summaryrefslogtreecommitdiffstats
path: root/src/expr/match.c
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2014-07-20 14:09:34 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2014-07-20 15:04:47 +0200
commit367cbfaae87c1f539c729b0653d920701beac3be (patch)
tree232077cd854cc757784383b56abcde8383b006dd /src/expr/match.c
parentcac9b26874d60aa17c7cabe46d33e9114b24885d (diff)
src: stricter netlink attribute length validation
If the kernel sends us different data length for a given attribute, stop further processing and indicate that an ABI breakage has ocurred. This is an example of the (hypothetical) message that is shown in that case: nf_tables kernel ABI is broken, contact your vendor. table.c:214 reason: Numerical result out of range Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/expr/match.c')
-rw-r--r--src/expr/match.c18
1 files changed, 6 insertions, 12 deletions
diff --git a/src/expr/match.c b/src/expr/match.c
index 2c4b3dc..378d5dd 100644
--- a/src/expr/match.c
+++ b/src/expr/match.c
@@ -91,22 +91,16 @@ static int nft_rule_expr_match_cb(const struct nlattr *attr, void *data)
switch(type) {
case NFTA_MATCH_NAME:
- if (mnl_attr_validate(attr, MNL_TYPE_NUL_STRING) < 0) {
- perror("mnl_attr_validate");
- return MNL_CB_ERROR;
- }
+ if (mnl_attr_validate(attr, MNL_TYPE_NUL_STRING) < 0)
+ abi_breakage();
break;
case NFTA_MATCH_REV:
- if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) {
- perror("mnl_attr_validate");
- return MNL_CB_ERROR;
- }
+ if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+ abi_breakage();
break;
case NFTA_MATCH_INFO:
- if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0) {
- perror("mnl_attr_validate");
- return MNL_CB_ERROR;
- }
+ if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0)
+ abi_breakage();
break;
}