenxu@ucloud.cn> |
| Date: Tue, 9 Feb 2021 14:37:49 +0800 |
| Subject: net/sched: cls_flower: Reject invalid ct_state flags rules |
| |
| From: wenxu <wenxu@ucloud.cn> |
| |
| commit 1bcc51ac0731aab1b109b2cd5c3d495f1884e5ca upstream. |
| |
| Reject the unsupported and invalid ct_state flags of cls flower rules. |
| |
| Fixes: e0ace68af2ac ("net/sched: cls_flower: Add matching on conntrack info") |
| Signed-off-by: wenxu <wenxu@ucloud.cn> |
| Reviewed-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> |
| Reviewed-by: Jakub Kicinski <kuba@kernel.org> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| include/uapi/linux/pkt_cls.h | 2 ++ |
| net/sched/cls_flower.c | 39 +++++++++++++++++++++++++++++++++++++-- |
| 2 files changed, 39 insertions(+), 2 deletions(-) |
| |
| --- a/include/uapi/linux/pkt_cls.h |
| +++ b/include/uapi/linux/pkt_cls.h |
| @@ -591,6 +591,8 @@ enum { |
| TCA_FLOWER_KEY_CT_FLAGS_ESTABLISHED = 1 << 1, /* Part of an existing connection. */ |
| TCA_FLOWER_KEY_CT_FLAGS_RELATED = 1 << 2, /* Related to an established connection. */ |
| TCA_FLOWER_KEY_CT_FLAGS_TRACKED = 1 << 3, /* Conntrack has occurred. */ |
| + |
| + __TCA_FLOWER_KEY_CT_FLAGS_MAX, |
| }; |
| |
| enum { |
| --- a/net/sched/cls_flower.c |
| +++ b/net/sched/cls_flower.c |
| @@ -30,6 +30,11 @@ |
| |
| #include <uapi/linux/netfilter/nf_conntrack_common.h> |
| |
| +#define TCA_FLOWER_KEY_CT_FLAGS_MAX \ |
| + ((__TCA_FLOWER_KEY_CT_FLAGS_MAX - 1) << 1) |
| +#define TCA_FLOWER_KEY_CT_FLAGS_MASK \ |
| + (TCA_FLOWER_KEY_CT_FLAGS_MAX - 1) |
| + |
| struct fl_flow_key { |
| struct flow_dissector_key_meta meta; |
| struct flow_dissector_key_control control; |
| @@ -686,8 +691,10 @@ static const struct nla_policy fl_policy |
| [TCA_FLOWER_KEY_ENC_IP_TTL_MASK] = { .type = NLA_U8 }, |
| [TCA_FLOWER_KEY_ENC_OPTS] = { .type = NLA_NESTED }, |
| [TCA_FLOWER_KEY_ENC_OPTS_MASK] = { .type = NLA_NESTED }, |
| - [TCA_FLOWER_KEY_CT_STATE] = { .type = NLA_U16 }, |
| - [TCA_FLOWER_KEY_CT_STATE_MASK] = { .type = NLA_U16 }, |
| + [TCA_FLOWER_KEY_CT_STATE] = |
| + NLA_POLICY_MASK(NLA_U16, TCA_FLOWER_KEY_CT_FLAGS_MASK), |
| + [TCA_FLOWER_KEY_CT_STATE_MASK] = |
| + NLA_POLICY_MASK(NLA_U16, TCA_FLOWER_KEY_CT_FLAGS_MASK), |
| [TCA_FLOWER_KEY_CT_ZONE] = { .type = NLA_U16 }, |
| [TCA_FLOWER_KEY_CT_ZONE_MASK] = { .type = NLA_U16 }, |
| [TCA_FLOWER_KEY_CT_MARK] = { .type = NLA_U32 }, |
| @@ -1390,12 +1397,33 @@ static int fl_set_enc_opt(struct nlattr |
| return 0; |
| } |
| |
| +static int fl_validate_ct_state(u16 state, struct nlattr *tb, |
| + struct netlink_ext_ack *extack) |
| +{ |
| + if (state && !(state & TCA_FLOWER_KEY_CT_FLAGS_TRACKED)) { |
| + NL_SET_ERR_MSG_ATTR(extack, tb, |
| + "no trk, so no other flag can be set"); |
| + return -EINVAL; |
| + } |
| + |
| + if (state & TCA_FLOWER_KEY_CT_FLAGS_NEW && |
| + state & TCA_FLOWER_KEY_CT_FLAGS_ESTABLISHED) { |
| + NL_SET_ERR_MSG_ATTR(extack, tb, |
| + "new and est are mutually exclusive"); |
| + return -EINVAL; |
| + } |
| + |
| + return 0; |
| +} |
| + |
| static int fl_set_key_ct(struct nlattr **tb, |
| struct flow_dissector_key_ct *key, |
| struct flow_dissector_key_ct *mask, |
| struct netlink_ext_ack *extack) |
| { |
| if (tb[TCA_FLOWER_KEY_CT_STATE]) { |
| + int err; |
| + |
| if (!IS_ENABLED(CONFIG_NF_CONNTRACK)) { |
| NL_SET_ERR_MSG(extack, "Conntrack isn't enabled"); |
| return -EOPNOTSUPP; |
| @@ -1403,6 +1431,13 @@ static int fl_set_key_ct(struct nlattr * |
| fl_set_key_val(tb, &key->ct_state, TCA_FLOWER_KEY_CT_STATE, |
| &mask->ct_state, TCA_FLOWER_KEY_CT_STATE_MASK, |
| sizeof(key->ct_state)); |
| + |
| + err = fl_validate_ct_state(mask->ct_state, |
| + tb[TCA_FLOWER_KEY_CT_STATE_MASK], |
| + extack); |
| + if (err) |
| + return err; |
| + |
| } |
| if (tb[TCA_FLOWER_KEY_CT_ZONE]) { |
| if (!IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES)) { |