netfilter: nf_tables: reject unbound anonymous set before commit phase

Add a new list to track set transaction and to check for unbound
anonymous sets before entering the commit phase.

Bail out at the end of the transaction handling if an anonymous set
remains unbound.

Fixes: 96518518cc41 ("netfilter: add nftables")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index f84b6daea5c45f3c8c72b9d432c15686dbf6d57d..ee47d7143d99f88adcd389fa55c338c4bfc0a525 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -1573,6 +1573,7 @@ static inline void nft_set_elem_clear_busy(struct nft_set_ext *ext)
  *     struct nft_trans - nf_tables object update in transaction
  *
  *     @list: used internally
+ *     @binding_list: list of objects with possible bindings
  *     @msg_type: message type
  *     @put_net: ctx->net needs to be put
  *     @ctx: transaction context
@@ -1580,6 +1581,7 @@ static inline void nft_set_elem_clear_busy(struct nft_set_ext *ext)
  */
 struct nft_trans {
        struct list_head                list;
+       struct list_head                binding_list;
        int                             msg_type;
        bool                            put_net;
        struct nft_ctx                  ctx;
@@ -1724,6 +1726,7 @@ static inline int nft_request_module(struct net *net, const char *fmt, ...) { re
 struct nftables_pernet {
        struct list_head        tables;
        struct list_head        commit_list;
+       struct list_head        binding_list;
        struct list_head        module_list;
        struct list_head        notify_list;
        struct mutex            commit_mutex;

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 6f26520bd865065187191a5f82b6ffdc7fb10b7a..66da44bff5e49741c089ed636472e38aa7afa04f 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -151,6 +151,7 @@ static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
                return NULL;
 
        INIT_LIST_HEAD(&trans->list);
+       INIT_LIST_HEAD(&trans->binding_list);
        trans->msg_type = msg_type;
        trans->ctx      = *ctx;
 
@@ -163,9 +164,15 @@ static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
        return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
 }
 
-static void nft_trans_destroy(struct nft_trans *trans)
+static void nft_trans_list_del(struct nft_trans *trans)
 {
        list_del(&trans->list);
+       list_del(&trans->binding_list);
+}
+
+static void nft_trans_destroy(struct nft_trans *trans)
+{
+       nft_trans_list_del(trans);
        kfree(trans);
 }
 
@@ -357,6 +364,14 @@ static void nft_trans_commit_list_add_tail(struct net *net, struct nft_trans *tr
 {
        struct nftables_pernet *nft_net = nft_pernet(net);
 
+       switch (trans->msg_type) {
+       case NFT_MSG_NEWSET:
+               if (!nft_trans_set_update(trans) &&
+                   nft_set_is_anonymous(nft_trans_set(trans)))
+                       list_add_tail(&trans->binding_list, &nft_net->binding_list);
+               break;
+       }
+
        list_add_tail(&trans->list, &nft_net->commit_list);
 }
 
@@ -9111,7 +9126,7 @@ static void nf_tables_trans_destroy_work(struct work_struct *w)
        synchronize_rcu();
 
        list_for_each_entry_safe(trans, next, &head, list) {
-               list_del(&trans->list);
+               nft_trans_list_del(trans);
                nft_commit_release(trans);
        }
 }
@@ -9476,6 +9491,19 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
                return 0;
        }
 
+       list_for_each_entry(trans, &nft_net->binding_list, binding_list) {
+               switch (trans->msg_type) {
+               case NFT_MSG_NEWSET:
+                       if (!nft_trans_set_update(trans) &&
+                           nft_set_is_anonymous(nft_trans_set(trans)) &&
+                           !nft_trans_set_bound(trans)) {
+                               pr_warn_once("nftables ruleset with unbound set\n");
+                               return -EINVAL;
+                       }
+                       break;
+               }
+       }
+
        /* 0. Validate ruleset, otherwise roll back for error reporting. */
        if (nf_tables_validate(net) < 0)
                return -EAGAIN;
@@ -9989,7 +10017,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
 
        list_for_each_entry_safe_reverse(trans, next,
                                         &nft_net->commit_list, list) {
-               list_del(&trans->list);
+               nft_trans_list_del(trans);
                nf_tables_abort_release(trans);
        }
 
@@ -10765,6 +10793,7 @@ static int __net_init nf_tables_init_net(struct net *net)
 
        INIT_LIST_HEAD(&nft_net->tables);
        INIT_LIST_HEAD(&nft_net->commit_list);
+       INIT_LIST_HEAD(&nft_net->binding_list);
        INIT_LIST_HEAD(&nft_net->module_list);
        INIT_LIST_HEAD(&nft_net->notify_list);
        mutex_init(&nft_net->commit_mutex);