* [PATCH nft] exthdr: avoid crash with older kernels
@ 2017-04-04 18:46 Florian Westphal
2017-04-06 22:55 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: Florian Westphal @ 2017-04-04 18:46 UTC (permalink / raw)
To: netfilter-devel; +Cc: Florian Westphal
if kernel is older it won't understand the EXTHDR_OP attribute, i.e.
the rule gets accepted as a check for ipv6 exthdr.
On dump nft is then presented with a invalid ipv6 exthdr.
So we need to get rid of the assert and output an "invalid" message on
list. Longterm we need a proper vm description or kernel-side check
to reject such messages in first place.
After patch, test suite yields erros of type
ip6/tcpopt.t: WARNING: 'src/nft add rule --debug=netlink ip6 test-ip6 \
input tcp option sack right 1': 'tcp option sack right 1' mismatches
'ip6 nexthdr 6 unknown-exthdr unknown 0x1 [invalid type]'
Signed-off-by: Florian Westphal <fw@strlen.de>
---
src/exthdr.c | 37 +++++++++++++++++++++----------------
1 file changed, 21 insertions(+), 16 deletions(-)
diff --git a/src/exthdr.c b/src/exthdr.c
index 375e18f..c8599f2 100644
--- a/src/exthdr.c
+++ b/src/exthdr.c
@@ -44,9 +44,10 @@ static void exthdr_expr_print(const struct expr *expr)
} else {
if (expr->exthdr.flags & NFT_EXTHDR_F_PRESENT)
printf("exthdr %s", expr->exthdr.desc->name);
- else
- printf("%s %s", expr->exthdr.desc->name,
+ else {
+ printf("%s %s", expr->exthdr.desc ? expr->exthdr.desc->name : "unknown-exthdr",
expr->exthdr.tmpl->token);
+ }
}
}
@@ -116,7 +117,7 @@ void exthdr_init_raw(struct expr *expr, uint8_t type,
unsigned int offset, unsigned int len,
enum nft_exthdr_op op, uint32_t flags)
{
- const struct proto_hdr_template *tmpl;
+ const struct proto_hdr_template *tmpl = &exthdr_unknown_template;
unsigned int i;
assert(expr->ops->type == EXPR_EXTHDR);
@@ -126,23 +127,27 @@ void exthdr_init_raw(struct expr *expr, uint8_t type,
expr->len = len;
expr->exthdr.flags = flags;
expr->exthdr.offset = offset;
- expr->exthdr.desc = exthdr_protocols[type];
- assert(expr->exthdr.desc != NULL);
+ expr->exthdr.desc = NULL;
- for (i = 0; i < array_size(expr->exthdr.desc->templates); i++) {
- tmpl = &expr->exthdr.desc->templates[i];
- if (tmpl->offset != offset ||
- tmpl->len != len)
- continue;
+ if (type < array_size(exthdr_protocols))
+ expr->exthdr.desc = exthdr_protocols[type];
- if (flags & NFT_EXTHDR_F_PRESENT)
- expr->dtype = &boolean_type;
- else
- expr->dtype = tmpl->dtype;
+ if (expr->exthdr.desc == NULL)
+ goto out;
- expr->exthdr.tmpl = tmpl;
- return;
+ for (i = 0; i < array_size(expr->exthdr.desc->templates); i++) {
+ tmpl = &expr->exthdr.desc->templates[i];
+ if (tmpl->offset == offset && tmpl->len == len)
+ goto out;
}
+
+ tmpl = &exthdr_unknown_template;
+ out:
+ expr->exthdr.tmpl = tmpl;
+ if (flags & NFT_EXTHDR_F_PRESENT)
+ expr->dtype = &boolean_type;
+ else
+ expr->dtype = tmpl->dtype;
}
static unsigned int mask_length(const struct expr *mask)
--
2.9.3
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH nft] exthdr: avoid crash with older kernels
2017-04-04 18:46 [PATCH nft] exthdr: avoid crash with older kernels Florian Westphal
@ 2017-04-06 22:55 ` Pablo Neira Ayuso
0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2017-04-06 22:55 UTC (permalink / raw)
To: Florian Westphal; +Cc: netfilter-devel
On Tue, Apr 04, 2017 at 08:46:46PM +0200, Florian Westphal wrote:
> if kernel is older it won't understand the EXTHDR_OP attribute, i.e.
> the rule gets accepted as a check for ipv6 exthdr.
>
> On dump nft is then presented with a invalid ipv6 exthdr.
> So we need to get rid of the assert and output an "invalid" message on
> list. Longterm we need a proper vm description or kernel-side check
> to reject such messages in first place.
>
> After patch, test suite yields erros of type
> ip6/tcpopt.t: WARNING: 'src/nft add rule --debug=netlink ip6 test-ip6 \
> input tcp option sack right 1': 'tcp option sack right 1' mismatches
> 'ip6 nexthdr 6 unknown-exthdr unknown 0x1 [invalid type]'
>
> Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-04-06 22:55 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-04-04 18:46 [PATCH nft] exthdr: avoid crash with older kernels Florian Westphal
2017-04-06 22:55 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).