Skip to contentSkip to conversation

Fix ipt_ACCOUNT for large networks

PATCH In review Thomas Jarosch 2 participants 2 messages Apr 4, 2005 netfilter

lore
Share & tools
lore

Thomas Jarosch

author
#0 lore raw

PATCH 1/1 Fix ipt_ACCOUNT for large networks

Hi Patrick,

attached is a small patch to fix the ACCOUNT target for large networks. The bug was introduced when the code was more modularized.

Kudos go to Peter Surda for finding the bug.

Cheers,
Thomas

Signed-off-by Thomas Jarosch <[email protected]>
linux/net/ipv4/netfilter/ipt_ACCOUNT.c 2005-04-04 10:36:57.802104874 +0200 renamed from linux/net/ipv4/netfilter/ipt_ACCOUNT.c 2005-04-04 10:36:22.000000000 +0200 +1 -1
diff -u -r -p ipt_ACCOUNT/linux/net/ipv4/netfilter/ipt_ACCOUNT.c ipt_ACCOUNT.fixed/linux/net/ipv4/netfilter/ipt_ACCOUNT.c
@@ -714,9 +714,9 @@ int ipt_acc_handle_copy_data(void *to_us
 
             /* Temporary buffer full? Flush to userspace */
             if (*pos+handle_ip_size >= PAGE_SIZE) {
-                *pos = 0;
                 if (copy_to_user(to_user, ipt_acc_tmpbuf, *pos))
                     return -EFAULT;
+                *pos = 0;
             }
             memcpy(ipt_acc_tmpbuf+*pos, &handle_ip, handle_ip_size);
             *pos += handle_ip_size;
#1 lore raw
Quoted 2 lines · Thomas Jarosch

attached is a small patch to fix the ACCOUNT target for large networks. The bug was introduced when the code was more modularized.

Please don't apply yet, this doesn't fix everything, you have to increment to_user too. I'm working on a version that does this, stay tuned.

linux/net/ipv4/netfilter/ipt_ACCOUNT.c 2005-04-04 10:36:57.802104874 +0200 int ipt_acc_handle_copy_data(void *to_us · line 718

Quoted 10 lines

diff -u -r -p ipt_ACCOUNT/linux/net/ipv4/netfilter/ipt_ACCOUNT.c ipt_ACCOUNT.fixed/linux/net/ipv4/netfilter/ipt_ACCOUNT.c

linux/net/ipv4/netfilter/ipt_ACCOUNT.c 2005-04-04 10:36:57.802104874 +0200 renamed from linux/net/ipv4/netfilter/ipt_ACCOUNT.c 2005-04-04 10:36:22.000000000 +0200 +0 -1
@@ -714,9 +714,9 @@ int ipt_acc_handle_copy_data(void *to_us
 
             /* Temporary buffer full? Flush to userspace */
             if (*pos+handle_ip_size >= PAGE_SIZE) {
-                *pos = 0;
                 if (copy_to_user(to_user, ipt_acc_tmpbuf, *pos))
                     return -EFAULT;

here it should do something like
to_user += *p;
except you probably have to cast it etc.

linux/net/ipv4/netfilter/ipt_ACCOUNT.c 2005-04-04 10:36:57.802104874 +0200 int ipt_acc_handle_copy_data(void *to_us · line 722

Quoted 4 lines
linux/net/ipv4/netfilter/ipt_ACCOUNT.c 2005-04-04 10:36:57.802104874 +0200 renamed from linux/net/ipv4/netfilter/ipt_ACCOUNT.c 2005-04-04 10:36:22.000000000 +0200 +1 -0
+                *pos = 0;
             }
             memcpy(ipt_acc_tmpbuf+*pos, &handle_ip, handle_ip_size);
             *pos += handle_ip_size;

Bye,

Peter Surda (Shurdeek) <[email protected]>, ICQ 10236103, +436505122023

Signature · 2 lines
Microsoft and Apple make the easy things very easy and the hard things impossible.
*BSD and Linux make the easy things challenging and the hard things difficult but possible.