netfilter: nf_tables: disallow jump to implicit chain from set element

BugLink: https://bugs.launchpad.net/bugs/1991717
[ Upstream commit f323ef3a0d49e147365284bc1f02212e617b7f09 ]

Extend struct nft_data_desc to add a flag field that specifies
nft_data_init() is being called for set element data.

Use it to disallow jump to implicit chain from set element, only jump
to chain via immediate expression is allowed.

Fixes: d0e2c7de92c7 ("netfilter: nf_tables: add NFT_CHAIN_BINDING")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 6a38bf8538f1e27223df52a3de02756767d7bb22..53746494eb846578396fdf41f95b10c5f8e4f607 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -193,10 +193,15 @@ struct nft_ctx {
        bool                            report;
 };
 
+enum nft_data_desc_flags {
+       NFT_DATA_DESC_SETELEM   = (1 << 0),
+};
+
 struct nft_data_desc {
        enum nft_data_types             type;
        unsigned int                    size;
        unsigned int                    len;
+       unsigned int                    flags;
 };
 
 int nft_data_init(const struct nft_ctx *ctx, struct nft_data *data,

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index b19f4255b901814acbb4cad7844daa42592f0a83..8bc4460b627aef8671d7d6267fba579a824a8e1e 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -5144,6 +5144,7 @@ static int nft_setelem_parse_data(struct nft_ctx *ctx, struct nft_set *set,
        desc->type = dtype;
        desc->size = NFT_DATA_VALUE_MAXLEN;
        desc->len = set->dlen;
+       desc->flags = NFT_DATA_DESC_SETELEM;
 
        return nft_data_init(ctx, data, desc, attr);
 }
@@ -9504,6 +9505,9 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
                        return PTR_ERR(chain);
                if (nft_is_base_chain(chain))
                        return -EOPNOTSUPP;
+               if (desc->flags & NFT_DATA_DESC_SETELEM &&
+                   chain->flags & NFT_CHAIN_BINDING)
+                       return -EINVAL;
 
                chain->use++;
                data->verdict.chain = chain;