[PATCH 3/3] netfilter: nf_tables: do not allow RULE_ID to refer to another chain

When doing lookups for rules on the same batch by using its ID, a rule from
a different chain can be used. If a rule is added to a chain but tries to
be positioned next to a rule from a different chain, it will be linked to
chain2, but the use counter on chain1 would be the one to be incremented.

When looking for rules by ID, use the chain that was used for the lookup by
name. The chain used in the context copied to the transaction needs to
match that same chain. That way, struct nft_rule does not need to get
enlarged with another member.

Fixes: 1a94e38d254b ("netfilter: nf_tables: add NFTA_RULE_ID attribute")
Fixes: 75dd48e2e420 ("netfilter: nf_tables: Support RULE_ID reference in new rule")
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Gbp-Pq: Topic bugfix/all
Gbp-Pq: Name netfilter-nf_tables-do-not-allow-RULE_ID-to-refer-to.patch

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index d34861bd7559407f1c2f9b3b161117338c77e8a7..30dd77d58f2071c4982a3fc37603d25be90ebf06 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3371,6 +3371,7 @@ static int nft_table_validate(struct net *net, const struct nft_table *table)
 }
 
 static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
+                                            const struct nft_chain *chain,
                                             const struct nlattr *nla);
 
 #define NFT_RULE_MAXEXPRS      128
@@ -3459,7 +3460,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
                                return PTR_ERR(old_rule);
                        }
                } else if (nla[NFTA_RULE_POSITION_ID]) {
-                       old_rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_POSITION_ID]);
+                       old_rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_POSITION_ID]);
                        if (IS_ERR(old_rule)) {
                                NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION_ID]);
                                return PTR_ERR(old_rule);
@@ -3604,6 +3605,7 @@ err_release_expr:
 }
 
 static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
+                                            const struct nft_chain *chain,
                                             const struct nlattr *nla)
 {
        struct nftables_pernet *nft_net = nft_pernet(net);
@@ -3614,6 +3616,7 @@ static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
                struct nft_rule *rule = nft_trans_rule(trans);
 
                if (trans->msg_type == NFT_MSG_NEWRULE &&
+                   trans->ctx.chain == chain &&
                    id == nft_trans_rule_id(trans))
                        return rule;
        }
@@ -3663,7 +3666,7 @@ static int nf_tables_delrule(struct sk_buff *skb, const struct nfnl_info *info,
 
                        err = nft_delrule(&ctx, rule);
                } else if (nla[NFTA_RULE_ID]) {
-                       rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]);
+                       rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_ID]);
                        if (IS_ERR(rule)) {
                                NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]);
                                return PTR_ERR(rule);