netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations

CVE: CVE-2024-26673
JIRA: https://issues.redhat.com/browse/RHEL-31345
Upstream Status: commit 8059918

commit 8059918
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Mon Jan 29 13:12:33 2024 +0100

    netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations

    - Disallow families other than NFPROTO_{IPV4,IPV6,INET}.
    - Disallow layer 4 protocol with no ports, since destination port is a
      mandatory attribute for this object.

    Fixes: 857b460 ("netfilter: nft_ct: add ct expectations support")
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Signed-off-by: Phil Sutter <psutter@redhat.com>

Author: SirPhuttel

net/netfilter/nft_ct.c

@@ -1190,7 +1190,31 @@ static int nft_ct_expect_obj_init(const struct nft_ctx *ctx,
 	if (tb[NFTA_CT_EXPECT_L3PROTO])
 		priv->l3num = ntohs(nla_get_be16(tb[NFTA_CT_EXPECT_L3PROTO]));
 
+	switch (priv->l3num) {
+	case NFPROTO_IPV4:
+	case NFPROTO_IPV6:
+		if (priv->l3num != ctx->family)
+			return -EINVAL;
+
+		fallthrough;
+	case NFPROTO_INET:
+		break;
+	default:
+		return -EOPNOTSUPP;
+	}
+
 	priv->l4proto = nla_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]);
+	switch (priv->l4proto) {
+	case IPPROTO_TCP:
+	case IPPROTO_UDP:
+	case IPPROTO_UDPLITE:
+	case IPPROTO_DCCP:
+	case IPPROTO_SCTP:
+		break;
+	default:
+		return -EOPNOTSUPP;
+	}
+
 	priv->dport = nla_get_be16(tb[NFTA_CT_EXPECT_DPORT]);
 	priv->timeout = nla_get_u32(tb[NFTA_CT_EXPECT_TIMEOUT]);
 	priv->size = nla_get_u8(tb[NFTA_CT_EXPECT_SIZE]);