Re: [SECURITY] netfilter: nft_limit byte-rate bypass via unchecked u64 multiplication

[Florian Westphal <fw@strlen.de>]

SaifAllah benMassaoud <saifmassaoudi18@gmail.com> wrote:
> My security concern is that an administrator may configure this limit to
> protect a service, yet a less-privileged sender could circumvent the
> intended rate enforcement by sending packets of specific sizes, without
> modifying the ruleset.

Why would anyone use 'per week' rates...?

N packets/s.
N packets/minute
N packets/hour.

.. make sense to me.

But even N packets/day is dubious. with that kind of limitation, why
would you even log in the first place?

The byte rate limiting is for traffic policing, i.e. N bytes / second.
The obvious 'fix' for your case is to reject the rule add.

diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c
--- a/net/netfilter/nft_limit.c
+++ b/net/netfilter/nft_limit.c
@@ -73,6 +73,10 @@ static int nft_limit_init(struct nft_limit_priv *priv,
        if (check_mul_overflow(unit, NSEC_PER_SEC, &priv->nsecs))
                return -EOVERFLOW;

+       if (!pkts &&
+           check_mul_overflow(priv->nsecs, GRO_MAX_SIZE, &tmp))
+               return -EOVERFLOW;
+
        if (tb[NFTA_LIMIT_BURST])

but I agree with Pablo, this is not a security issue.
Consider testing the above and then submitting that as a patch,
targetting nf-next tree.