From 596f2e31ae7cee26e4f39f300cc69605f4ba512f Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 22 Dec 2022 15:58:27 +0100 Subject: nft: Reject tcp/udp extension without proper protocol match Internally, 'th' expression is used, which works but matches both protocols. Since users won't expect '-m tcp --dport 1' to match UDP packets, catch missing/wrong '-p' argument. Fixes: c034cf31dd1a9 ("nft: prefer native expressions instead of udp match") Signed-off-by: Phil Sutter --- iptables/nft.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'iptables') diff --git a/iptables/nft.c b/iptables/nft.c index 430888e8..63468cf3 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -1360,6 +1360,9 @@ static int add_nft_udp(struct nft_handle *h, struct nftnl_rule *r, return ret; } + if (nftnl_rule_get_u32(r, NFTNL_RULE_COMPAT_PROTO) != IPPROTO_UDP) + xtables_error(PARAMETER_PROBLEM, "UDP match requires '-p udp'"); + return add_nft_tcpudp(h, r, udp->spts, udp->invflags & XT_UDP_INV_SRCPT, udp->dpts, udp->invflags & XT_UDP_INV_DSTPT); } @@ -1410,6 +1413,9 @@ static int add_nft_tcp(struct nft_handle *h, struct nftnl_rule *r, return ret; } + if (nftnl_rule_get_u32(r, NFTNL_RULE_COMPAT_PROTO) != IPPROTO_TCP) + xtables_error(PARAMETER_PROBLEM, "TCP match requires '-p tcp'"); + if (tcp->flg_mask) { int ret = add_nft_tcpflags(h, r, tcp->flg_cmp, tcp->flg_mask, tcp->invflags & XT_TCP_INV_FLAGS); -- cgit v1.2.3