OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

netfilter: xt_SECMARK: add new revision to fix structure layout 

[ Upstream commit c7d13358b6a2f49f81a34aa323a2d0878a0532a2 ]

This extension breaks when trying to delete rules, add a new revision to
fix this.

Fixes: 5e6874cdb8 ("[SECMARK]: Add xtables SECMARK target")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Pablo Neira Ayuso 2021-04-30 14:00:13 +02:00 committed by Greg Kroah-Hartman
parent 7a0a9f5cf8
commit 9e3cbdc523
2 changed files with 75 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
include/uapi/linux/netfilter/xt_SECMARK.h
View File

@ -20,4 +20,10 @@ struct xt_secmark_target_info {
char secctx[SECMARK_SECCTX_MAX]; char secctx[SECMARK_SECCTX_MAX];
}; };
struct xt_secmark_target_info_v1 {
__u8 mode;
char secctx[SECMARK_SECCTX_MAX];
__u32 secid;
};
#endif /*_XT_SECMARK_H_target */ #endif /*_XT_SECMARK_H_target */

88
net/netfilter/xt_SECMARK.c
View File

@ -26,10 +26,9 @@ MODULE_ALIAS("ip6t_SECMARK");
static u8 mode; static u8 mode;
static unsigned int static unsigned int
secmark_tg(struct sk_buff *skb, const struct xt_action_param *par) secmark_tg(struct sk_buff *skb, const struct xt_secmark_target_info_v1 *info)
{ {
u32 secmark = 0; u32 secmark = 0;
const struct xt_secmark_target_info *info = par->targinfo;
switch (mode) { switch (mode) {
case SECMARK_MODE_SEL: case SECMARK_MODE_SEL:
@ -43,7 +42,7 @@ secmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
return XT_CONTINUE; return XT_CONTINUE;
} }
static int checkentry_lsm(struct xt_secmark_target_info *info) static int checkentry_lsm(struct xt_secmark_target_info_v1 *info)
{ {
int err; int err;
@ -75,15 +74,15 @@ static int checkentry_lsm(struct xt_secmark_target_info *info)
return 0; return 0;
} }
static int secmark_tg_check(const struct xt_tgchk_param *par) static int
secmark_tg_check(const char *table, struct xt_secmark_target_info_v1 *info)
{ {
struct xt_secmark_target_info *info = par->targinfo;
int err; int err;
if (strcmp(par->table, "mangle") != 0 && if (strcmp(table, "mangle") != 0 &&
strcmp(par->table, "security") != 0) { strcmp(table, "security") != 0) {
pr_info_ratelimited("only valid in \'mangle\' or \'security\' table, not \'%s\'\n", pr_info_ratelimited("only valid in \'mangle\' or \'security\' table, not \'%s\'\n",
par->table); table);
return -EINVAL; return -EINVAL;
} }
@ -118,25 +117,76 @@ static void secmark_tg_destroy(const struct xt_tgdtor_param *par)
} }
} }
static struct xt_target secmark_tg_reg __read_mostly = { static int secmark_tg_check_v0(const struct xt_tgchk_param *par)
.name = "SECMARK", {
.revision = 0, struct xt_secmark_target_info *info = par->targinfo;
.family = NFPROTO_UNSPEC, struct xt_secmark_target_info_v1 newinfo = {
.checkentry = secmark_tg_check, .mode = info->mode,
.destroy = secmark_tg_destroy, };
.target = secmark_tg, int ret;
.targetsize = sizeof(struct xt_secmark_target_info),
.me = THIS_MODULE, memcpy(newinfo.secctx, info->secctx, SECMARK_SECCTX_MAX);
ret = secmark_tg_check(par->table, &newinfo);
info->secid = newinfo.secid;
return ret;
}
static unsigned int
secmark_tg_v0(struct sk_buff *skb, const struct xt_action_param *par)
{
const struct xt_secmark_target_info *info = par->targinfo;
struct xt_secmark_target_info_v1 newinfo = {
.secid = info->secid,
};
return secmark_tg(skb, &newinfo);
}
static int secmark_tg_check_v1(const struct xt_tgchk_param *par)
{
return secmark_tg_check(par->table, par->targinfo);
}
static unsigned int
secmark_tg_v1(struct sk_buff *skb, const struct xt_action_param *par)
{
return secmark_tg(skb, par->targinfo);
}
static struct xt_target secmark_tg_reg[] __read_mostly = {
{
.name = "SECMARK",
.revision = 0,
.family = NFPROTO_UNSPEC,
.checkentry = secmark_tg_check_v0,
.destroy = secmark_tg_destroy,
.target = secmark_tg_v0,
.targetsize = sizeof(struct xt_secmark_target_info),
.me = THIS_MODULE,
},
{
.name = "SECMARK",
.revision = 1,
.family = NFPROTO_UNSPEC,
.checkentry = secmark_tg_check_v1,
.destroy = secmark_tg_destroy,
.target = secmark_tg_v1,
.targetsize = sizeof(struct xt_secmark_target_info_v1),
.usersize = offsetof(struct xt_secmark_target_info_v1, secid),
.me = THIS_MODULE,
},
}; };
static int __init secmark_tg_init(void) static int __init secmark_tg_init(void)
{ {
return xt_register_target(&secmark_tg_reg); return xt_register_targets(secmark_tg_reg, ARRAY_SIZE(secmark_tg_reg));
} }
static void __exit secmark_tg_exit(void) static void __exit secmark_tg_exit(void)
{ {
xt_unregister_target(&secmark_tg_reg); xt_unregister_targets(secmark_tg_reg, ARRAY_SIZE(secmark_tg_reg));
} }
module_init(secmark_tg_init); module_init(secmark_tg_init);