Netfilter-Devel Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH 0/9] Netfilter fixes for net
@ 2016-08-10 18:56 Pablo Neira Ayuso
  2016-08-10 18:56 ` [PATCH 1/9] netfilter: nf_ct_h323: do not re-activate already expired timer Pablo Neira Ayuso
                   ` (9 more replies)
  0 siblings, 10 replies; 12+ messages in thread
From: Pablo Neira Ayuso @ 2016-08-10 18:56 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem

Hi David,

The following patchset contains Netfilter fixes for your net tree,
they are:

1) Use mod_timer_pending() to avoid reactivating a dead expectation in
   the h323 conntrack helper, from Liping Zhang.

2) Oneliner to fix a type in the register name defined in the nf_tables
   header.

3) Don't try to look further when we find an inactive elements with no
   descendants in the rbtree set implementation, otherwise we crash.

4) Handle valid zero CSeq in the SIP conntrack helper, from
   Christophe Leroy.

5) Don't display a trailing slash in conntrack helper with no classes
   via /proc/net/nf_conntrack_expect, from Liping Zhang.

6) Fix an expectation leak during creation from the nfqueue path, again
   from Liping Zhang.

7) Validate netlink port ID in verdict message from nfqueue, otherwise
   an injection can be possible. Again from Zhang.

8) Reject conntrack tuples with different transport protocol on
   original and reply tuples, also from Zhang.

9) Validate offset and length in nft_exthdr, make sure they are under
   sizeof(u8), from Laura Garcia Liebana.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit c518189567eaf42b2ec50a4d982484c8e38799f8:

  net: macb: Correct CAPS mask (2016-08-06 20:53:06 -0400)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 4da449ae1df9cfeb167e78f250b250eff64bc65e:

  netfilter: nft_exthdr: Add size check on u8 nft_exthdr attributes (2016-08-10 13:10:13 +0200)

----------------------------------------------------------------
Christophe Leroy (1):
      netfilter: nf_conntrack_sip: CSeq 0 is a valid CSeq

Laura Garcia Liebana (1):
      netfilter: nft_exthdr: Add size check on u8 nft_exthdr attributes

Liping Zhang (5):
      netfilter: nf_ct_h323: do not re-activate already expired timer
      netfilter: nf_ct_expect: remove the redundant slash when policy name is empty
      netfilter: nfnetlink_queue: fix memory leak when attach expectation successfully
      netfilter: nfnetlink_queue: reject verdict request from different portid
      netfilter: ctnetlink: reject new conntrack request with different l4proto

Pablo Neira Ayuso (2):
      netfilter: nf_tables: s/MFT_REG32_01/NFT_REG32_01
      netfilter: nft_rbtree: ignore inactive matching element with no descendants

 include/uapi/linux/netfilter/nf_tables.h |  2 +-
 net/netfilter/nf_conntrack_expect.c      |  2 +-
 net/netfilter/nf_conntrack_h323_main.c   |  3 ++-
 net/netfilter/nf_conntrack_netlink.c     | 10 ++++------
 net/netfilter/nf_conntrack_sip.c         |  4 ++--
 net/netfilter/nfnetlink_queue.c          |  6 ++----
 net/netfilter/nft_exthdr.c               | 11 +++++++++--
 net/netfilter/nft_rbtree.c               | 10 ++++++----
 8 files changed, 27 insertions(+), 21 deletions(-)

^ permalink raw reply	[flat|nested] 12+ messages in thread

* [PATCH 1/9] netfilter: nf_ct_h323: do not re-activate already expired timer
  2016-08-10 18:56 [PATCH 0/9] Netfilter fixes for net Pablo Neira Ayuso
@ 2016-08-10 18:56 ` Pablo Neira Ayuso
  2016-08-10 18:56 ` [PATCH 2/9] netfilter: nf_tables: s/MFT_REG32_01/NFT_REG32_01 Pablo Neira Ayuso
                   ` (8 subsequent siblings)
  9 siblings, 0 replies; 12+ messages in thread
From: Pablo Neira Ayuso @ 2016-08-10 18:56 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem

From: Liping Zhang <liping.zhang@spreadtrum.com>

Commit 96d1327ac2e3 ("netfilter: h323: Use mod_timer instead of
set_expect_timeout") just simplify the source codes
    if (!del_timer(&exp->timeout))
        return 0;
    add_timer(&exp->timeout);
to mod_timer(&exp->timeout, jiffies + info->timeout * HZ);

This is not correct, and introduce a race codition:
    CPU0                     CPU1
     -                     timer expire
  process_rcf              expectation_timed_out
  lock(exp_lock)              -
  find_exp                 waiting exp_lock...
  re-activate timer!!      waiting exp_lock...
  unlock(exp_lock)         lock(exp_lock)
     -                     unlink expect
     -                     free(expect)
     -                     unlock(exp_lock)
So when the timer expires again, we will access the memory that
was already freed.

Replace mod_timer with mod_timer_pending here to fix this problem.

Fixes: 96d1327ac2e3 ("netfilter: h323: Use mod_timer instead of set_expect_timeout")
Cc: Gao Feng <fgao@ikuai8.com>
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nf_conntrack_h323_main.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index bb77a97..5c0db5c 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -1473,7 +1473,8 @@ static int process_rcf(struct sk_buff *skb, struct nf_conn *ct,
 				 "timeout to %u seconds for",
 				 info->timeout);
 			nf_ct_dump_tuple(&exp->tuple);
-			mod_timer(&exp->timeout, jiffies + info->timeout * HZ);
+			mod_timer_pending(&exp->timeout,
+					  jiffies + info->timeout * HZ);
 		}
 		spin_unlock_bh(&nf_conntrack_expect_lock);
 	}
-- 
2.1.4


^ permalink raw reply	[flat|nested] 12+ messages in thread

* [PATCH 2/9] netfilter: nf_tables: s/MFT_REG32_01/NFT_REG32_01
  2016-08-10 18:56 [PATCH 0/9] Netfilter fixes for net Pablo Neira Ayuso
  2016-08-10 18:56 ` [PATCH 1/9] netfilter: nf_ct_h323: do not re-activate already expired timer Pablo Neira Ayuso
@ 2016-08-10 18:56 ` Pablo Neira Ayuso
  2016-08-10 18:56 ` [PATCH 3/9] netfilter: nft_rbtree: ignore inactive matching element with no descendants Pablo Neira Ayuso
                   ` (7 subsequent siblings)
  9 siblings, 0 replies; 12+ messages in thread
From: Pablo Neira Ayuso @ 2016-08-10 18:56 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem

MFT_REG32_01 is a typo, rename this to NFT_REG32_01.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 include/uapi/linux/netfilter/nf_tables.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 01751fa..c674ba2 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -24,7 +24,7 @@ enum nft_registers {
 	__NFT_REG_MAX,
 
 	NFT_REG32_00	= 8,
-	MFT_REG32_01,
+	NFT_REG32_01,
 	NFT_REG32_02,
 	NFT_REG32_03,
 	NFT_REG32_04,
-- 
2.1.4


^ permalink raw reply	[flat|nested] 12+ messages in thread

* [PATCH 3/9] netfilter: nft_rbtree: ignore inactive matching element with no descendants
  2016-08-10 18:56 [PATCH 0/9] Netfilter fixes for net Pablo Neira Ayuso
  2016-08-10 18:56 ` [PATCH 1/9] netfilter: nf_ct_h323: do not re-activate already expired timer Pablo Neira Ayuso
  2016-08-10 18:56 ` [PATCH 2/9] netfilter: nf_tables: s/MFT_REG32_01/NFT_REG32_01 Pablo Neira Ayuso
@ 2016-08-10 18:56 ` Pablo Neira Ayuso
  2016-08-10 18:56 ` [PATCH 4/9] netfilter: nf_conntrack_sip: CSeq 0 is a valid CSeq Pablo Neira Ayuso
                   ` (6 subsequent siblings)
  9 siblings, 0 replies; 12+ messages in thread
From: Pablo Neira Ayuso @ 2016-08-10 18:56 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem

If we find a matching element that is inactive with no descendants, we
jump to the found label, then crash because of nul-dereference on the
left branch.

Fix this by checking that the element is active and not an interval end
and skipping the logic that only applies to the tree iteration.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Tested-by: Anders K. Pedersen <akp@akp.dk>
---
 net/netfilter/nft_rbtree.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/nft_rbtree.c b/net/netfilter/nft_rbtree.c
index 6473936..ffe9ae0 100644
--- a/net/netfilter/nft_rbtree.c
+++ b/net/netfilter/nft_rbtree.c
@@ -70,7 +70,6 @@ static bool nft_rbtree_lookup(const struct net *net, const struct nft_set *set,
 		} else if (d > 0)
 			parent = parent->rb_right;
 		else {
-found:
 			if (!nft_set_elem_active(&rbe->ext, genmask)) {
 				parent = parent->rb_left;
 				continue;
@@ -84,9 +83,12 @@ found:
 		}
 	}
 
-	if (set->flags & NFT_SET_INTERVAL && interval != NULL) {
-		rbe = interval;
-		goto found;
+	if (set->flags & NFT_SET_INTERVAL && interval != NULL &&
+	    nft_set_elem_active(&interval->ext, genmask) &&
+	    !nft_rbtree_interval_end(interval)) {
+		spin_unlock_bh(&nft_rbtree_lock);
+		*ext = &interval->ext;
+		return true;
 	}
 out:
 	spin_unlock_bh(&nft_rbtree_lock);
-- 
2.1.4


^ permalink raw reply	[flat|nested] 12+ messages in thread

* [PATCH 4/9] netfilter: nf_conntrack_sip: CSeq 0 is a valid CSeq
  2016-08-10 18:56 [PATCH 0/9] Netfilter fixes for net Pablo Neira Ayuso
                   ` (2 preceding siblings ...)
  2016-08-10 18:56 ` [PATCH 3/9] netfilter: nft_rbtree: ignore inactive matching element with no descendants Pablo Neira Ayuso
@ 2016-08-10 18:56 ` Pablo Neira Ayuso
  2016-08-10 18:56 ` [PATCH 5/9] netfilter: nf_ct_expect: remove the redundant slash when policy name is empty Pablo Neira Ayuso
                   ` (5 subsequent siblings)
  9 siblings, 0 replies; 12+ messages in thread
From: Pablo Neira Ayuso @ 2016-08-10 18:56 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem

From: Christophe Leroy <christophe.leroy@c-s.fr>

Do not drop packet when CSeq is 0 as 0 is also a valid value for CSeq.

simple_strtoul() will return 0 either when all digits are 0
or if there are no digits at all. Therefore when simple_strtoul()
returns 0 we check if first character is digit 0 or not.

Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nf_conntrack_sip.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 8d9db9d..7d77217 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -1383,7 +1383,7 @@ static int process_sip_response(struct sk_buff *skb, unsigned int protoff,
 		return NF_DROP;
 	}
 	cseq = simple_strtoul(*dptr + matchoff, NULL, 10);
-	if (!cseq) {
+	if (!cseq && *(*dptr + matchoff) != '0') {
 		nf_ct_helper_log(skb, ct, "cannot get cseq");
 		return NF_DROP;
 	}
@@ -1446,7 +1446,7 @@ static int process_sip_request(struct sk_buff *skb, unsigned int protoff,
 			return NF_DROP;
 		}
 		cseq = simple_strtoul(*dptr + matchoff, NULL, 10);
-		if (!cseq) {
+		if (!cseq && *(*dptr + matchoff) != '0') {
 			nf_ct_helper_log(skb, ct, "cannot get cseq");
 			return NF_DROP;
 		}
-- 
2.1.4


^ permalink raw reply	[flat|nested] 12+ messages in thread

* [PATCH 5/9] netfilter: nf_ct_expect: remove the redundant slash when policy name is empty
  2016-08-10 18:56 [PATCH 0/9] Netfilter fixes for net Pablo Neira Ayuso
                   ` (3 preceding siblings ...)
  2016-08-10 18:56 ` [PATCH 4/9] netfilter: nf_conntrack_sip: CSeq 0 is a valid CSeq Pablo Neira Ayuso
@ 2016-08-10 18:56 ` Pablo Neira Ayuso
  2016-08-10 18:56 ` [PATCH 6/9] netfilter: nfnetlink_queue: fix memory leak when attach expectation successfully Pablo Neira Ayuso
                   ` (4 subsequent siblings)
  9 siblings, 0 replies; 12+ messages in thread
From: Pablo Neira Ayuso @ 2016-08-10 18:56 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem

From: Liping Zhang <liping.zhang@spreadtrum.com>

The 'name' filed in struct nf_conntrack_expect_policy{} is not a
pointer, so check it is NULL or not will always return true. Even if the
name is empty, slash will always be displayed like follows:
  # cat /proc/net/nf_conntrack_expect
  297 l3proto = 2 proto=6 src=1.1.1.1 dst=2.2.2.2 sport=1 dport=1025 ftp/
                                                                        ^

Fixes: 3a8fc53a45c4 ("netfilter: nf_ct_helper: allocate 16 bytes for the helper and policy names")
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nf_conntrack_expect.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 9e36931..f8dbacf 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -574,7 +574,7 @@ static int exp_seq_show(struct seq_file *s, void *v)
 	helper = rcu_dereference(nfct_help(expect->master)->helper);
 	if (helper) {
 		seq_printf(s, "%s%s", expect->flags ? " " : "", helper->name);
-		if (helper->expect_policy[expect->class].name)
+		if (helper->expect_policy[expect->class].name[0])
 			seq_printf(s, "/%s",
 				   helper->expect_policy[expect->class].name);
 	}
-- 
2.1.4


^ permalink raw reply	[flat|nested] 12+ messages in thread

* [PATCH 6/9] netfilter: nfnetlink_queue: fix memory leak when attach expectation successfully
  2016-08-10 18:56 [PATCH 0/9] Netfilter fixes for net Pablo Neira Ayuso
                   ` (4 preceding siblings ...)
  2016-08-10 18:56 ` [PATCH 5/9] netfilter: nf_ct_expect: remove the redundant slash when policy name is empty Pablo Neira Ayuso
@ 2016-08-10 18:56 ` Pablo Neira Ayuso
  2016-08-10 18:56 ` [PATCH 7/9] netfilter: nfnetlink_queue: reject verdict request from different portid Pablo Neira Ayuso
                   ` (3 subsequent siblings)
  9 siblings, 0 replies; 12+ messages in thread
From: Pablo Neira Ayuso @ 2016-08-10 18:56 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem

From: Liping Zhang <liping.zhang@spreadtrum.com>

User can use NFQA_EXP to attach expectations to conntracks, but we
forget to put back nf_conntrack_expect when it is inserted successfully,
i.e. in this normal case, expect's use refcnt will be 3. So even we
unlink it and put it back later, the use refcnt is still 1, then the
memory will be leaked forever.

Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nf_conntrack_netlink.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 050bb34..b9bfe64 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -2362,12 +2362,8 @@ ctnetlink_glue_attach_expect(const struct nlattr *attr, struct nf_conn *ct,
 		return PTR_ERR(exp);
 
 	err = nf_ct_expect_related_report(exp, portid, report);
-	if (err < 0) {
-		nf_ct_expect_put(exp);
-		return err;
-	}
-
-	return 0;
+	nf_ct_expect_put(exp);
+	return err;
 }
 
 static void ctnetlink_glue_seqadj(struct sk_buff *skb, struct nf_conn *ct,
-- 
2.1.4


^ permalink raw reply	[flat|nested] 12+ messages in thread

* [PATCH 7/9] netfilter: nfnetlink_queue: reject verdict request from different portid
  2016-08-10 18:56 [PATCH 0/9] Netfilter fixes for net Pablo Neira Ayuso
                   ` (5 preceding siblings ...)
  2016-08-10 18:56 ` [PATCH 6/9] netfilter: nfnetlink_queue: fix memory leak when attach expectation successfully Pablo Neira Ayuso
@ 2016-08-10 18:56 ` Pablo Neira Ayuso
  2016-08-10 18:56 ` [PATCH 8/9] netfilter: ctnetlink: reject new conntrack request with different l4proto Pablo Neira Ayuso
                   ` (2 subsequent siblings)
  9 siblings, 0 replies; 12+ messages in thread
From: Pablo Neira Ayuso @ 2016-08-10 18:56 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem

From: Liping Zhang <liping.zhang@spreadtrum.com>

Like NFQNL_MSG_VERDICT_BATCH do, we should also reject the verdict
request when the portid is not same with the initial portid(maybe
from another process).

Fixes: 97d32cf9440d ("netfilter: nfnetlink_queue: batch verdict support")
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nfnetlink_queue.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 5d36a09..f49f450 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -1145,10 +1145,8 @@ static int nfqnl_recv_verdict(struct net *net, struct sock *ctnl,
 	struct nfnl_queue_net *q = nfnl_queue_pernet(net);
 	int err;
 
-	queue = instance_lookup(q, queue_num);
-	if (!queue)
-		queue = verdict_instance_lookup(q, queue_num,
-						NETLINK_CB(skb).portid);
+	queue = verdict_instance_lookup(q, queue_num,
+					NETLINK_CB(skb).portid);
 	if (IS_ERR(queue))
 		return PTR_ERR(queue);
 
-- 
2.1.4


^ permalink raw reply	[flat|nested] 12+ messages in thread

* [PATCH 8/9] netfilter: ctnetlink: reject new conntrack request with different l4proto
  2016-08-10 18:56 [PATCH 0/9] Netfilter fixes for net Pablo Neira Ayuso
                   ` (6 preceding siblings ...)
  2016-08-10 18:56 ` [PATCH 7/9] netfilter: nfnetlink_queue: reject verdict request from different portid Pablo Neira Ayuso
@ 2016-08-10 18:56 ` Pablo Neira Ayuso
  2016-08-10 18:56 ` [PATCH 9/9] netfilter: nft_exthdr: Add size check on u8 nft_exthdr attributes Pablo Neira Ayuso
  2016-08-10 21:54 ` [PATCH 0/9] Netfilter fixes for net David Miller
  9 siblings, 0 replies; 12+ messages in thread
From: Pablo Neira Ayuso @ 2016-08-10 18:56 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem

From: Liping Zhang <liping.zhang@spreadtrum.com>

Currently, user can add a conntrack with different l4proto via nfnetlink.
For example, original tuple is TCP while reply tuple is SCTP. This is
invalid combination, we should report EINVAL to userspace.

Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nf_conntrack_netlink.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index b9bfe64..fdfc71f 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1894,6 +1894,8 @@ static int ctnetlink_new_conntrack(struct net *net, struct sock *ctnl,
 
 			if (!cda[CTA_TUPLE_ORIG] || !cda[CTA_TUPLE_REPLY])
 				return -EINVAL;
+			if (otuple.dst.protonum != rtuple.dst.protonum)
+				return -EINVAL;
 
 			ct = ctnetlink_create_conntrack(net, &zone, cda, &otuple,
 							&rtuple, u3);
-- 
2.1.4


^ permalink raw reply	[flat|nested] 12+ messages in thread

* [PATCH 9/9] netfilter: nft_exthdr: Add size check on u8 nft_exthdr attributes
  2016-08-10 18:56 [PATCH 0/9] Netfilter fixes for net Pablo Neira Ayuso
                   ` (7 preceding siblings ...)
  2016-08-10 18:56 ` [PATCH 8/9] netfilter: ctnetlink: reject new conntrack request with different l4proto Pablo Neira Ayuso
@ 2016-08-10 18:56 ` Pablo Neira Ayuso
  2016-08-10 21:54 ` [PATCH 0/9] Netfilter fixes for net David Miller
  9 siblings, 0 replies; 12+ messages in thread
From: Pablo Neira Ayuso @ 2016-08-10 18:56 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem

From: Laura Garcia Liebana <nevola@gmail.com>

Fix the direct assignment of offset and length attributes included in
nft_exthdr structure from u32 data to u8.

Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nft_exthdr.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
index ba7aed1..82c264e 100644
--- a/net/netfilter/nft_exthdr.c
+++ b/net/netfilter/nft_exthdr.c
@@ -59,6 +59,7 @@ static int nft_exthdr_init(const struct nft_ctx *ctx,
 			   const struct nlattr * const tb[])
 {
 	struct nft_exthdr *priv = nft_expr_priv(expr);
+	u32 offset, len;
 
 	if (tb[NFTA_EXTHDR_DREG] == NULL ||
 	    tb[NFTA_EXTHDR_TYPE] == NULL ||
@@ -66,9 +67,15 @@ static int nft_exthdr_init(const struct nft_ctx *ctx,
 	    tb[NFTA_EXTHDR_LEN] == NULL)
 		return -EINVAL;
 
+	offset = ntohl(nla_get_be32(tb[NFTA_EXTHDR_OFFSET]));
+	len = ntohl(nla_get_be32(tb[NFTA_EXTHDR_LEN]));
+
+	if (offset > U8_MAX || len > U8_MAX)
+		return -ERANGE;
+
 	priv->type   = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
-	priv->offset = ntohl(nla_get_be32(tb[NFTA_EXTHDR_OFFSET]));
-	priv->len    = ntohl(nla_get_be32(tb[NFTA_EXTHDR_LEN]));
+	priv->offset = offset;
+	priv->len    = len;
 	priv->dreg   = nft_parse_register(tb[NFTA_EXTHDR_DREG]);
 
 	return nft_validate_register_store(ctx, priv->dreg, NULL,
-- 
2.1.4


^ permalink raw reply	[flat|nested] 12+ messages in thread

* Re: [PATCH 0/9] Netfilter fixes for net
  2016-08-10 18:56 [PATCH 0/9] Netfilter fixes for net Pablo Neira Ayuso
                   ` (8 preceding siblings ...)
  2016-08-10 18:56 ` [PATCH 9/9] netfilter: nft_exthdr: Add size check on u8 nft_exthdr attributes Pablo Neira Ayuso
@ 2016-08-10 21:54 ` David Miller
  9 siblings, 0 replies; 12+ messages in thread
From: David Miller @ 2016-08-10 21:54 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Wed, 10 Aug 2016 20:56:25 +0200

> The following patchset contains Netfilter fixes for your net tree,
> they are:
 ...
> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Pulled, thanks a lot Pablo!

^ permalink raw reply	[flat|nested] 12+ messages in thread

* [PATCH 7/9] netfilter: nfnetlink_queue: reject verdict request from different portid
  2016-08-10 19:16 Pablo Neira Ayuso
@ 2016-08-10 19:16 ` Pablo Neira Ayuso
  0 siblings, 0 replies; 12+ messages in thread
From: Pablo Neira Ayuso @ 2016-08-10 19:16 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

From: Liping Zhang <liping.zhang@spreadtrum.com>

Like NFQNL_MSG_VERDICT_BATCH do, we should also reject the verdict
request when the portid is not same with the initial portid(maybe
from another process).

Fixes: 97d32cf9440d ("netfilter: nfnetlink_queue: batch verdict support")
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nfnetlink_queue.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 5d36a09..f49f450 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -1145,10 +1145,8 @@ static int nfqnl_recv_verdict(struct net *net, struct sock *ctnl,
 	struct nfnl_queue_net *q = nfnl_queue_pernet(net);
 	int err;
 
-	queue = instance_lookup(q, queue_num);
-	if (!queue)
-		queue = verdict_instance_lookup(q, queue_num,
-						NETLINK_CB(skb).portid);
+	queue = verdict_instance_lookup(q, queue_num,
+					NETLINK_CB(skb).portid);
 	if (IS_ERR(queue))
 		return PTR_ERR(queue);
 
-- 
2.1.4

^ permalink raw reply	[flat|nested] 12+ messages in thread

end of thread, back to index

Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-08-10 18:56 [PATCH 0/9] Netfilter fixes for net Pablo Neira Ayuso
2016-08-10 18:56 ` [PATCH 1/9] netfilter: nf_ct_h323: do not re-activate already expired timer Pablo Neira Ayuso
2016-08-10 18:56 ` [PATCH 2/9] netfilter: nf_tables: s/MFT_REG32_01/NFT_REG32_01 Pablo Neira Ayuso
2016-08-10 18:56 ` [PATCH 3/9] netfilter: nft_rbtree: ignore inactive matching element with no descendants Pablo Neira Ayuso
2016-08-10 18:56 ` [PATCH 4/9] netfilter: nf_conntrack_sip: CSeq 0 is a valid CSeq Pablo Neira Ayuso
2016-08-10 18:56 ` [PATCH 5/9] netfilter: nf_ct_expect: remove the redundant slash when policy name is empty Pablo Neira Ayuso
2016-08-10 18:56 ` [PATCH 6/9] netfilter: nfnetlink_queue: fix memory leak when attach expectation successfully Pablo Neira Ayuso
2016-08-10 18:56 ` [PATCH 7/9] netfilter: nfnetlink_queue: reject verdict request from different portid Pablo Neira Ayuso
2016-08-10 18:56 ` [PATCH 8/9] netfilter: ctnetlink: reject new conntrack request with different l4proto Pablo Neira Ayuso
2016-08-10 18:56 ` [PATCH 9/9] netfilter: nft_exthdr: Add size check on u8 nft_exthdr attributes Pablo Neira Ayuso
2016-08-10 21:54 ` [PATCH 0/9] Netfilter fixes for net David Miller
2016-08-10 19:16 Pablo Neira Ayuso
2016-08-10 19:16 ` [PATCH 7/9] netfilter: nfnetlink_queue: reject verdict request from different portid Pablo Neira Ayuso

Netfilter-Devel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/netfilter-devel/0 netfilter-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 netfilter-devel netfilter-devel/ https://lore.kernel.org/netfilter-devel \
		netfilter-devel@vger.kernel.org
	public-inbox-index netfilter-devel

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.netfilter-devel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git