diff options
| author |   Asbjørn Sloth Tønnesen <ast@fiberby.net> | 2025-11-26 17:35:33 +0000 |
|---|---|---|
| committer |   Jason A. Donenfeld <Jason@zx2c4.com> | 2025-11-26 18:56:20 +0100 |
| commit | 30a17e18f7e1687c7c5884e9fce7524f5f325bce (patch) | |
| tree | 32e11890d4e4fc0642c1982e181a5dffd77d4583 /drivers/net/wireguard/netlink.c | |
| parent | wireguard: netlink: enable strict genetlink validation (diff) | |
| download | wireguard-linux-30a17e18f7e1687c7c5884e9fce7524f5f325bce.tar.xz wireguard-linux-30a17e18f7e1687c7c5884e9fce7524f5f325bce.zip | |
wireguard: netlink: validate nested arrays in policy
Use NLA_POLICY_NESTED_ARRAY() to perform nested array validation
in the policy validation step.
The nested policy was already enforced through nla_parse_nested(),
however extack wasn't passed previously, so no fancy error messages.
With the nested attributes being validated directly in the policy, the
policy argument can be set to NULL in the calls to nla_parse_nested().
Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Diffstat (limited to '')
| -rw-r--r-- | drivers/net/wireguard/netlink.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/drivers/net/wireguard/netlink.c b/drivers/net/wireguard/netlink.c index 8adeec6f9440..97723f9c7998 100644 --- a/drivers/net/wireguard/netlink.c +++ b/drivers/net/wireguard/netlink.c @@ -18,6 +18,8 @@ #include <crypto/utils.h> static struct genl_family genl_family; +static const struct nla_policy peer_policy[WGPEER_A_MAX + 1]; +static const struct nla_policy allowedip_policy[WGALLOWEDIP_A_MAX + 1]; static const struct nla_policy device_policy[WGDEVICE_A_MAX + 1] = { [WGDEVICE_A_IFINDEX] = { .type = NLA_U32 }, @@ -27,7 +29,7 @@ static const struct nla_policy device_policy[WGDEVICE_A_MAX + 1] = { [WGDEVICE_A_FLAGS] = NLA_POLICY_MASK(NLA_U32, __WGDEVICE_F_ALL), [WGDEVICE_A_LISTEN_PORT] = { .type = NLA_U16 }, [WGDEVICE_A_FWMARK] = { .type = NLA_U32 }, - [WGDEVICE_A_PEERS] = { .type = NLA_NESTED } + [WGDEVICE_A_PEERS] = NLA_POLICY_NESTED_ARRAY(peer_policy), }; static const struct nla_policy peer_policy[WGPEER_A_MAX + 1] = { @@ -39,7 +41,7 @@ static const struct nla_policy peer_policy[WGPEER_A_MAX + 1] = { [WGPEER_A_LAST_HANDSHAKE_TIME] = NLA_POLICY_EXACT_LEN(sizeof(struct __kernel_timespec)), [WGPEER_A_RX_BYTES] = { .type = NLA_U64 }, [WGPEER_A_TX_BYTES] = { .type = NLA_U64 }, - [WGPEER_A_ALLOWEDIPS] = { .type = NLA_NESTED }, + [WGPEER_A_ALLOWEDIPS] = NLA_POLICY_NESTED_ARRAY(allowedip_policy), [WGPEER_A_PROTOCOL_VERSION] = { .type = NLA_U32 } }; @@ -467,7 +469,7 @@ static int set_peer(struct wg_device *wg, struct nlattr **attrs) nla_for_each_nested(attr, attrs[WGPEER_A_ALLOWEDIPS], rem) { ret = nla_parse_nested(allowedip, WGALLOWEDIP_A_MAX, - attr, allowedip_policy, NULL); + attr, NULL, NULL); if (ret < 0) goto out; ret = set_allowedip(peer, allowedip); @@ -593,7 +595,7 @@ skip_set_private_key: nla_for_each_nested(attr, info->attrs[WGDEVICE_A_PEERS], rem) { ret = nla_parse_nested(peer, WGPEER_A_MAX, attr, - peer_policy, NULL); + NULL, NULL); if (ret < 0) goto out; ret = set_peer(wg, peer); |