[NETFILTER 02/02]: ipt_recent: sanity check hit count

[NETFILTER 02/02]: ipt_recent: sanity check hit count

[Patrick McHardy]

[-- Attachment #1: Type: text/plain, Size: 0 bytes --]



[-- Attachment #2: 02.diff --]
[-- Type: text/x-diff, Size: 1968 bytes --]

commit be32bceccbf7051ff1433943df7e808c576d1191
Author: Daniel Hokka Zakrisson <daniel@hozac.com>
Date:   Thu Mar 20 18:34:39 2008 +0100

    [NETFILTER]: ipt_recent: sanity check hit count
    
    If a rule using ipt_recent is created with a hit count greater than
    ip_pkt_list_tot, the rule will never match as it cannot keep track
    of enough timestamps. This patch makes ipt_recent refuse to create such
    rules.
    
    With ip_pkt_list_tot's default value of 20, the following can be used
    to reproduce the problem.
    
    nc -u -l 0.0.0.0 1234 &
    for i in `seq 1 100`; do echo $i | nc -w 1 -u 127.0.0.1 1234; done
    
    This limits it to 20 packets:
    iptables -A OUTPUT -p udp --dport 1234 -m recent --set --name test \
             --rsource
    iptables -A OUTPUT -p udp --dport 1234 -m recent --update --seconds \
             60 --hitcount 20 --name test --rsource -j DROP
    
    While this is unlimited:
    iptables -A OUTPUT -p udp --dport 1234 -m recent --set --name test \
             --rsource
    iptables -A OUTPUT -p udp --dport 1234 -m recent --update --seconds \
             60 --hitcount 21 --name test --rsource -j DROP
    
    With the patch the second rule-set will throw an EINVAL.
    
    Reported-by: Sean Kennedy <skennedy@vcn.com>
    Signed-off-by: Daniel Hokka Zakrisson <daniel@hozac.com>
    Signed-off-by: Patrick McHardy <kaber@trash.net>

diff --git a/net/ipv4/netfilter/ipt_recent.c b/net/ipv4/netfilter/ipt_recent.c
index 68cbe3c..8e8f042 100644
--- a/net/ipv4/netfilter/ipt_recent.c
+++ b/net/ipv4/netfilter/ipt_recent.c
@@ -252,6 +252,8 @@ recent_mt_check(const char *tablename, const void *ip,
 	if ((info->check_set & (IPT_RECENT_SET | IPT_RECENT_REMOVE)) &&
 	    (info->seconds || info->hit_count))
 		return false;
+	if (info->hit_count > ip_pkt_list_tot)
+		return false;
 	if (info->name[0] == '\0' ||
 	    strnlen(info->name, IPT_RECENT_NAME_LEN) == IPT_RECENT_NAME_LEN)
 		return false;

Re: [NETFILTER 02/02]: ipt_recent: sanity check hit count

[David Miller]

From: Patrick McHardy <kaber@trash.net>
Date: Thu, 20 Mar 2008 18:55:19 +0100

> [NETFILTER]: ipt_recent: sanity check hit count
> 
> If a rule using ipt_recent is created with a hit count greater than
> ip_pkt_list_tot, the rule will never match as it cannot keep track
> of enough timestamps. This patch makes ipt_recent refuse to create such
> rules.
> 
> With ip_pkt_list_tot's default value of 20, the following can be used
> to reproduce the problem.
> 
> nc -u -l 0.0.0.0 1234 &
> for i in `seq 1 100`; do echo $i | nc -w 1 -u 127.0.0.1 1234; done
> 
> This limits it to 20 packets:
> iptables -A OUTPUT -p udp --dport 1234 -m recent --set --name test \
>          --rsource
> iptables -A OUTPUT -p udp --dport 1234 -m recent --update --seconds \
>          60 --hitcount 20 --name test --rsource -j DROP
> 
> While this is unlimited:
> iptables -A OUTPUT -p udp --dport 1234 -m recent --set --name test \
>          --rsource
> iptables -A OUTPUT -p udp --dport 1234 -m recent --update --seconds \
>          60 --hitcount 21 --name test --rsource -j DROP
> 
> With the patch the second rule-set will throw an EINVAL.
> 
> Reported-by: Sean Kennedy <skennedy@vcn.com>
> Signed-off-by: Daniel Hokka Zakrisson <daniel@hozac.com>
> Signed-off-by: Patrick McHardy <kaber@trash.net>

Also applied, thanks.