From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x224ucKJonAZkDVGFKDGVpBD3B/tJ+Y+7qXjOqP+07X6y9oQn9npJsoGL8CjlCeODloNWJT3E ARC-Seal: i=1; a=rsa-sha256; t=1517256508; cv=none; d=google.com; s=arc-20160816; b=oYw3Nc7HxtZ1UimzMi8CdZum9fztRjXdczfq3MnVjLyC7lRkzwL/Gm1D0XJCR+cTV0 8Zr8PVP4OmW/EZXkUNIeB4IGfvmynfYdPDnobsBa6FY8uIOmMkadPXcCN1ieA0Ofef11 W0nAwYFcO9vQzvedj1zhuh46TiwsjNh9Pb866FCbyk4tiZNlxMV1ig9f9R7tBQSyLJPx Q94UeEAgeUhMhtWtBZr06XGC0RtSE1uOqeMAO+UdWmKLuyxtvKWuy87uRwyTTq/pEirf 3SIW9HMN62qxDVT00Vo8aFSCTCrbzpcOyVLSDzghtfu7fmZ1QcYOWitTmypy1gWjHPnB p5qw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=7IeD9CQULM4oxOU0YcdWWjy6wrId4KXdt/nsTGV3uwU=; b=WTff//ukuLHY+wb1UYVLDJdMxYaUuANgu28QxwS/J1ZSs2GEnvsqDzEb4hWWFkszmt Gh+0TSEM+4Ik0RsGTCz9iF9kyIMXcIe7f7VjBFavAohDlwqx0BgfHgCiN65Y+HjjjYf3 LLVoC6DY5k1X/mdrYpRpmr3YKanmBs3T4fA9KCmOiXdU+coYrpAMrb2x/N1YYIvYtI81 n2ceWEgDU7t8re8nle1czSpCbRT0C4aT+eHhMCqHArvgl1BVONHQljUNJHzNmRJeSZZJ At7AZ3ozUAga8aDHOy9xZ8gbsDTNyiaMUlTtDTMgU5jY+nb028v7vCcVqc6yrBg5AGNF Of9w== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ulrich Weber , Marco Angaroni , Pablo Neira Ayuso , Michal Kubecek Subject: [PATCH 3.18 29/52] netfilter: nf_conntrack_sip: extend request line validation Date: Mon, 29 Jan 2018 13:56:47 +0100 Message-Id: <20180129123629.467468723@linuxfoundation.org> X-Mailer: git-send-email 2.16.1 In-Reply-To: <20180129123628.168904217@linuxfoundation.org> References: <20180129123628.168904217@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1590931932922722920?= X-GMAIL-MSGID: =?utf-8?q?1590958760824958696?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 3.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ulrich Weber commit 444f901742d054a4cd5ff045871eac5131646cfb upstream. on SIP requests, so a fragmented TCP SIP packet from an allow header starting with INVITE,NOTIFY,OPTIONS,REFER,REGISTER,UPDATE,SUBSCRIBE Content-Length: 0 will not bet interpreted as an INVITE request. Also Request-URI must start with an alphabetic character. Confirm with RFC 3261 Request-Line = Method SP Request-URI SP SIP-Version CRLF Fixes: 30f33e6dee80 ("[NETFILTER]: nf_conntrack_sip: support method specific request/response handling") Signed-off-by: Ulrich Weber Acked-by: Marco Angaroni Signed-off-by: Pablo Neira Ayuso Acked-by: Michal Kubecek Signed-off-by: Greg Kroah-Hartman --- net/netfilter/nf_conntrack_sip.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/net/netfilter/nf_conntrack_sip.c +++ b/net/netfilter/nf_conntrack_sip.c @@ -1434,9 +1434,12 @@ static int process_sip_request(struct sk handler = &sip_handlers[i]; if (handler->request == NULL) continue; - if (*datalen < handler->len || + if (*datalen < handler->len + 2 || strncasecmp(*dptr, handler->method, handler->len)) continue; + if ((*dptr)[handler->len] != ' ' || + !isalpha((*dptr)[handler->len+1])) + continue; if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CSEQ, &matchoff, &matchlen) <= 0) {