* [PATCH] netfilter: check the length of the data before dereferencing it
@ 2012-04-01 14:22 Changli Gao
2012-04-01 16:43 ` Pablo Neira Ayuso
0 siblings, 1 reply; 5+ messages in thread
From: Changli Gao @ 2012-04-01 14:22 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: Patrick McHardy, David S. Miller, netfilter-devel, netdev,
Changli Gao
We should check the length of the data before dereferencing it when parsing
the TCP options.
Signed-off-by: Changli Gao <xiaosuo@gmail.com>
---
net/netfilter/nf_conntrack_proto_tcp.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 361eade..9e446c5 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -404,6 +404,8 @@ static void tcp_options(const struct sk_buff *skb,
length--;
continue;
default:
+ if (length < 2)
+ return;
opsize=*ptr++;
if (opsize < 2) /* "silly options" */
return;
@@ -464,6 +466,8 @@ static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
length--;
continue;
default:
+ if (length < 2)
+ return;
opsize = *ptr++;
if (opsize < 2) /* "silly options" */
return;
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] netfilter: check the length of the data before dereferencing it
2012-04-01 14:22 [PATCH] netfilter: check the length of the data before dereferencing it Changli Gao
@ 2012-04-01 16:43 ` Pablo Neira Ayuso
2012-04-01 16:55 ` Eric Dumazet
0 siblings, 1 reply; 5+ messages in thread
From: Pablo Neira Ayuso @ 2012-04-01 16:43 UTC (permalink / raw)
To: Changli Gao; +Cc: Patrick McHardy, David S. Miller, netfilter-devel, netdev
On Sun, Apr 01, 2012 at 10:22:50PM +0800, Changli Gao wrote:
> We should check the length of the data before dereferencing it when parsing
> the TCP options.
>
> Signed-off-by: Changli Gao <xiaosuo@gmail.com>
> ---
> net/netfilter/nf_conntrack_proto_tcp.c | 4 ++++
> 1 file changed, 4 insertions(+)
> diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
> index 361eade..9e446c5 100644
> --- a/net/netfilter/nf_conntrack_proto_tcp.c
> +++ b/net/netfilter/nf_conntrack_proto_tcp.c
> @@ -404,6 +404,8 @@ static void tcp_options(const struct sk_buff *skb,
> length--;
> continue;
> default:
> + if (length < 2)
> + return;
> opsize=*ptr++;
> if (opsize < 2) /* "silly options" */
> return;
length is always multiple of 4:
int length = (tcph->doff*4) - sizeof(struct tcphdr);
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] netfilter: check the length of the data before dereferencing it
2012-04-01 16:43 ` Pablo Neira Ayuso
@ 2012-04-01 16:55 ` Eric Dumazet
2012-04-01 17:02 ` Pablo Neira Ayuso
0 siblings, 1 reply; 5+ messages in thread
From: Eric Dumazet @ 2012-04-01 16:55 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: Changli Gao, Patrick McHardy, David S. Miller, netfilter-devel,
netdev
On Sun, 2012-04-01 at 18:43 +0200, Pablo Neira Ayuso wrote:
> On Sun, Apr 01, 2012 at 10:22:50PM +0800, Changli Gao wrote:
> > We should check the length of the data before dereferencing it when parsing
> > the TCP options.
> >
> > Signed-off-by: Changli Gao <xiaosuo@gmail.com>
> > ---
> > net/netfilter/nf_conntrack_proto_tcp.c | 4 ++++
> > 1 file changed, 4 insertions(+)
> > diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
> > index 361eade..9e446c5 100644
> > --- a/net/netfilter/nf_conntrack_proto_tcp.c
> > +++ b/net/netfilter/nf_conntrack_proto_tcp.c
> > @@ -404,6 +404,8 @@ static void tcp_options(const struct sk_buff *skb,
> > length--;
> > continue;
> > default:
> > + if (length < 2)
> > + return;
> > opsize=*ptr++;
> > if (opsize < 2) /* "silly options" */
> > return;
>
> length is always multiple of 4:
>
> int length = (tcph->doff*4) - sizeof(struct tcphdr);
> --
initial value yes, but it can change in the loop.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] netfilter: check the length of the data before dereferencing it
2012-04-01 16:55 ` Eric Dumazet
@ 2012-04-01 17:02 ` Pablo Neira Ayuso
2012-04-02 3:05 ` Changli Gao
0 siblings, 1 reply; 5+ messages in thread
From: Pablo Neira Ayuso @ 2012-04-01 17:02 UTC (permalink / raw)
To: Eric Dumazet
Cc: Changli Gao, Patrick McHardy, David S. Miller, netfilter-devel,
netdev
On Sun, Apr 01, 2012 at 06:55:22PM +0200, Eric Dumazet wrote:
> On Sun, 2012-04-01 at 18:43 +0200, Pablo Neira Ayuso wrote:
> > On Sun, Apr 01, 2012 at 10:22:50PM +0800, Changli Gao wrote:
> > > We should check the length of the data before dereferencing it when parsing
> > > the TCP options.
> > >
> > > Signed-off-by: Changli Gao <xiaosuo@gmail.com>
> > > ---
> > > net/netfilter/nf_conntrack_proto_tcp.c | 4 ++++
> > > 1 file changed, 4 insertions(+)
> > > diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
> > > index 361eade..9e446c5 100644
> > > --- a/net/netfilter/nf_conntrack_proto_tcp.c
> > > +++ b/net/netfilter/nf_conntrack_proto_tcp.c
> > > @@ -404,6 +404,8 @@ static void tcp_options(const struct sk_buff *skb,
> > > length--;
> > > continue;
> > > default:
> > > + if (length < 2)
> > > + return;
> > > opsize=*ptr++;
> > > if (opsize < 2) /* "silly options" */
> > > return;
> >
> > length is always multiple of 4:
> >
> > int length = (tcph->doff*4) - sizeof(struct tcphdr);
> > --
>
> initial value yes, but it can change in the loop.
Indeed, then I think we need a similar patch for tcp_parse_options()
in net/ipv4/tcp_input.c
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] netfilter: check the length of the data before dereferencing it
2012-04-01 17:02 ` Pablo Neira Ayuso
@ 2012-04-02 3:05 ` Changli Gao
0 siblings, 0 replies; 5+ messages in thread
From: Changli Gao @ 2012-04-02 3:05 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: Eric Dumazet, Patrick McHardy, David S. Miller, netfilter-devel,
netdev
On Mon, Apr 2, 2012 at 1:02 AM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
>
> Indeed, then I think we need a similar patch for tcp_parse_options()
> in net/ipv4/tcp_input.c
I'll send a separated patch for it. Thanks.
--
Regards,
Changli Gao(xiaosuo@gmail.com)
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2012-04-02 3:05 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-04-01 14:22 [PATCH] netfilter: check the length of the data before dereferencing it Changli Gao
2012-04-01 16:43 ` Pablo Neira Ayuso
2012-04-01 16:55 ` Eric Dumazet
2012-04-01 17:02 ` Pablo Neira Ayuso
2012-04-02 3:05 ` Changli Gao
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).