From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc [91.216.245.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 82F763EE1C0 for ; Mon, 6 Jul 2026 12:31:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.216.245.30 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783341075; cv=none; b=eSgz3fEtncAxKeOQhCYy7+IEV/Q8emQOaOzSX2rNPG+MIRjAt4KPz+9ABxXKx0B2WO063ui0w9+hVNH5Q3khXCcIyEfbTNjk53Ip6LIsQ30hyryqgbRw5ISXgmo+sSODfBlMMKn9hIyCZH4xiqO1NG5t/P6hvR99m3YwAeIIOXc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783341075; c=relaxed/simple; bh=vDYIrJTrkXgofS+9+kSf6a7zutrm/8RhrspSig5+HPg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=YLuUyAw6GYqh5R7urVszeD/26tT05WowzI5/9h6kLnBS82yeIjZ0+iVo8vy1v0dB0oKG84nr+KiYM1MtVF9YlEmw6dIbGi/nHuOhbuSiVcm1/OfgZTHDRcjzr79OxRHDI2FTH6Xtu45f2ea6BKMI9P3NmyUeD1YTX+1FK5seRAY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=strlen.de; spf=pass smtp.mailfrom=Chamillionaire.breakpoint.cc; arc=none smtp.client-ip=91.216.245.30 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=strlen.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=Chamillionaire.breakpoint.cc Received: by Chamillionaire.breakpoint.cc (Postfix, from userid 1003) id 4D3B46064E; Mon, 06 Jul 2026 14:31:11 +0200 (CEST) From: Florian Westphal To: Cc: Florian Westphal Subject: [PATCH nf-next] netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet Date: Mon, 6 Jul 2026 14:30:55 +0200 Message-ID: <20260706123058.13242-1-fw@strlen.de> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: netfilter-devel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit sashiko says: If map_addr() changes the packet length, such as when the public NAT IP string is shorter or longer than the internal IP, coff will still point to the offset relative to the pre-mangled packet. If the packet shrinks, coff could overshoot the correct position, potentially causing the next ct_sip_parse_header_uri() call to silently skip bytes and miss subsequent Contact headers. Could this lead to a failure to NAT those subsequent headers and leak internal network details? Fixes: c978cd3a9371 ("[NETFILTER]: nf_nat_sip: translate all Contact headers") Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Florian Westphal --- No bug reports for this, not clear how many uses are left. Not urgent, defer to -next. diff --git a/net/netfilter/nf_nat_sip.c b/net/netfilter/nf_nat_sip.c index aea02f6aff09..762d7e7bb7c7 100644 --- a/net/netfilter/nf_nat_sip.c +++ b/net/netfilter/nf_nat_sip.c @@ -273,12 +273,17 @@ static unsigned int nf_nat_sip(struct sk_buff *skb, unsigned int protoff, SIP_HDR_CONTACT, &in_header, &matchoff, &matchlen, &addr, &port) > 0) { + int old_len = skb->len, delta; + if (!map_addr(skb, protoff, dataoff, dptr, datalen, matchoff, matchlen, &addr, port)) { nf_ct_helper_log(skb, ct, "cannot mangle contact"); return NF_DROP; } + + delta = (int)skb->len - old_len; + coff += delta; } if (!map_sip_addr(skb, protoff, dataoff, dptr, datalen, SIP_HDR_FROM) || -- 2.54.0