|
 |
4b2fc1 |
From 611c93ad808addc5e3f38c279de273d6419b5c6e Mon Sep 17 00:00:00 2001
|
|
|
4b2fc1 |
From: Timothy Redaelli <tredaelli@redhat.com>
|
|
|
4b2fc1 |
Date: Mon, 8 May 2017 18:43:32 +0200
|
|
|
4b2fc1 |
Subject: [PATCH] payload: don't update protocol context if we can't find a
|
|
|
4b2fc1 |
description
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1446534
|
|
|
4b2fc1 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1399764
|
|
|
4b2fc1 |
Upstream Status: nftables commit 3503738
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
commit 3503738f77cdbe521da1054a37f59ac2e442b4cf
|
|
|
4b2fc1 |
Author: Florian Westphal <fw@strlen.de>
|
|
|
4b2fc1 |
Date: Mon Jun 6 21:52:28 2016 +0200
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
payload: don't update protocol context if we can't find a description
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
Since commit
|
|
|
4b2fc1 |
20b1131c07acd2fc ("payload: fix stacked headers protocol context tracking")
|
|
|
4b2fc1 |
we deref null pointer if we can't find a description for the desired
|
|
|
4b2fc1 |
protocol, so "ip protocol 254" crashes while testing protocols 6 or 17
|
|
|
4b2fc1 |
(tcp, udp) works.
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
Also add a test case for this.
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1072
|
|
|
4b2fc1 |
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
|
4b2fc1 |
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
Signed-off-by: Timothy Redaelli <tredaelli@redhat.com>
|
|
|
4b2fc1 |
---
|
|
|
4b2fc1 |
src/payload.c | 3 +++
|
|
|
4b2fc1 |
tests/py/ip/ip.t | 3 +++
|
|
|
4b2fc1 |
tests/py/ip/ip.t.payload | 5 +++++
|
|
|
4b2fc1 |
tests/py/ip/ip.t.payload.inet | 7 +++++++
|
|
|
4b2fc1 |
tests/py/ip/ip.t.payload.netdev | 7 +++++++
|
|
|
4b2fc1 |
5 files changed, 25 insertions(+)
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
diff --git a/src/payload.c b/src/payload.c
|
|
|
4b2fc1 |
index ac0e917..9ba980a 100644
|
|
|
4b2fc1 |
--- a/src/payload.c
|
|
|
4b2fc1 |
+++ b/src/payload.c
|
|
|
4b2fc1 |
@@ -85,6 +85,9 @@ static void payload_expr_pctx_update(struct proto_ctx *ctx,
|
|
|
4b2fc1 |
base = ctx->protocol[left->payload.base].desc;
|
|
|
4b2fc1 |
desc = proto_find_upper(base, proto);
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
+ if (!desc)
|
|
|
4b2fc1 |
+ return;
|
|
|
4b2fc1 |
+
|
|
|
4b2fc1 |
assert(desc->base <= PROTO_BASE_MAX);
|
|
|
4b2fc1 |
if (desc->base == base->base) {
|
|
|
4b2fc1 |
assert(base->length > 0);
|
|
|
4b2fc1 |
diff --git a/tests/py/ip/ip.t b/tests/py/ip/ip.t
|
|
|
4b2fc1 |
index 594136c..a265b75 100644
|
|
|
4b2fc1 |
--- a/tests/py/ip/ip.t
|
|
|
4b2fc1 |
+++ b/tests/py/ip/ip.t
|
|
|
4b2fc1 |
@@ -75,6 +75,9 @@ ip protocol != tcp;ok;ip protocol != 6
|
|
|
4b2fc1 |
ip protocol { icmp, esp, ah, comp, udp, udplite, tcp, dccp, sctp} accept;ok;ip protocol { 33, 136, 17, 51, 50, 6, 132, 1, 108} accept
|
|
|
4b2fc1 |
- ip protocol != { icmp, esp, ah, comp, udp, udplite, tcp, dccp, sctp} accept;ok
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
+ip protocol 255;ok
|
|
|
4b2fc1 |
+ip protocol 256;fail
|
|
|
4b2fc1 |
+
|
|
|
4b2fc1 |
ip checksum 13172 drop;ok
|
|
|
4b2fc1 |
ip checksum 22;ok
|
|
|
4b2fc1 |
ip checksum != 233;ok
|
|
|
4b2fc1 |
diff --git a/tests/py/ip/ip.t.payload b/tests/py/ip/ip.t.payload
|
|
|
4b2fc1 |
index 9ce5527..13df804 100644
|
|
|
4b2fc1 |
--- a/tests/py/ip/ip.t.payload
|
|
|
4b2fc1 |
+++ b/tests/py/ip/ip.t.payload
|
|
|
4b2fc1 |
@@ -200,6 +200,11 @@ ip test-ip4 input
|
|
|
4b2fc1 |
[ lookup reg 1 set __set%d ]
|
|
|
4b2fc1 |
[ immediate reg 0 accept ]
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
+# ip protocol 255
|
|
|
4b2fc1 |
+ip test-ip4 input
|
|
|
4b2fc1 |
+ [ payload load 1b @ network header + 9 => reg 1 ]
|
|
|
4b2fc1 |
+ [ cmp eq reg 1 0x000000ff ]
|
|
|
4b2fc1 |
+
|
|
|
4b2fc1 |
# ip checksum 13172 drop
|
|
|
4b2fc1 |
ip test-ip4 input
|
|
|
4b2fc1 |
[ payload load 2b @ network header + 10 => reg 1 ]
|
|
|
4b2fc1 |
diff --git a/tests/py/ip/ip.t.payload.inet b/tests/py/ip/ip.t.payload.inet
|
|
|
4b2fc1 |
index cf41eb2..34fca91 100644
|
|
|
4b2fc1 |
--- a/tests/py/ip/ip.t.payload.inet
|
|
|
4b2fc1 |
+++ b/tests/py/ip/ip.t.payload.inet
|
|
|
4b2fc1 |
@@ -264,6 +264,13 @@ inet test-inet input
|
|
|
4b2fc1 |
[ lookup reg 1 set __set%d ]
|
|
|
4b2fc1 |
[ immediate reg 0 accept ]
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
+# ip protocol 255
|
|
|
4b2fc1 |
+ip test-ip4 input
|
|
|
4b2fc1 |
+ [ meta load nfproto => reg 1 ]
|
|
|
4b2fc1 |
+ [ cmp eq reg 1 0x00000002 ]
|
|
|
4b2fc1 |
+ [ payload load 1b @ network header + 9 => reg 1 ]
|
|
|
4b2fc1 |
+ [ cmp eq reg 1 0x000000ff ]
|
|
|
4b2fc1 |
+
|
|
|
4b2fc1 |
# ip checksum 13172 drop
|
|
|
4b2fc1 |
inet test-inet input
|
|
|
4b2fc1 |
[ meta load nfproto => reg 1 ]
|
|
|
4b2fc1 |
diff --git a/tests/py/ip/ip.t.payload.netdev b/tests/py/ip/ip.t.payload.netdev
|
|
|
4b2fc1 |
index ae2a74b..b61fd1e 100644
|
|
|
4b2fc1 |
--- a/tests/py/ip/ip.t.payload.netdev
|
|
|
4b2fc1 |
+++ b/tests/py/ip/ip.t.payload.netdev
|
|
|
4b2fc1 |
@@ -200,6 +200,13 @@ netdev test-netdev ingress
|
|
|
4b2fc1 |
[ lookup reg 1 set __set%d ]
|
|
|
4b2fc1 |
[ immediate reg 0 accept ]
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
+# ip protocol 255
|
|
|
4b2fc1 |
+ip test-ip4 input
|
|
|
4b2fc1 |
+ [ meta load protocol => reg 1 ]
|
|
|
4b2fc1 |
+ [ cmp eq reg 1 0x00000008 ]
|
|
|
4b2fc1 |
+ [ payload load 1b @ network header + 9 => reg 1 ]
|
|
|
4b2fc1 |
+ [ cmp eq reg 1 0x000000ff ]
|
|
|
4b2fc1 |
+
|
|
|
4b2fc1 |
# ip checksum 13172 drop
|
|
|
4b2fc1 |
netdev test-netdev ingress
|
|
|
4b2fc1 |
[ meta load protocol => reg 1 ]
|
|
|
4b2fc1 |
--
|
|
|
4b2fc1 |
1.8.3.1
|
|
|
4b2fc1 |
|