diff options
| author | Phil Sutter <phil@nwl.cc> | 2022-12-22 15:58:27 +0100 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2022-12-22 16:43:58 +0100 |
| commit | 596f2e31ae7cee26e4f39f300cc69605f4ba512f (patch) | |
| tree | bf6cd7dc6b5adaedfe2d32e50813f078e73f5658 | |
| parent | ec86937089a95ac57f149b70cbf740d69b9bd775 (diff) | |
nft: Reject tcp/udp extension without proper protocol match
Internally, 'th' expression is used, which works but matches both
protocols. Since users won't expect '-m tcp --dport 1' to match UDP
packets, catch missing/wrong '-p' argument.
Fixes: c034cf31dd1a9 ("nft: prefer native expressions instead of udp match")
Signed-off-by: Phil Sutter <phil@nwl.cc>
| -rw-r--r-- | extensions/libxt_tcp.t | 3 | ||||
| -rw-r--r-- | extensions/libxt_udp.t | 3 | ||||
| -rw-r--r-- | iptables/nft.c | 6 |
3 files changed, 12 insertions, 0 deletions
diff --git a/extensions/libxt_tcp.t b/extensions/libxt_tcp.t index b0e8006e..7a3bbd08 100644 --- a/extensions/libxt_tcp.t +++ b/extensions/libxt_tcp.t @@ -22,5 +22,8 @@ -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG SYN;=;OK -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,PSH,ACK,URG SYN;=;OK -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG RST;=;OK +-m tcp --dport 1;;FAIL +-m tcp --dport 1 -p tcp;-p tcp -m tcp --dport 1;OK +-m tcp --dport 1 -p 6;-p tcp -m tcp --dport 1;OK # should we accept this below? -p tcp -m tcp;=;OK diff --git a/extensions/libxt_udp.t b/extensions/libxt_udp.t index 1b4d3dd6..f5347701 100644 --- a/extensions/libxt_udp.t +++ b/extensions/libxt_udp.t @@ -18,5 +18,8 @@ # -p udp -m udp --sport 65536;;FAIL -p udp -m udp --sport -1;;FAIL -p udp -m udp --dport -1;;FAIL +-m udp --dport 1;;FAIL +-m udp --dport 1 -p udp;-p udp -m udp --dport 1;OK +-m udp --dport 1 -p 17;-p udp -m udp --dport 1;OK # should we accept this below? -p udp -m udp;=;OK diff --git a/iptables/nft.c b/iptables/nft.c index 430888e8..63468cf3 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -1360,6 +1360,9 @@ static int add_nft_udp(struct nft_handle *h, struct nftnl_rule *r, return ret; } + if (nftnl_rule_get_u32(r, NFTNL_RULE_COMPAT_PROTO) != IPPROTO_UDP) + xtables_error(PARAMETER_PROBLEM, "UDP match requires '-p udp'"); + return add_nft_tcpudp(h, r, udp->spts, udp->invflags & XT_UDP_INV_SRCPT, udp->dpts, udp->invflags & XT_UDP_INV_DSTPT); } @@ -1410,6 +1413,9 @@ static int add_nft_tcp(struct nft_handle *h, struct nftnl_rule *r, return ret; } + if (nftnl_rule_get_u32(r, NFTNL_RULE_COMPAT_PROTO) != IPPROTO_TCP) + xtables_error(PARAMETER_PROBLEM, "TCP match requires '-p tcp'"); + if (tcp->flg_mask) { int ret = add_nft_tcpflags(h, r, tcp->flg_cmp, tcp->flg_mask, tcp->invflags & XT_TCP_INV_FLAGS); |