Skip to contentSkip to conversation

netfilter: default to NF_DROP in sip_help_tcp()

PATCH In review Simon Horman 2 participants 6 messages Jul 10, 2010 – Aug 5, 2010

Subsystems (3)
Networking Network drivers netfilter
lore
Share & tools
lore

Simon Horman

author
#0 lore raw

PATCH 1/1 netfilter: default to NF_DROP in sip_help_tcp()

I initially noticed this because of the compiler warning below, but it does seem to be a valid concern in the case where ct_sip_get_header() returns 0 in the first iteration of the while loop.

net/netfilter/nf_conntrack_sip.c: In function 'sip_help_tcp':
net/netfilter/nf_conntrack_sip.c:1379: warning: 'ret' may be used uninitialized in this function

Signed-off-by Simon Horman <[email protected]>
net/netfilter/nf_conntrack_sip.c +1 -1
Index: nf-next-2.6/net/netfilter/nf_conntrack_sip.c
===================================================================
@@ -1376,7 +1376,7 @@ static int sip_help_tcp(struct sk_buff *
 	unsigned int msglen, origlen;
 	const char *dptr, *end;
 	s16 diff, tdiff = 0;
-	int ret;
+	int ret = NF_DROP;
 	typeof(nf_nat_sip_seq_adjust_hook) nf_nat_sip_seq_adjust;
 
 	if (ctinfo != IP_CT_ESTABLISHED &&
#1 lore raw
Quoted 6 lines · Simon Horman

I initially noticed this because of the compiler warning below, but it does seem to be a valid concern in the case where ct_sip_get_header() returns 0 in the first iteration of the while loop.

net/netfilter/nf_conntrack_sip.c: In function 'sip_help_tcp':
net/netfilter/nf_conntrack_sip.c:1379: warning: 'ret' may be used uninitialized in this function

Thanks Simon. I've applied the patch, but changed NF_DROP to NF_ACCEPT since we should avoid dropping packets with unknown contents (not SIP) if possible.

author
#2 lore raw
Quoted 11 lines · Patrick McHardy
Quoted 6 lines · Simon Horman

I initially noticed this because of the compiler warning below, but it does seem to be a valid concern in the case where ct_sip_get_header() returns 0 in the first iteration of the while loop.

net/netfilter/nf_conntrack_sip.c: In function 'sip_help_tcp':
net/netfilter/nf_conntrack_sip.c:1379: warning: 'ret' may be used uninitialized in this function

Thanks Simon. I've applied the patch, but changed NF_DROP to NF_ACCEPT since we should avoid dropping packets with unknown contents (not SIP) if possible.

Thanks, to be honest I was a bit unsure of what policy was best.

author
#3 lore raw
In reply to Patrick McHardy
Quoted 11 lines · Patrick McHardy
Quoted 6 lines · Simon Horman

I initially noticed this because of the compiler warning below, but it does seem to be a valid concern in the case where ct_sip_get_header() returns 0 in the first iteration of the while loop.

net/netfilter/nf_conntrack_sip.c: In function 'sip_help_tcp':
net/netfilter/nf_conntrack_sip.c:1379: warning: 'ret' may be used uninitialized in this function

Thanks Simon. I've applied the patch, but changed NF_DROP to NF_ACCEPT since we should avoid dropping packets with unknown contents (not SIP) if possible.

Hi Patrick,

I'm not seeing this patch in nf-next-2.6.
Am I looking in the wrong place?

#4 lore raw

Am 04.08.2010 10:07, schrieb Simon Horman:

Quoted 9 lines · Patrick McHardy
Quoted 8 lines · Simon Horman
Quoted 6 lines

I initially noticed this because of the compiler warning below, but it does seem to be a valid concern in the case where ct_sip_get_header() returns 0 in the first iteration of the while loop.

net/netfilter/nf_conntrack_sip.c: In function 'sip_help_tcp':
net/netfilter/nf_conntrack_sip.c:1379: warning: 'ret' may be used uninitialized in this function

Quoted 8 lines
Quoted 3 lines

Thanks Simon. I've applied the patch, but changed NF_DROP to NF_ACCEPT since we should avoid dropping packets with unknown contents (not SIP) if possible.

Hi Patrick,

I'm not seeing this patch in nf-next-2.6.
Am I looking in the wrong place?

I was struggling with some file system corruption and didn't manage to send it out in time, sorry. I'll include it in the next batch of patches for .36 and will also push it to -stable.

author
#5 lore raw
Quoted 14 lines · Patrick McHardy

Am 04.08.2010 10:07, schrieb Simon Horman:

Quoted 13 lines · Patrick McHardy
Quoted 11 lines · Simon Horman
Quoted 6 lines

I initially noticed this because of the compiler warning below, but it does seem to be a valid concern in the case where ct_sip_get_header() returns 0 in the first iteration of the while loop.

net/netfilter/nf_conntrack_sip.c: In function 'sip_help_tcp':
net/netfilter/nf_conntrack_sip.c:1379: warning: 'ret' may be used uninitialized in this function

Thanks Simon. I've applied the patch, but changed NF_DROP to NF_ACCEPT since we should avoid dropping packets with unknown contents (not SIP) if possible.

Quoted 8 lines
Quoted 4 lines

Hi Patrick,

I'm not seeing this patch in nf-next-2.6.
Am I looking in the wrong place?

I was struggling with some file system corruption and didn't manage to send it out in time, sorry. I'll include it in the next batch of patches for .36 and will also push it to -stable.

Thanks, I'm happy so long as it makes it eventually.