Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1733594

[PATCH for 4.9 33/39] netfilter: nf_tables: set pktinfo->thoff at AH header if found

Show all headers | View raw

From: Pablo Neira Ayuso <pablo@netfilter.org>

[ Upstream commit 568af6de058cb2b0c5b98d98ffcf37cdc6bc38a7 ]

Phil Sutter reports that IPv6 AH header matching is broken. From
userspace, nft generates bytecode that expects to find the AH header at
NFT_PAYLOAD_TRANSPORT_HEADER both for IPv4 and IPv6. However,
pktinfo->thoff is set to the inner header after the AH header in IPv6,
while in IPv4 pktinfo->thoff points to the AH header indeed. This
behaviour is inconsistent. This patch fixes this problem by updating
ipv6_find_hdr() to get the IP6_FH_F_AUTH flag so this function stops at
the AH header, so both IPv4 and IPv6 pktinfo->thoff point to the AH
header.

This is also inconsistent when trying to match encapsulated headers:

1) A packet that looks like IPv4 + AH + TCP dport 22 will *not* match.
2) A packet that looks like IPv6 + AH + TCP dport 22 will match.

Reported-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 include/net/netfilter/nf_tables_ipv6.h | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/include/net/netfilter/nf_tables_ipv6.h b/include/net/netfilter/nf_tables_ipv6.h
index d150b5066201..97983d1c05e4 100644
--- a/include/net/netfilter/nf_tables_ipv6.h
+++ b/include/net/netfilter/nf_tables_ipv6.h
@@ -9,12 +9,13 @@ nft_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
 		     struct sk_buff *skb,
 		     const struct nf_hook_state *state)
 {
+	unsigned int flags = IP6_FH_F_AUTH;
 	int protohdr, thoff = 0;
 	unsigned short frag_off;
 
 	nft_set_pktinfo(pkt, skb, state);
 
-	protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, NULL);
+	protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, &flags);
 	if (protohdr < 0) {
 		nft_set_pktinfo_proto_unspec(pkt, skb);
 		return;
@@ -32,6 +33,7 @@ __nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt,
 				const struct nf_hook_state *state)
 {
 #if IS_ENABLED(CONFIG_IPV6)
+	unsigned int flags = IP6_FH_F_AUTH;
 	struct ipv6hdr *ip6h, _ip6h;
 	unsigned int thoff = 0;
 	unsigned short frag_off;
@@ -50,7 +52,7 @@ __nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt,
 	if (pkt_len + sizeof(*ip6h) > skb->len)
 		return -1;
 
-	protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, NULL);
+	protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, &flags);
 	if (protohdr < 0)
 		return -1;
 
-- 
2.11.0

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH for 4.9 18/39] iommu/exynos: Block SYSMMU while invalidating  FLPD cache "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200
  [PATCH for 4.9 27/39] x86/acpi: Restore the order of CPU IDs "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200
  [PATCH for 4.9 22/39] netfilter: nfnl_cthelper: fix incorrect  helper->expect_class_max "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200
  [PATCH for 4.9 35/39] xfs: remove kmem_zalloc_greedy "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200
  [PATCH for 4.9 31/39] rds: ib: add error handle "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200
  [PATCH for 4.9 24/39] nfs: make nfs4_cb_sv_ops static "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200
  [PATCH for 4.9 32/39] md/raid10: submit bio directly to replacement  disk "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200
  [PATCH for 4.9 38/39] ARM: dts: BCM5301X: Fix memory start address "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200
  [PATCH for 4.9 29/39] arm64: kasan: avoid bad virt_to_pfn() "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200
  [PATCH for 4.9 39/39] tools/power turbostat: bugfix: GFXMHz column  not changing "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200
  [PATCH for 4.9 20/39] MIPS: smp-cps: Fix retrieval of VPE mask on big  endian CPUs "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200
  [PATCH for 4.9 28/39] iommu/io-pgtable-arm: Check for leaf entry  before dereferencing it "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200
  [PATCH for 4.9 23/39] parisc: perf: Fix potential NULL pointer  dereference "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200
  [PATCH for 4.9 34/39] i2c: meson: fix wrong variable usage in  meson_i2c_put_data "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200
  [PATCH for 4.9 36/39] ASoC: wm_adsp: Return an error on write to a  disabled volatile control "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200
  [PATCH for 4.9 25/39] ibmvnic: Free tx/rx scrq pointer array when  releasing sub-crqs "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200
  [PATCH for 4.9 33/39] netfilter: nf_tables: set pktinfo->thoff at AH  header if found "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200
  [PATCH for 4.9 37/39] libata: transport: Remove circular dependency  at free time "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200

csiph-web