d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Reject invalid object types that can not be used with specific opcodes.

Browse Source 
When we doing reference counting of named objects in the new rule,
for existing objects check that opcode references to correct object,
otherwise return EINVAL.

PR:		217391
MFC after:	1 week
Sponsored by:	Yandex LLC
This commit is contained in:
Andrey V. Elsukov 2017-03-05 22:19:43 +00:00
parent 27ca6260e0
commit c750a56914
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=314715
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sys/netpfil/ipfw/ip_fw_sockopt.c
View File

@ -2669,7 +2669,14 @@ ref_opcode_object(struct ip_fw_chain *ch, ipfw_insn *cmd, struct tid_info *ti,
return (0);
}
/* Found. Bump refcount and update kidx. */
/*
* Object is already exist.
* Its subtype should match with expected value.
*/
if (ti->type != no->subtype)
return (EINVAL);
/* Bump refcount and update kidx. */
no->refcnt++;
rw->update(cmd, no->kidx);
return (0);