From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CA734372ED0; Sat, 12 Sep 2026 18:51:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789239086; cv=none; b=W53DTBf/O0UC7JhcqzNSlFHZ6zfDQNasV3YJYSgFovKvOAxFy1VM6XAcp6D+GPq3QpiVkQ+540LEJ2WQnKIi4jLpOIryq6Km/nRdVRQmbD5UCkGo7Ok7k2T/DElJbh3dD82haTPdUya23WAHxjh2Wpe71Hek9yI0W+bAOl3uu8o= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789239086; c=relaxed/simple; bh=n4otS6qoGMGzrEIiPKplCKcD1wJlTqi5yyyB2Fons1o=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=p5D6bt6s2e6+RV646XLupeetUxBYaQTsdwelWsx/Dq3GUjdPw090qGZGVQYwOnm8x6HW4supmHOfbP0+u6+xn/MkcNwqBKwYSKwWSfr5biDy9bR31lKmvvZwj6QvvM+EqcHng7CzfDnFosn6ZEdvoDAz9nyM5CCHhf4NzPIkapY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=qPu1m8kM; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="qPu1m8kM" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CC49A1F000FF; Sat, 12 Sep 2026 18:51:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789239085; bh=Nt1IzKm2hbBjfPd1u3VPlUd3uJ3HgvWxSQaGFpWfeZs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=qPu1m8kMa87cg4KUh40ySl01MTIywCjY7D5xyYogTet/EausBroTXDcGmAyhPqzbd rrHKacWkdfR1N/6wiOsRpHVed51Ka4KH4dfiVUGwSTo1midzoAh8u0kYRr/inv8dGB 4EH8qmwvCYLv8gLe6dRHwV4AtmTR6Ro1S6kUGxis= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Florian Westphal , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 5.15 594/935] netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet Date: Sat, 12 Sep 2026 09:00:24 +0200 Message-ID: <20260912065540.464594814@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260912065526.833703348@linuxfoundation.org> References: <20260912065526.833703348@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Florian Westphal [ Upstream commit 16aecbe3036f6097c26b51b12e4c1cf207769690 ] sashiko says: If map_addr() changes the packet length, such as when the public NAT IP string is shorter or longer than the internal IP, coff will still point to the offset relative to the pre-mangled packet. If the packet shrinks, coff could overshoot the correct position, potentially causing the next ct_sip_parse_header_uri() call to silently skip bytes and miss subsequent Contact headers. Could this lead to a failure to NAT those subsequent headers and leak internal network details? Fixes: c978cd3a9371 ("[NETFILTER]: nf_nat_sip: translate all Contact headers") Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- net/netfilter/nf_nat_sip.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/netfilter/nf_nat_sip.c b/net/netfilter/nf_nat_sip.c index 7687d3d15df22..a77881c218ebf 100644 --- a/net/netfilter/nf_nat_sip.c +++ b/net/netfilter/nf_nat_sip.c @@ -267,12 +267,17 @@ static unsigned int nf_nat_sip(struct sk_buff *skb, unsigned int protoff, SIP_HDR_CONTACT, &in_header, &matchoff, &matchlen, &addr, &port) > 0) { + int old_len = skb->len, delta; + if (!map_addr(skb, protoff, dataoff, dptr, datalen, matchoff, matchlen, &addr, port)) { nf_ct_helper_log(skb, ct, "cannot mangle contact"); return NF_DROP; } + + delta = (int)skb->len - old_len; + coff += delta; } if (!map_sip_addr(skb, protoff, dataoff, dptr, datalen, SIP_HDR_FROM) || -- 2.53.0