brain-hackers_pepepper-mirror
/
linux-brain
mirror of https://github.com/brain-hackers/linux-brain.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

netfilter: xt_SECMARK: add new revision to fix structure layout 

[ Upstream commit c7d13358b6a2f49f81a34aa323a2d0878a0532a2 ]

This extension breaks when trying to delete rules, add a new revision to
fix this.

Fixes: 5e6874cdb8 ("[SECMARK]: Add xtables SECMARK target")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Pablo Neira Ayuso 2021-04-30 14:00:13 +02:00 committed by Greg Kroah-Hartman
parent 7a0a9f5cf8
commit 9e3cbdc523
2 changed files with 75 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
include/uapi/linux/netfilter/xt_SECMARK.h
View File

@ -20,4 +20,10 @@ struct xt_secmark_target_info {
char secctx[SECMARK_SECCTX_MAX];
};
struct xt_secmark_target_info_v1 {
__u8 mode;
char secctx[SECMARK_SECCTX_MAX];
__u32 secid;
};
#endif /*_XT_SECMARK_H_target */

88
net/netfilter/xt_SECMARK.c
View File

@ -26,10 +26,9 @@ MODULE_ALIAS("ip6t_SECMARK");
static u8 mode;
static unsigned int
secmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
secmark_tg(struct sk_buff *skb, const struct xt_secmark_target_info_v1 *info)
{
u32 secmark = 0;
const struct xt_secmark_target_info *info = par->targinfo;
switch (mode) {
case SECMARK_MODE_SEL:
@ -43,7 +42,7 @@ secmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
return XT_CONTINUE;
}
static int checkentry_lsm(struct xt_secmark_target_info *info)
static int checkentry_lsm(struct xt_secmark_target_info_v1 *info)
{
int err;
@ -75,15 +74,15 @@ static int checkentry_lsm(struct xt_secmark_target_info *info)
return 0;
}
static int secmark_tg_check(const struct xt_tgchk_param *par)
static int
secmark_tg_check(const char *table, struct xt_secmark_target_info_v1 *info)
{
struct xt_secmark_target_info *info = par->targinfo;
int err;
if (strcmp(par->table, "mangle") != 0 &&
strcmp(par->table, "security") != 0) {
if (strcmp(table, "mangle") != 0 &&
strcmp(table, "security") != 0) {
pr_info_ratelimited("only valid in \'mangle\' or \'security\' table, not \'%s\'\n",
par->table);
table);
return -EINVAL;
}
@ -118,25 +117,76 @@ static void secmark_tg_destroy(const struct xt_tgdtor_param *par)
}
}
static struct xt_target secmark_tg_reg __read_mostly = {
.name = "SECMARK",
.revision = 0,
.family = NFPROTO_UNSPEC,
.checkentry = secmark_tg_check,
.destroy = secmark_tg_destroy,
.target = secmark_tg,
.targetsize = sizeof(struct xt_secmark_target_info),
.me = THIS_MODULE,
static int secmark_tg_check_v0(const struct xt_tgchk_param *par)
{
struct xt_secmark_target_info *info = par->targinfo;
struct xt_secmark_target_info_v1 newinfo = {
.mode = info->mode,
};
int ret;
memcpy(newinfo.secctx, info->secctx, SECMARK_SECCTX_MAX);
ret = secmark_tg_check(par->table, &newinfo);
info->secid = newinfo.secid;
return ret;
}
static unsigned int
secmark_tg_v0(struct sk_buff *skb, const struct xt_action_param *par)
{
const struct xt_secmark_target_info *info = par->targinfo;
struct xt_secmark_target_info_v1 newinfo = {
.secid = info->secid,
};
return secmark_tg(skb, &newinfo);
}
static int secmark_tg_check_v1(const struct xt_tgchk_param *par)
{
return secmark_tg_check(par->table, par->targinfo);
}
static unsigned int
secmark_tg_v1(struct sk_buff *skb, const struct xt_action_param *par)
{
return secmark_tg(skb, par->targinfo);
}
static struct xt_target secmark_tg_reg[] __read_mostly = {
{
.name = "SECMARK",
.revision = 0,
.family = NFPROTO_UNSPEC,
.checkentry = secmark_tg_check_v0,
.destroy = secmark_tg_destroy,
.target = secmark_tg_v0,
.targetsize = sizeof(struct xt_secmark_target_info),
.me = THIS_MODULE,
},
{
.name = "SECMARK",
.revision = 1,
.family = NFPROTO_UNSPEC,
.checkentry = secmark_tg_check_v1,
.destroy = secmark_tg_destroy,
.target = secmark_tg_v1,
.targetsize = sizeof(struct xt_secmark_target_info_v1),
.usersize = offsetof(struct xt_secmark_target_info_v1, secid),
.me = THIS_MODULE,
},
};
static int __init secmark_tg_init(void)
{
return xt_register_target(&secmark_tg_reg);
return xt_register_targets(secmark_tg_reg, ARRAY_SIZE(secmark_tg_reg));
}
static void __exit secmark_tg_exit(void)
{
xt_unregister_target(&secmark_tg_reg);
xt_unregister_targets(secmark_tg_reg, ARRAY_SIZE(secmark_tg_reg));
}
module_init(secmark_tg_init);