diff options
| author | Florian Westphal <fw@strlen.de> | 2022-11-18 15:20:32 +0100 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2022-11-23 09:19:01 +0100 |
| commit | 25883ce88bfba087ef142cb909d59dbbc1818b32 (patch) | |
| tree | 06d7347a6239f9ef36aa6653df685264d03da5fc | |
| parent | c9d41cefbe6eafb4a6b12c69fc1fa54b716d6c99 (diff) | |
nft: check for unknown meta keys
Set ->errmsg when the meta key isn't supported by iptables-nft instead
of pretending everything is fine.
The old code is good enough to handle rules added by iptables-nft, but
its not enough to handle rules added by native nft.
At least make sure that there is a an error message telling that
iptables-nft could not decode the entire ruleset.
Signed-off-by: Florian Westphal <fw@strlen.de>
| -rw-r--r-- | iptables/nft-arp.c | 9 | ||||
| -rw-r--r-- | iptables/nft-bridge.c | 6 | ||||
| -rw-r--r-- | iptables/nft-ipv4.c | 7 | ||||
| -rw-r--r-- | iptables/nft-ipv6.c | 7 |
4 files changed, 21 insertions, 8 deletions
diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c index e9e11141..59f100af 100644 --- a/iptables/nft-arp.c +++ b/iptables/nft-arp.c @@ -168,11 +168,14 @@ static void nft_arp_parse_meta(struct nft_xt_ctx *ctx, struct arpt_entry *fw = &cs->arp; uint8_t flags = 0; - parse_meta(ctx, e, reg->meta_dreg.key, fw->arp.iniface, fw->arp.iniface_mask, + if (parse_meta(ctx, e, reg->meta_dreg.key, fw->arp.iniface, fw->arp.iniface_mask, fw->arp.outiface, fw->arp.outiface_mask, - &flags); + &flags) == 0) { + fw->arp.invflags |= flags; + return; + } - fw->arp.invflags |= flags; + ctx->errmsg = "Unknown arp meta key"; } static void parse_mask_ipv4(const struct nft_xt_ctx_reg *reg, struct in_addr *mask) diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c index 749cbc6f..e8ac7a36 100644 --- a/iptables/nft-bridge.c +++ b/iptables/nft-bridge.c @@ -197,7 +197,10 @@ static void nft_bridge_parse_meta(struct nft_xt_ctx *ctx, uint8_t invflags = 0; char iifname[IFNAMSIZ] = {}, oifname[IFNAMSIZ] = {}; - parse_meta(ctx, e, reg->meta_dreg.key, iifname, NULL, oifname, NULL, &invflags); + if (parse_meta(ctx, e, reg->meta_dreg.key, iifname, NULL, oifname, NULL, &invflags) < 0) { + ctx->errmsg = "unknown meta key"; + return; + } switch (reg->meta_dreg.key) { case NFT_META_BRI_IIFNAME: @@ -221,6 +224,7 @@ static void nft_bridge_parse_meta(struct nft_xt_ctx *ctx, snprintf(fw->out, sizeof(fw->out), "%s", oifname); break; default: + ctx->errmsg = "unknown bridge meta key"; break; } } diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c index 92a914f1..6c62dd46 100644 --- a/iptables/nft-ipv4.c +++ b/iptables/nft-ipv4.c @@ -146,9 +146,12 @@ static void nft_ipv4_parse_meta(struct nft_xt_ctx *ctx, break; } - parse_meta(ctx, e, reg->meta_dreg.key, cs->fw.ip.iniface, cs->fw.ip.iniface_mask, + if (parse_meta(ctx, e, reg->meta_dreg.key, cs->fw.ip.iniface, cs->fw.ip.iniface_mask, cs->fw.ip.outiface, cs->fw.ip.outiface_mask, - &cs->fw.ip.invflags); + &cs->fw.ip.invflags) == 0) + return; + + ctx->errmsg = "unknown ipv4 meta key"; } static void parse_mask_ipv4(const struct nft_xt_ctx_reg *sreg, struct in_addr *mask) diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c index 7ca9d842..98c35afa 100644 --- a/iptables/nft-ipv6.c +++ b/iptables/nft-ipv6.c @@ -119,9 +119,12 @@ static void nft_ipv6_parse_meta(struct nft_xt_ctx *ctx, break; } - parse_meta(ctx, e, reg->meta_dreg.key, cs->fw6.ipv6.iniface, + if (parse_meta(ctx, e, reg->meta_dreg.key, cs->fw6.ipv6.iniface, cs->fw6.ipv6.iniface_mask, cs->fw6.ipv6.outiface, - cs->fw6.ipv6.outiface_mask, &cs->fw6.ipv6.invflags); + cs->fw6.ipv6.outiface_mask, &cs->fw6.ipv6.invflags) == 0) + return; + + ctx->errmsg = "unknown ipv6 meta key"; } static void parse_mask_ipv6(const struct nft_xt_ctx_reg *reg, |