From 8c75d3a169605b605711ccb6f4ab3253c40ba10b Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 10 Mar 2023 00:52:15 +0100 Subject: Reject invalid chain priority values in user space The kernel doesn't accept nat type chains with a priority of -200 or below. Catch this and provide a better error message than the kernel's EOPNOTSUPP. Signed-off-by: Phil Sutter --- src/evaluate.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/evaluate.c b/src/evaluate.c index 47caf3b0..663ace26 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -4885,6 +4885,8 @@ static int chain_evaluate(struct eval_ctx *ctx, struct chain *chain) } if (chain->flags & CHAIN_F_BASECHAIN) { + int priority; + chain->hook.num = str2hooknum(chain->handle.family, chain->hook.name); if (chain->hook.num == NF_INET_NUMHOOKS) @@ -4897,6 +4899,13 @@ static int chain_evaluate(struct eval_ctx *ctx, struct chain *chain) return __stmt_binary_error(ctx, &chain->priority.loc, NULL, "invalid priority expression %s in this context.", expr_name(chain->priority.expr)); + + mpz_export_data(&priority, chain->priority.expr->value, + BYTEORDER_HOST_ENDIAN, sizeof(int)); + if (priority <= -200 && !strcmp(chain->type.str, "nat")) + return __stmt_binary_error(ctx, &chain->priority.loc, NULL, + "Chains of type \"nat\" must have a priority value above -200."); + if (chain->policy) { expr_set_context(&ctx->ectx, &policy_type, NFT_NAME_MAXLEN * BITS_PER_BYTE); -- cgit v1.2.3