All of lore.kernel.org
 help / color / mirror / Atom feed
From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 05/13] netfilter: nf_conntrack_h323: restore boundary check correctness
Date: Mon, 13 May 2019 11:56:22 +0200	[thread overview]
Message-ID: <20190513095630.32443-6-pablo@netfilter.org> (raw)
In-Reply-To: <20190513095630.32443-1-pablo@netfilter.org>

From: Jakub Jankowski <shasta@toxcorp.com>

Since commit bc7d811ace4a ("netfilter: nf_ct_h323: Convert
CHECK_BOUND macro to function"), NAT traversal for H.323
doesn't work, failing to parse H323-UserInformation.
nf_h323_error_boundary() compares contents of the bitstring,
not the addresses, preventing valid H.323 packets from being
conntrack'd.

This looks like an oversight from when CHECK_BOUND macro was
converted to a function.

To fix it, stop dereferencing bs->cur and bs->end.

Fixes: bc7d811ace4a ("netfilter: nf_ct_h323: Convert CHECK_BOUND macro to function")
Signed-off-by: Jakub Jankowski <shasta@toxcorp.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nf_conntrack_h323_asn1.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/nf_conntrack_h323_asn1.c b/net/netfilter/nf_conntrack_h323_asn1.c
index 1601275efe2d..4c2ef42e189c 100644
--- a/net/netfilter/nf_conntrack_h323_asn1.c
+++ b/net/netfilter/nf_conntrack_h323_asn1.c
@@ -172,7 +172,7 @@ static int nf_h323_error_boundary(struct bitstr *bs, size_t bytes, size_t bits)
 	if (bits % BITS_PER_BYTE > 0)
 		bytes++;
 
-	if (*bs->cur + bytes > *bs->end)
+	if (bs->cur + bytes > bs->end)
 		return 1;
 
 	return 0;
-- 
2.11.0


  parent reply	other threads:[~2019-05-13  9:57 UTC|newest]

Thread overview: 30+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-05-13  9:56 [PATCH 00/13] Netfilter fixes for net Pablo Neira Ayuso
2019-05-13  9:56 ` [PATCH 01/13] netfilter: nf_tables: delay chain policy update until transaction is complete Pablo Neira Ayuso
2019-05-13  9:56 ` [PATCH 02/13] netfilter: nft_flow_offload: add entry to flowtable after confirmation Pablo Neira Ayuso
2019-05-13  9:56 ` [PATCH 03/13] netfilter: nf_flow_table: fix netdev refcnt leak Pablo Neira Ayuso
2019-05-13  9:56 ` [PATCH 04/13] netfilter: nf_flow_table: check ttl value in flow offload data path Pablo Neira Ayuso
2019-05-13  9:56 ` Pablo Neira Ayuso [this message]
2019-05-13  9:56 ` [PATCH 06/13] netfilter: nf_tables: fix base chain stat rcu_dereference usage Pablo Neira Ayuso
2019-05-13  9:56 ` [PATCH 07/13] netfilter: nf_flow_table: fix missing error check for rhashtable_insert_fast Pablo Neira Ayuso
2019-05-13  9:56 ` [PATCH 08/13] netfilter: ctnetlink: Resolve conntrack L3-protocol flush regression Pablo Neira Ayuso
2019-06-24  3:44   ` Felix Kaechele
2019-06-24 23:58     ` Pablo Neira Ayuso
2019-06-25  3:02       ` Felix Kaechele
2019-06-25  8:08         ` Pablo Neira Ayuso
2019-06-25 11:33           ` Felix Kaechele
2019-06-25 11:52             ` Kristian Evensen
2019-06-25 14:45               ` Felix Kaechele
2019-06-25 15:08                 ` Kristian Evensen
2019-06-25 16:16                   ` Felix Kaechele
2019-06-25 19:45                     ` Pablo Neira Ayuso
2019-06-25 15:45                 ` Kristian Evensen
2019-06-25 19:40               ` Pablo Neira Ayuso
2019-06-25 19:41             ` Pablo Neira Ayuso
2019-06-25 15:01       ` Nicolas Dichtel
2019-06-25 19:44         ` Pablo Neira Ayuso
2019-05-13  9:56 ` [PATCH 09/13] netfilter: nf_conntrack_h323: Remove deprecated config check Pablo Neira Ayuso
2019-05-13  9:56 ` [PATCH 10/13] netfilter: nf_flow_table: do not flow offload deleted conntrack entries Pablo Neira Ayuso
2019-05-13  9:56 ` [PATCH 11/13] netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule Pablo Neira Ayuso
2019-05-13  9:56 ` [PATCH 12/13] netfilter: nf_tables: remove NFT_CT_TIMEOUT Pablo Neira Ayuso
2019-05-13  9:56 ` [PATCH 13/13] netfilter: nf_tables: correct NFT_LOGLEVEL_MAX value Pablo Neira Ayuso
2019-05-13 16:02 ` [PATCH 00/13] Netfilter fixes for net David Miller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190513095630.32443-6-pablo@netfilter.org \
    --to=pablo@netfilter.org \
    --cc=davem@davemloft.net \
    --cc=netdev@vger.kernel.org \
    --cc=netfilter-devel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.