From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 473741EB5FD; Sat, 12 Sep 2026 07:56:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789199781; cv=none; b=ll4lDKrkPvXaufqD81FcKJWq8t05EaNx8t2T6n98ruiAObB4LVTNdQ+hp+59fd0rLeam16hSyIveduQJ9Sj23Ih/M2j0Iy+eA47PoklLsjzNT/kBpaabkAvVjPa8mG3ie36kMMCFunX7szsF9A4amY7O0suToII9wzCViTw7ZYs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789199781; c=relaxed/simple; bh=2KivHhhA0Q6ra42IoDxC1GYdFufgakCxhtD50zuYPgw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=V59LbBG4IBULBrRvxxDqx6+ueg0cBiiugtHoM9aY2llIGaHGwSoIVEhJk5Ag2er161SJidbrHAibCTfT4dnocVnBwPlDZrLRdJok0cWT7ldZRf4DC7Snr7D1bcfbfh+roIQplLeVL7SuBdWrOziZQh/MjziVfEavDyYcZPjcWHM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=XNpG1TBV; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="XNpG1TBV" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DC0DC1F000FF; Sat, 12 Sep 2026 07:56:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789199779; bh=w/0QwAgbZiN9a18MWpObThIPhR4qhZZIs+xylKYAXbA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=XNpG1TBVNT7xNHVNnda4TdbQ+jC7Pgg7Z5nMdabnCJYBrrwB1Adobql/TcPZBYIiZ Es0X7sN7m7BntezTzbpRAn3y9usp+6LIJyGsFLMW4w1xfF5VMlzIF5cq8tFufmFoJX 4wdYj3uRF9k9ekuvmzcTa0ZBZRd7zK/C7nnRsnts= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Florian Westphal , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 7.2 0638/1815] netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet Date: Sat, 12 Sep 2026 08:39:48 +0200 Message-ID: <20260912065703.859231737@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260912065648.999753832@linuxfoundation.org> References: <20260912065648.999753832@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.2-stable review patch. If anyone has any objections, please let me know. ------------------ From: Florian Westphal [ Upstream commit 16aecbe3036f6097c26b51b12e4c1cf207769690 ] sashiko says: If map_addr() changes the packet length, such as when the public NAT IP string is shorter or longer than the internal IP, coff will still point to the offset relative to the pre-mangled packet. If the packet shrinks, coff could overshoot the correct position, potentially causing the next ct_sip_parse_header_uri() call to silently skip bytes and miss subsequent Contact headers. Could this lead to a failure to NAT those subsequent headers and leak internal network details? Fixes: c978cd3a9371 ("[NETFILTER]: nf_nat_sip: translate all Contact headers") Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- net/netfilter/nf_nat_sip.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/netfilter/nf_nat_sip.c b/net/netfilter/nf_nat_sip.c index 133bd713fe0c2..8c412bcf6cff5 100644 --- a/net/netfilter/nf_nat_sip.c +++ b/net/netfilter/nf_nat_sip.c @@ -273,12 +273,17 @@ static unsigned int nf_nat_sip(struct sk_buff *skb, unsigned int protoff, SIP_HDR_CONTACT, &in_header, &matchoff, &matchlen, &addr, &port) > 0) { + int old_len = skb->len, delta; + if (!map_addr(skb, protoff, dataoff, dptr, datalen, matchoff, matchlen, &addr, port)) { nf_ct_helper_log(skb, ct, "cannot mangle contact"); return NF_DROP; } + + delta = (int)skb->len - old_len; + coff += delta; } if (!map_sip_addr(skb, protoff, dataoff, dptr, datalen, SIP_HDR_FROM) || -- 2.53.0