All of lore.kernel.org
 help / color / mirror / Atom feed
From: chleroy <chleroy@ce692ce0-f8e3-4c9c-b4d7-dcccc219094e.localdomain>
To: Pablo Neira Ayuso <pablo@netfilter.org>,
	Patrick McHardy <kaber@trash.net>,
	Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>,
	"David S. Miller" <davem@davemloft.net>
Cc: netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
	netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH] netfilter: nf_conntrack_sip: CSeq 0 is a valid CSeq
Date: Fri,  1 Jul 2016 11:45:41 +0200 (CEST)	[thread overview]
Message-ID: <20160701094541.2A8AA1A23A2@localhost.localdomain> (raw)

Do not drop packet when CSeq is 0 as 0 is also a valid value for CSeq.

In order to do so, we replace obsolete simple_strtoul() which
returns 0 on error by kstrtouint(). As kstrtouint() requires a
NULL terminated string, we need to use a temporary buffer

Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
---
 net/netfilter/nf_conntrack_sip.c | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index f72ba55..e770477 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -1368,6 +1368,7 @@ static int process_sip_response(struct sk_buff *skb, unsigned int protoff,
 	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 	unsigned int matchoff, matchlen, matchend;
 	unsigned int code, cseq, i;
+	char buf[21];
 
 	if (*datalen < strlen("SIP/2.0 200"))
 		return NF_ACCEPT;
@@ -1382,8 +1383,13 @@ static int process_sip_response(struct sk_buff *skb, unsigned int protoff,
 		nf_ct_helper_log(skb, ct, "cannot parse cseq");
 		return NF_DROP;
 	}
-	cseq = simple_strtoul(*dptr + matchoff, NULL, 10);
-	if (!cseq) {
+	if (matchlen > sizeof(buf) - 1) {
+		nf_ct_helper_log(skb, ct, "cannot parse cseq (too big)");
+		return NF_DROP;
+	}
+	memcpy(buf, *dptr + matchoff, matchlen);
+	buf[matchlen] = 0;
+	if (kstrtouint(buf, 10, &cseq)) {
 		nf_ct_helper_log(skb, ct, "cannot get cseq");
 		return NF_DROP;
 	}
@@ -1432,6 +1438,7 @@ static int process_sip_request(struct sk_buff *skb, unsigned int protoff,
 
 	for (i = 0; i < ARRAY_SIZE(sip_handlers); i++) {
 		const struct sip_handler *handler;
+		char buf[21];
 
 		handler = &sip_handlers[i];
 		if (handler->request == NULL)
@@ -1445,8 +1452,13 @@ static int process_sip_request(struct sk_buff *skb, unsigned int protoff,
 			nf_ct_helper_log(skb, ct, "cannot parse cseq");
 			return NF_DROP;
 		}
-		cseq = simple_strtoul(*dptr + matchoff, NULL, 10);
-		if (!cseq) {
+		if (matchlen > sizeof(buf) - 1) {
+			nf_ct_helper_log(skb, ct, "cannot parse cseq(too big)");
+			return NF_DROP;
+		}
+		memcpy(buf, *dptr + matchoff, matchlen);
+		buf[matchlen] = 0;
+		if (kstrtouint(buf, 10, &cseq)) {
 			nf_ct_helper_log(skb, ct, "cannot get cseq");
 			return NF_DROP;
 		}
-- 
2.1.0

             reply	other threads:[~2016-07-01  9:45 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-07-01  9:45 chleroy [this message]
2016-07-01  9:48 [PATCH] netfilter: nf_conntrack_sip: CSeq 0 is a valid CSeq Christophe Leroy
2016-07-04  5:48 ` Liping Zhang
2016-07-04  6:14   ` Christophe Leroy
2016-07-04 11:43     ` Liping Zhang

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20160701094541.2A8AA1A23A2@localhost.localdomain \
    --to=chleroy@ce692ce0-f8e3-4c9c-b4d7-dcccc219094e.localdomain \
    --cc=coreteam@netfilter.org \
    --cc=davem@davemloft.net \
    --cc=kaber@trash.net \
    --cc=kadlec@blackhole.kfki.hu \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=netfilter-devel@vger.kernel.org \
    --cc=pablo@netfilter.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.