Skip to content

[ciqlts8_6] netfilter: nf_tables: do not allow RULE_ID to refer to another chain #1724

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
PlaidCat merged 1 commit into from
Oct 23, 2026
Merged

[ciqlts8_6] netfilter: nf_tables: do not allow RULE_ID to refer to another chain #1724

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions net/netfilter/nf_tables_api.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3087,6 +3087,7 @@ static int nft_table_validate(struct net *net, const struct nft_table *table)
}

static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
const struct nft_chain *chain,
const struct nlattr *nla);

#define NFT_RULE_MAXEXPRS 128
Expand Down Expand Up @@ -3160,7 +3161,7 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
return PTR_ERR(old_rule);
}
} else if (nla[NFTA_RULE_POSITION_ID]) {
old_rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_POSITION_ID]);
old_rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_POSITION_ID]);
if (IS_ERR(old_rule)) {
NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION_ID]);
return PTR_ERR(old_rule);
Expand Down Expand Up @@ -3302,6 +3303,7 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
}

static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
const struct nft_chain *chain,
const struct nlattr *nla)
{
u32 id = ntohl(nla_get_be32(nla));
Expand All @@ -3311,6 +3313,7 @@ static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
struct nft_rule *rule = nft_trans_rule(trans);

if (trans->msg_type == NFT_MSG_NEWRULE &&
trans->ctx.chain == chain &&
id == nft_trans_rule_id(trans))
return rule;
}
Expand Down Expand Up @@ -3357,7 +3360,7 @@ static int nf_tables_delrule(struct net *net, struct sock *nlsk,

err = nft_delrule(&ctx, rule);
} else if (nla[NFTA_RULE_ID]) {
rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]);
rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_ID]);
if (IS_ERR(rule)) {
NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]);
return PTR_ERR(rule);
Expand Down
Loading