diff options
| author | Alvaro Neira <alvaroneay@gmail.com> | 2014-10-20 15:32:09 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2014-10-21 10:16:29 +0200 |
| commit | 1fe6a5add50d9f81b1a25c9ecb7f7ef4f065ca8c (patch) | |
| tree | f46b2ae2cb356bff9d687d901d5da7a41f03281b /src | |
| parent | 93097588b9d8cb3662ce2e91118040a76b46b9c0 (diff) | |
evaluate: reject: fix crash if we specify ether type or meta nfproto
If we use this rule:
nft add rule bridge filter input \
ether type ip reject with icmp type host-unreachable
or that:
nft add rule inet filter input \
meta nfproto ipv4 reject with icmp type host-unreachable
we have a segfault because we add a network dependency when we already have
network context.
Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src')
| -rw-r--r-- | src/evaluate.c | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/src/evaluate.c b/src/evaluate.c index d61d76ba..1fec1201 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1142,7 +1142,7 @@ static int reject_payload_gen_dependency_tcp(struct eval_ctx *ctx, return 0; *payload = payload_expr_alloc(&stmt->location, &proto_tcp, TCPHDR_UNSPEC); - return 0; + return 1; } static int reject_payload_gen_dependency_family(struct eval_ctx *ctx, @@ -1171,7 +1171,7 @@ static int reject_payload_gen_dependency_family(struct eval_ctx *ctx, default: BUG("unknown reject family"); } - return 0; + return 1; } static int stmt_reject_gen_dependency(struct eval_ctx *ctx, struct stmt *stmt, @@ -1179,21 +1179,21 @@ static int stmt_reject_gen_dependency(struct eval_ctx *ctx, struct stmt *stmt, { struct expr *payload = NULL; struct stmt *nstmt; + int ret; switch (stmt->reject.type) { case NFT_REJECT_TCP_RST: - if (reject_payload_gen_dependency_tcp(ctx, stmt, &payload) < 0) - return -1; + ret = reject_payload_gen_dependency_tcp(ctx, stmt, &payload); break; case NFT_REJECT_ICMP_UNREACH: - if (reject_payload_gen_dependency_family(ctx, stmt, - &payload) < 0) - return -1; + ret = reject_payload_gen_dependency_family(ctx, stmt, &payload); break; default: BUG("cannot generate reject dependency for type %d", stmt->reject.type); } + if (ret <= 0) + return ret; if (payload_gen_dependency(ctx, payload, &nstmt) < 0) return -1; |