Reject invalid object types that can not be used with specific opcodes.
When we doing reference counting of named objects in the new rule, for existing objects check that opcode references to correct object, otherwise return EINVAL. PR: 217391 MFC after: 1 week Sponsored by: Yandex LLC
This commit is contained in:
parent
27ca6260e0
commit
c750a56914
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=314715
@ -2669,7 +2669,14 @@ ref_opcode_object(struct ip_fw_chain *ch, ipfw_insn *cmd, struct tid_info *ti,
|
||||
return (0);
|
||||
}
|
||||
|
||||
/* Found. Bump refcount and update kidx. */
|
||||
/*
|
||||
* Object is already exist.
|
||||
* Its subtype should match with expected value.
|
||||
*/
|
||||
if (ti->type != no->subtype)
|
||||
return (EINVAL);
|
||||
|
||||
/* Bump refcount and update kidx. */
|
||||
no->refcnt++;
|
||||
rw->update(cmd, no->kidx);
|
||||
return (0);
|
||||
|
Loading…
Reference in New Issue
Block a user