* [PATCH nf 2/2] netfilter: nft_osf: check for TCP packet before further processing
2021-06-10 18:20 [PATCH nf 1/2] netfilter: nft_exthdr: check for IPv6 packet before further processing Pablo Neira Ayuso
@ 2021-06-10 18:20 ` Pablo Neira Ayuso
2021-06-16 14:42 ` kernel test robot
2021-06-16 12:48 ` [PATCH nf 1/2] netfilter: nft_exthdr: check for IPv6 " kernel test robot
` (2 subsequent siblings)
3 siblings, 1 reply; 6+ messages in thread
From: Pablo Neira Ayuso @ 2021-06-10 18:20 UTC (permalink / raw)
To: netfilter-devel
The osf expression only supports for TCP packets, add a upfront sanity
check to skip packet parsing if this is not a TCP packet.
Fixes: b96af92d6eaf ("netfilter: nf_tables: implement Passive OS fingerprint module in nft_osf")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nft_osf.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/netfilter/nft_osf.c b/net/netfilter/nft_osf.c
index ac61f708b82d..4e6c65eaf567 100644
--- a/net/netfilter/nft_osf.c
+++ b/net/netfilter/nft_osf.c
@@ -28,6 +28,11 @@ static void nft_osf_eval(const struct nft_expr *expr, struct nft_regs *regs,
struct nf_osf_data data;
struct tcphdr _tcph;
+ if (pkt->tprot != IPPROTO_TCP) {
+ regs->verdict.code = NFT_BREAK;
+ break;
+ }
+
tcp = skb_header_pointer(skb, ip_hdrlen(skb),
sizeof(struct tcphdr), &_tcph);
if (!tcp) {
--
2.20.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH nf 2/2] netfilter: nft_osf: check for TCP packet before further processing
2021-06-10 18:20 ` [PATCH nf 2/2] netfilter: nft_osf: check for TCP " Pablo Neira Ayuso
@ 2021-06-16 14:42 ` kernel test robot
0 siblings, 0 replies; 6+ messages in thread
From: kernel test robot @ 2021-06-16 14:42 UTC (permalink / raw)
To: Pablo Neira Ayuso, netfilter-devel; +Cc: kbuild-all, clang-built-linux
[-- Attachment #1: Type: text/plain, Size: 3044 bytes --]
Hi Pablo,
I love your patch! Yet something to improve:
[auto build test ERROR on nf/master]
url: https://github.com/0day-ci/linux/commits/Pablo-Neira-Ayuso/netfilter-nft_exthdr-check-for-IPv6-packet-before-further-processing/20210616-144640
base: https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
config: arm-randconfig-r001-20210615 (attached as .config)
compiler: clang version 13.0.0 (https://github.com/llvm/llvm-project 64720f57bea6a6bf033feef4a5751ab9c0c3b401)
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# install arm cross compiling tool for clang build
# apt-get install binutils-arm-linux-gnueabi
# https://github.com/0day-ci/linux/commit/f572a05becf9cc86053b01e0f0f898334583692a
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Pablo-Neira-Ayuso/netfilter-nft_exthdr-check-for-IPv6-packet-before-further-processing/20210616-144640
git checkout f572a05becf9cc86053b01e0f0f898334583692a
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=arm
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
All errors (new ones prefixed by >>):
>> net/netfilter/nft_osf.c:33:3: error: 'break' statement not in loop or switch statement
break;
^
1 error generated.
vim +/break +33 net/netfilter/nft_osf.c
19
20 static void nft_osf_eval(const struct nft_expr *expr, struct nft_regs *regs,
21 const struct nft_pktinfo *pkt)
22 {
23 struct nft_osf *priv = nft_expr_priv(expr);
24 u32 *dest = ®s->data[priv->dreg];
25 struct sk_buff *skb = pkt->skb;
26 char os_match[NFT_OSF_MAXGENRELEN + 1];
27 const struct tcphdr *tcp;
28 struct nf_osf_data data;
29 struct tcphdr _tcph;
30
31 if (pkt->tprot != IPPROTO_TCP) {
32 regs->verdict.code = NFT_BREAK;
> 33 break;
34 }
35
36 tcp = skb_header_pointer(skb, ip_hdrlen(skb),
37 sizeof(struct tcphdr), &_tcph);
38 if (!tcp) {
39 regs->verdict.code = NFT_BREAK;
40 return;
41 }
42 if (!tcp->syn) {
43 regs->verdict.code = NFT_BREAK;
44 return;
45 }
46
47 if (!nf_osf_find(skb, nf_osf_fingers, priv->ttl, &data)) {
48 strncpy((char *)dest, "unknown", NFT_OSF_MAXGENRELEN);
49 } else {
50 if (priv->flags & NFT_OSF_F_VERSION)
51 snprintf(os_match, NFT_OSF_MAXGENRELEN, "%s:%s",
52 data.genre, data.version);
53 else
54 strlcpy(os_match, data.genre, NFT_OSF_MAXGENRELEN);
55
56 strncpy((char *)dest, os_match, NFT_OSF_MAXGENRELEN);
57 }
58 }
59
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 28746 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH nf 1/2] netfilter: nft_exthdr: check for IPv6 packet before further processing
2021-06-10 18:20 [PATCH nf 1/2] netfilter: nft_exthdr: check for IPv6 packet before further processing Pablo Neira Ayuso
2021-06-10 18:20 ` [PATCH nf 2/2] netfilter: nft_osf: check for TCP " Pablo Neira Ayuso
@ 2021-06-16 12:48 ` kernel test robot
2021-06-16 13:48 ` kernel test robot
2021-06-16 14:14 ` kernel test robot
3 siblings, 0 replies; 6+ messages in thread
From: kernel test robot @ 2021-06-16 12:48 UTC (permalink / raw)
To: Pablo Neira Ayuso, netfilter-devel; +Cc: kbuild-all
[-- Attachment #1: Type: text/plain, Size: 2573 bytes --]
Hi Pablo,
I love your patch! Yet something to improve:
[auto build test ERROR on nf/master]
url: https://github.com/0day-ci/linux/commits/Pablo-Neira-Ayuso/netfilter-nft_exthdr-check-for-IPv6-packet-before-further-processing/20210616-144640
base: https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
config: i386-randconfig-s001-20210615 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
reproduce:
# apt-get install sparse
# sparse version: v0.6.3-341-g8af24329-dirty
# https://github.com/0day-ci/linux/commit/3e2206f7e73972c0cb8a3b6b8a8e0b636a959c96
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Pablo-Neira-Ayuso/netfilter-nft_exthdr-check-for-IPv6-packet-before-further-processing/20210616-144640
git checkout 3e2206f7e73972c0cb8a3b6b8a8e0b636a959c96
# save the attached .config to linux build tree
make W=1 C=1 CF='-fdiagnostic-prefix -D__CHECK_ENDIAN__' W=1 ARCH=i386
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
All errors (new ones prefixed by >>):
net/netfilter/nft_exthdr.c: In function 'nft_exthdr_ipv6_eval':
>> net/netfilter/nft_exthdr.c:45:6: error: 'skb' undeclared (first use in this function)
45 | if (skb->protocol != htons(ETH_P_IPV6))
| ^~~
net/netfilter/nft_exthdr.c:45:6: note: each undeclared identifier is reported only once for each function it appears in
vim +/skb +45 net/netfilter/nft_exthdr.c
35
36 static void nft_exthdr_ipv6_eval(const struct nft_expr *expr,
37 struct nft_regs *regs,
38 const struct nft_pktinfo *pkt)
39 {
40 struct nft_exthdr *priv = nft_expr_priv(expr);
41 u32 *dest = ®s->data[priv->dreg];
42 unsigned int offset = 0;
43 int err;
44
> 45 if (skb->protocol != htons(ETH_P_IPV6))
46 goto err;
47
48 err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);
49 if (priv->flags & NFT_EXTHDR_F_PRESENT) {
50 nft_reg_store8(dest, err >= 0);
51 return;
52 } else if (err < 0) {
53 goto err;
54 }
55 offset += priv->offset;
56
57 dest[priv->len / NFT_REG32_SIZE] = 0;
58 if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0)
59 goto err;
60 return;
61 err:
62 regs->verdict.code = NFT_BREAK;
63 }
64
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 42304 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH nf 1/2] netfilter: nft_exthdr: check for IPv6 packet before further processing
2021-06-10 18:20 [PATCH nf 1/2] netfilter: nft_exthdr: check for IPv6 packet before further processing Pablo Neira Ayuso
2021-06-10 18:20 ` [PATCH nf 2/2] netfilter: nft_osf: check for TCP " Pablo Neira Ayuso
2021-06-16 12:48 ` [PATCH nf 1/2] netfilter: nft_exthdr: check for IPv6 " kernel test robot
@ 2021-06-16 13:48 ` kernel test robot
2021-06-16 14:14 ` kernel test robot
3 siblings, 0 replies; 6+ messages in thread
From: kernel test robot @ 2021-06-16 13:48 UTC (permalink / raw)
To: Pablo Neira Ayuso, netfilter-devel; +Cc: kbuild-all, clang-built-linux
[-- Attachment #1: Type: text/plain, Size: 2645 bytes --]
Hi Pablo,
I love your patch! Yet something to improve:
[auto build test ERROR on nf/master]
url: https://github.com/0day-ci/linux/commits/Pablo-Neira-Ayuso/netfilter-nft_exthdr-check-for-IPv6-packet-before-further-processing/20210616-144640
base: https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
config: arm-randconfig-r001-20210615 (attached as .config)
compiler: clang version 13.0.0 (https://github.com/llvm/llvm-project 64720f57bea6a6bf033feef4a5751ab9c0c3b401)
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# install arm cross compiling tool for clang build
# apt-get install binutils-arm-linux-gnueabi
# https://github.com/0day-ci/linux/commit/3e2206f7e73972c0cb8a3b6b8a8e0b636a959c96
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Pablo-Neira-Ayuso/netfilter-nft_exthdr-check-for-IPv6-packet-before-further-processing/20210616-144640
git checkout 3e2206f7e73972c0cb8a3b6b8a8e0b636a959c96
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=arm
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
All errors (new ones prefixed by >>):
>> net/netfilter/nft_exthdr.c:45:6: error: use of undeclared identifier 'skb'
if (skb->protocol != htons(ETH_P_IPV6))
^
1 error generated.
vim +/skb +45 net/netfilter/nft_exthdr.c
35
36 static void nft_exthdr_ipv6_eval(const struct nft_expr *expr,
37 struct nft_regs *regs,
38 const struct nft_pktinfo *pkt)
39 {
40 struct nft_exthdr *priv = nft_expr_priv(expr);
41 u32 *dest = ®s->data[priv->dreg];
42 unsigned int offset = 0;
43 int err;
44
> 45 if (skb->protocol != htons(ETH_P_IPV6))
46 goto err;
47
48 err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);
49 if (priv->flags & NFT_EXTHDR_F_PRESENT) {
50 nft_reg_store8(dest, err >= 0);
51 return;
52 } else if (err < 0) {
53 goto err;
54 }
55 offset += priv->offset;
56
57 dest[priv->len / NFT_REG32_SIZE] = 0;
58 if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0)
59 goto err;
60 return;
61 err:
62 regs->verdict.code = NFT_BREAK;
63 }
64
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 28746 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH nf 1/2] netfilter: nft_exthdr: check for IPv6 packet before further processing
2021-06-10 18:20 [PATCH nf 1/2] netfilter: nft_exthdr: check for IPv6 packet before further processing Pablo Neira Ayuso
` (2 preceding siblings ...)
2021-06-16 13:48 ` kernel test robot
@ 2021-06-16 14:14 ` kernel test robot
3 siblings, 0 replies; 6+ messages in thread
From: kernel test robot @ 2021-06-16 14:14 UTC (permalink / raw)
To: Pablo Neira Ayuso, netfilter-devel; +Cc: kbuild-all, clang-built-linux
[-- Attachment #1: Type: text/plain, Size: 2653 bytes --]
Hi Pablo,
I love your patch! Yet something to improve:
[auto build test ERROR on nf/master]
url: https://github.com/0day-ci/linux/commits/Pablo-Neira-Ayuso/netfilter-nft_exthdr-check-for-IPv6-packet-before-further-processing/20210616-144640
base: https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
config: x86_64-randconfig-a013-20210615 (attached as .config)
compiler: clang version 13.0.0 (https://github.com/llvm/llvm-project 64720f57bea6a6bf033feef4a5751ab9c0c3b401)
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# install x86_64 cross compiling tool for clang build
# apt-get install binutils-x86-64-linux-gnu
# https://github.com/0day-ci/linux/commit/3e2206f7e73972c0cb8a3b6b8a8e0b636a959c96
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Pablo-Neira-Ayuso/netfilter-nft_exthdr-check-for-IPv6-packet-before-further-processing/20210616-144640
git checkout 3e2206f7e73972c0cb8a3b6b8a8e0b636a959c96
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=x86_64
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
All errors (new ones prefixed by >>):
>> net/netfilter/nft_exthdr.c:45:6: error: use of undeclared identifier 'skb'
if (skb->protocol != htons(ETH_P_IPV6))
^
1 error generated.
vim +/skb +45 net/netfilter/nft_exthdr.c
35
36 static void nft_exthdr_ipv6_eval(const struct nft_expr *expr,
37 struct nft_regs *regs,
38 const struct nft_pktinfo *pkt)
39 {
40 struct nft_exthdr *priv = nft_expr_priv(expr);
41 u32 *dest = ®s->data[priv->dreg];
42 unsigned int offset = 0;
43 int err;
44
> 45 if (skb->protocol != htons(ETH_P_IPV6))
46 goto err;
47
48 err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);
49 if (priv->flags & NFT_EXTHDR_F_PRESENT) {
50 nft_reg_store8(dest, err >= 0);
51 return;
52 } else if (err < 0) {
53 goto err;
54 }
55 offset += priv->offset;
56
57 dest[priv->len / NFT_REG32_SIZE] = 0;
58 if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0)
59 goto err;
60 return;
61 err:
62 regs->verdict.code = NFT_BREAK;
63 }
64
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 38719 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread