diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-08-29 13:20:08 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-08-29 20:30:29 +0200 |
| commit | 06c8f6fccc689cae71cc84d4d6d27098c9e15089 (patch) | |
| tree | 1a6ac94ee167c56b15522fdfd5dab94a86ba509f /include | |
| parent | cb7cb885d65ec02aa33872b4bd382ef8a692113a (diff) | |
evaluate: validate maximum hash and numgen value
We can validate that values don't get over the maximum datatype
length, this is expressed in number of bits, so the maximum value
is always power of 2.
However, since we got the hash and numgen expressions, the user should
not set a value higher that what the specified modulus option, which
may not be power of 2. This patch extends the expression context with
a new optional field to store the maximum value.
After this patch, nft bails out if the user specifies non-sense rules
like those below:
# nft add rule x y jhash ip saddr mod 10 seed 0xa 10
<cmdline>:1:45-46: Error: Value 10 exceeds valid range 0-9
add rule x y jhash ip saddr mod 10 seed 0xa 10
^^
The modulus sets a valid value range of [0, n), so n is out of the valid
value range.
# nft add rule x y numgen inc mod 10 eq 12
<cmdline>:1:35-36: Error: Value 12 exceeds valid range 0-9
add rule x y numgen inc mod 10 eq 12
^^
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/expression.h | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/include/expression.h b/include/expression.h index 6a509b33..13ca315c 100644 --- a/include/expression.h +++ b/include/expression.h @@ -104,21 +104,24 @@ enum symbol_types { * @dtype: expected datatype * @byteorder: expected byteorder * @len: expected len + * @maxval: expected maximum value */ struct expr_ctx { const struct datatype *dtype; enum byteorder byteorder; unsigned int len; + unsigned int maxval; }; static inline void __expr_set_context(struct expr_ctx *ctx, const struct datatype *dtype, enum byteorder byteorder, - unsigned int len) + unsigned int len, unsigned int maxval) { ctx->dtype = dtype; ctx->byteorder = byteorder; ctx->len = len; + ctx->maxval = maxval; } static inline void expr_set_context(struct expr_ctx *ctx, @@ -126,7 +129,8 @@ static inline void expr_set_context(struct expr_ctx *ctx, unsigned int len) { __expr_set_context(ctx, dtype, - dtype ? dtype->byteorder : BYTEORDER_INVALID, len); + dtype ? dtype->byteorder : BYTEORDER_INVALID, + len, 0); } /** |