Skip to contentSkip to conversation

: Netfilter fixes

PATCH In review Patrick McHardy 2 participants 5 messages Nov 29, 2007 – Nov 30, 2007

Subsystems (4)
Networking Library code netfilter Labeled networking (NetLabel)
lore
Share & tools
lore

Patrick McHardy

author
#0 lore raw

cover : Netfilter fixes

Hi Herbert,

these patches for 2.6.24 fix a number of netfilter bugs: a refcount leak in a CONNMARK and CONNSECMARK error path, a network triggerable WARN_ON in the IPv6 TCPMSS target and an endless loop caused by passing a zero-length pattern to the string match.

Please apply, thanks.

 lib/textsearch.c               |    8 ++++++--
 net/netfilter/xt_CONNMARK.c    |   10 +++++-----
 net/netfilter/xt_CONNSECMARK.c |   10 +++++-----
 net/netfilter/xt_TCPMSS.c      |    4 +---
 4 files changed, 17 insertions(+), 15 deletions(-)

Jan Engelhardt (1):
[NETFILTER]: fix forgotten module release in xt_CONNMARK and xt_CONNSECMARK

Pablo Neira Ayuso (1):
[TEXTSEARCH]: Do not allow zero length patterns in the textsearch infrastructure

Patrick McHardy (1):
[NETFILTER]: xt_TCPMSS: remove network triggerable WARN_ON

author
#1 lore raw

PATCH 1/3 : xt_TCPMSS: remove network triggerable WARN_ON

[NETFILTER]: xt_TCPMSS: remove network triggerable WARN_ON

ipv6_skip_exthdr() returns -1 for invalid packets. don't WARN_ON that.

Signed-off-by Patrick McHardy <[email protected]>

---
commit 6d3d8a9e26a4322f7f6f2601742f7a669585f338
tree 742b7f78ffcb24a6400a95db1dca419228b3e23e
parent 09f345da758fca1222b0971b65b2fddbdf78bb83
author Patrick McHardy <[email protected]> Thu, 29 Nov 2007 09:04:39 +0100 committer Patrick McHardy <[email protected]> Thu, 29 Nov 2007 09:04:39 +0100

 net/netfilter/xt_TCPMSS.c |    4 +---
 1 files changed, 1 insertions(+), 3 deletions(-)
net/netfilter/xt_TCPMSS.c +1 -3
index 07435a6..8e76d1f 100644
@@ -174,10 +174,8 @@ xt_tcpmss_target6(struct sk_buff *skb,
 
 	nexthdr = ipv6h->nexthdr;
 	tcphoff = ipv6_skip_exthdr(skb, sizeof(*ipv6h), &nexthdr);
-	if (tcphoff < 0) {
-		WARN_ON(1);
+	if (tcphoff < 0)
 		return NF_DROP;
-	}
 	ret = tcpmss_mangle_packet(skb, targinfo, tcphoff,
 				   sizeof(*ipv6h) + sizeof(struct tcphdr));
 	if (ret < 0)
author
#2 lore raw

PATCH 2/3 : fix forgotten module release in xt_CONNMARK and xt_CONNSECMARK

In reply to Patrick McHardy

[NETFILTER]: fix forgotten module release in xt_CONNMARK and xt_CONNSECMARK

Fix forgotten module release in xt_CONNMARK and xt_CONNSECMARK

When xt_CONNMARK is used outside the mangle table and the user specified "--restore-mark", the connmark_tg_check() function will (correctly) error out, but (incorrectly) forgets to release the L3 conntrack module. Same for xt_CONNSECMARK.

Fix is to move the call to acquire the L3 module after the basic constraint checks.

Signed-off-by Jan Engelhardt <[email protected]>
Signed-off-by Patrick McHardy <[email protected]>

---
commit 7f6c4730c53415caee7cb0ed4c1adad48de3bb07
tree 0a05c965d3e4a9a01586045991626c23b14fedca
parent 6d3d8a9e26a4322f7f6f2601742f7a669585f338
author Jan Engelhardt <[email protected]> Thu, 29 Nov 2007 23:18:23 +0100 committer Patrick McHardy <[email protected]> Thu, 29 Nov 2007 23:27:40 +0100

 net/netfilter/xt_CONNMARK.c    |   10 +++++-----
 net/netfilter/xt_CONNSECMARK.c |   10 +++++-----
 2 files changed, 10 insertions(+), 10 deletions(-)
net/netfilter/xt_CONNMARK.c +5 -5
index 856793e..0621ca7 100644
@@ -86,11 +86,6 @@ checkentry(const char *tablename,
 {
 	const struct xt_connmark_target_info *matchinfo = targinfo;
 
-	if (nf_ct_l3proto_try_module_get(target->family) < 0) {
-		printk(KERN_WARNING "can't load conntrack support for "
-				    "proto=%d\n", target->family);
-		return false;
-	}
 	if (matchinfo->mode == XT_CONNMARK_RESTORE) {
 		if (strcmp(tablename, "mangle") != 0) {
 			printk(KERN_WARNING "CONNMARK: restore can only be "

@@ -103,6 +98,11 @@ checkentry(const char *tablename,
 		printk(KERN_WARNING "CONNMARK: Only supports 32bit mark\n");
 		return false;
 	}
+	if (nf_ct_l3proto_try_module_get(target->family) < 0) {
+		printk(KERN_WARNING "can't load conntrack support for "
+				    "proto=%d\n", target->family);
+		return false;
+	}
 	return true;
 }
net/netfilter/xt_CONNSECMARK.c +5 -5
index 021b5c8..d8feba9 100644
@@ -90,11 +90,6 @@ static bool checkentry(const char *tablename, const void *entry,
 {
 	const struct xt_connsecmark_target_info *info = targinfo;
 
-	if (nf_ct_l3proto_try_module_get(target->family) < 0) {
-		printk(KERN_WARNING "can't load conntrack support for "
-				    "proto=%d\n", target->family);
-		return false;
-	}
 	switch (info->mode) {
 	case CONNSECMARK_SAVE:
 	case CONNSECMARK_RESTORE:

@@ -105,6 +100,11 @@ static bool checkentry(const char *tablename, const void *entry,
 		return false;
 	}
 
+	if (nf_ct_l3proto_try_module_get(target->family) < 0) {
+		printk(KERN_WARNING "can't load conntrack support for "
+				    "proto=%d\n", target->family);
+		return false;
+	}
 	return true;
 }
author
#3 lore raw

PATCH 3/3 : Do not allow zero length patterns in the textsearch infrastructure

In reply to Patrick McHardy

[TEXTSEARCH]: Do not allow zero length patterns in the textsearch infrastructure

If a zero length pattern is passed then return EINVAL. Avoids infinite loops (bm) or invalid memory accesses (kmp).

Signed-off-by Pablo Neira Ayuso <[email protected]>
Signed-off-by Patrick McHardy <[email protected]>

---
commit d3161d25f17eca4f57ea85485f453a6209d0c919
tree d1ea696ac2fc68cd79d43975e5d56940c04a2342
parent 7f6c4730c53415caee7cb0ed4c1adad48de3bb07
author Pablo Neira Ayuso <[email protected]> Fri, 30 Nov 2007 00:54:50 +0100 committer Patrick McHardy <[email protected]> Fri, 30 Nov 2007 00:54:50 +0100

 lib/textsearch.c |    8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)
lib/textsearch.c +6 -2
index 88c98a2..be8bda3 100644
@@ -7,7 +7,7 @@
  *		2 of the License, or (at your option) any later version.
  *
  * Authors:	Thomas Graf <[email protected]>
- * 		Pablo Neira Ayuso <[email protected]>
+ * 		Pablo Neira Ayuso <[email protected]>
  *
  * ==========================================================================
  *

@@ -250,7 +250,8 @@ unsigned int textsearch_find_continuous(struct ts_config *conf,
  *       the various search algorithms.
  *
  * Returns a new textsearch configuration according to the specified
- *         parameters or a ERR_PTR().
+ * parameters or a ERR_PTR(). If a zero length pattern is passed, this
+ * function returns EINVAL.
  */
 struct ts_config *textsearch_prepare(const char *algo, const void *pattern,
 				     unsigned int len, gfp_t gfp_mask, int flags)

@@ -259,6 +260,9 @@ struct ts_config *textsearch_prepare(const char *algo, const void *pattern,
 	struct ts_config *conf;
 	struct ts_ops *ops;
 	
+	if (len == 0)
+		return ERR_PTR(-EINVAL);
+
 	ops = lookup_ts_algo(algo);
 #ifdef CONFIG_KMOD
 	/*
#4 lore raw
In reply to Patrick McHardy
Quoted 7 lines · Patrick McHardy

these patches for 2.6.24 fix a number of netfilter bugs: a refcount leak in a CONNMARK and CONNSECMARK error path, a network triggerable WARN_ON in the IPv6 TCPMSS target and an endless loop caused by passing a zero-length pattern to the string match.

Please apply, thanks.

All applied. Thanks a lot Patrick.

Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt