Skip to contentSkip to conversation

filter: add SKF_AD_NLATTR_NEST to look for nested attributes

PATCH Applied Pablo Neira Ayuso 3 participants 3 messages Nov 18, 2008 – Nov 20, 2008

Subsystems (6)
Networking Network drivers netfilter BPF +2 more subsystems
lore
Share & tools
lore

Pablo Neira Ayuso

author maintainer
#0 lore raw

PATCH 1/1 filter: add SKF_AD_NLATTR_NEST to look for nested attributes

SKF_AD_NLATTR allows us to find the first matching attribute in a stream of netlink attributes from one offset to the end of the netlink message. This is not suitable to look for a specific matching inside a set of nested attributes.

For example, in ctnetlink messages, if we look for the CTA_V6_SRC attribute in a message that talks about an IPv4 connection, SKF_AD_NLATTR returns the offset of CTA_STATUS which has the same value of CTA_V6_SRC but outside the nest. To differenciate CTA_STATUS and CTA_V6_SRC, we would have to make assumptions on the size of the attribute and the usual offset, resulting in horrible BSF code.

This patch adds SKF_AD_NLATTR_NEST, which is a variant of SKF_AD_NLATTR, that looks for an attribute inside the limits of a nested attributes, but not further.

This patch validates that we have enough room to look for the nested attributes - based on a suggestion from Patrick McHardy.

Signed-off-by Pablo Neira Ayuso <[email protected]>

---

 include/linux/filter.h |    3 ++-
 net/core/filter.c      |   19 +++++++++++++++++++
 2 files changed, 21 insertions(+), 1 deletions(-)
include/linux/filter.h +2 -1
index b6ea9aa..1354aaf 100644
@@ -122,7 +122,8 @@ struct sock_fprog	/* Required for SO_ATTACH_FILTER. */
 #define SKF_AD_PKTTYPE 	4
 #define SKF_AD_IFINDEX 	8
 #define SKF_AD_NLATTR	12
-#define SKF_AD_MAX 	16
+#define SKF_AD_NLATTR_NEST	16
+#define SKF_AD_MAX	20
 #define SKF_NET_OFF   (-0x100000)
 #define SKF_LL_OFF    (-0x200000)
net/core/filter.c +19 -0
index df37443..d1d779c 100644
@@ -319,6 +319,25 @@ load_b:
 				A = 0;
 			continue;
 		}
+		case SKF_AD_NLATTR_NEST: {
+			struct nlattr *nla;
+
+			if (skb_is_nonlinear(skb))
+				return 0;
+			if (A > skb->len - sizeof(struct nlattr))
+				return 0;
+
+			nla = (struct nlattr *)&skb->data[A];
+			if (nla->nla_len > A - skb->len)
+				return 0;
+
+			nla = nla_find_nested(nla, X);
+			if (nla)
+				A = (void *)nla - (void *)skb->data;
+			else
+				A = 0;
+			continue;
+		}
 		default:
 			return 0;
 		}
Acked-by on v1 1/1
#1 lore raw
Quoted 13 lines · Pablo Neira Ayuso

SKF_AD_NLATTR allows us to find the first matching attribute in a stream of netlink attributes from one offset to the end of the netlink message. This is not suitable to look for a specific matching inside a set of nested attributes.

For example, in ctnetlink messages, if we look for the CTA_V6_SRC attribute in a message that talks about an IPv4 connection, SKF_AD_NLATTR returns the offset of CTA_STATUS which has the same value of CTA_V6_SRC but outside the nest. To differenciate CTA_STATUS and CTA_V6_SRC, we would have to make assumptions on the size of the attribute and the usual offset, resulting in horrible BSF code.

Quoted 6 lines

This patch adds SKF_AD_NLATTR_NEST, which is a variant of SKF_AD_NLATTR, that looks for an attribute inside the limits of a nested attributes, but not further.

This patch validates that we have enough room to look for the nested attributes - based on a suggestion from Patrick McHardy.

Looks good, thanks Pablo.

Acked-by Patrick McHardy <[email protected]>
maintainer Applied
#2 lore raw

From: Patrick McHardy <[email protected]>
Date: Tue, 18 Nov 2008 11:49:18 +0100

Quoted 18 lines
Quoted 8 lines · Pablo Neira Ayuso

SKF_AD_NLATTR allows us to find the first matching attribute in a stream of netlink attributes from one offset to the end of the netlink message. This is not suitable to look for a specific matching inside a set of nested attributes.
For example, in ctnetlink messages, if we look for the CTA_V6_SRC attribute in a message that talks about an IPv4 connection, SKF_AD_NLATTR returns the offset of CTA_STATUS which has the same value of CTA_V6_SRC but outside the nest. To differenciate

Quoted 8 lines

CTA_STATUS and CTA_V6_SRC, we would have to make assumptions on the size of the attribute and the usual offset, resulting in horrible BSF code.
This patch adds SKF_AD_NLATTR_NEST, which is a variant of SKF_AD_NLATTR, that looks for an attribute inside the limits of a nested attributes, but not further.
This patch validates that we have enough room to look for the nested attributes - based on a suggestion from Patrick McHardy.

Quoted 3 lines

Looks good, thanks Pablo.

Acked-by Patrick McHardy <[email protected]>

Applied, thanks everyone.