• Kevin Darbyshire-Bryant's avatar
    net: sched: act_ctinfo: fix policy validation · c197d636
    Kevin Darbyshire-Bryant authored
    Fix nla_policy definition by specifying an exact length type attribute
    to CTINFO action paraneter block structure.  Without this change,
    netlink parsing will fail validation and the action will not be
    instantiated.
    
    8cb08174 ("netlink: make validation more configurable for future")
    introduced much stricter checking to attributes being passed via
    netlink.  Existing actions were updated to use less restrictive
    deprecated versions of nla_parse_nested.
    
    As a new module, act_ctinfo should be designed to use the strict
    checking model otherwise, well, what was the point of implementing it.
    
    Confession time: Until very recently, development of this module has
    been done on 'net-next' tree to 'clean compile' level with run-time
    testing on backports to 4.14 & 4.19 kernels under openwrt.  This is how
    I managed to miss the run-time impacts of the new strict
    nla_parse_nested function.  I hopefully have learned something from this
    (glances toward laptop running a net-next kernel)
    
    There is however a still outstanding implication on iproute2 user space
    in that it needs to be told to pass nested netlink messages with the
    nested attribute actually set.  So even with this kernel fix to do
    things correctly you still cannot instantiate a new 'strict'
    nla_parse_nested based action such as act_ctinfo with iproute2's tc.
    Signed-off-by: default avatarKevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    c197d636
act_ctinfo.c 10.5 KB