Check u32 load in u8 attributes

PATCH In review Laura Garcia Liebana 2 participants 7 messages Aug 10, 2016 – Aug 11, 2016

Subsystems (2)

Networking netfilter

lore

Share & tools

lore

Laura Garcia Liebana

author

2016-08-10 19:09 UTC #0 lore raw

cover Check u32 load in u8 attributes

The following patchset adds a check during the load of an u32 value into an u8 attribute which can cause an overflow.

Laura Garcia Liebana (5):
netfilter: nf_tables: Check u32 load in u8 nft_bitwise attribute
netfilter: nf_tables: Check u32 load in u8 nft_byteorder attribute
netfilter: nf_tables: Check u32 load in u8 nft_cmp attribute
netfilter: nf_tables: Check u32 load in u8 nft_immediate attribute
netfilter: nf_tables: Check u32 load in u8 nft_nat attribute

 net/netfilter/nft_bitwise.c   |  7 ++++++-
 net/netfilter/nft_byteorder.c | 13 +++++++++++--
 net/netfilter/nft_cmp.c       |  5 ++++-
 net/netfilter/nft_immediate.c |  3 +++
 net/netfilter/nft_nat.c       |  2 ++
 5 files changed, 26 insertions(+), 4 deletions(-)

Signature · 1 line

2.8.1

Laura Garcia Liebana

author

2016-08-10 19:19 UTC #1 lore raw

PATCH 1/5 netfilter: nf_tables: Check u32 load in u8 nft_bitwise attribute

Fix the direct assignment from u32 data input into the len attribute with a size of u8.

Signed-off-by Laura Garcia Liebana <[email protected]>

---
 net/netfilter/nft_bitwise.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

net/netfilter/nft_bitwise.c +6 -1

index d71cc18..2c49f69 100644
@@ -53,6 +53,7 @@ static int nft_bitwise_init(const struct nft_ctx *ctx,
 	struct nft_bitwise *priv = nft_expr_priv(expr);
 	struct nft_data_desc d1, d2;
 	int err;
+	u32 len;
 
 	if (tb[NFTA_BITWISE_SREG] == NULL ||
 	    tb[NFTA_BITWISE_DREG] == NULL ||

@@ -61,7 +62,11 @@ static int nft_bitwise_init(const struct nft_ctx *ctx,
 	    tb[NFTA_BITWISE_XOR] == NULL)
 		return -EINVAL;
 
-	priv->len  = ntohl(nla_get_be32(tb[NFTA_BITWISE_LEN]));
+	len  = ntohl(nla_get_be32(tb[NFTA_BITWISE_LEN]));
+	if (len > U8_MAX)
+		return -EINVAL;
+	priv->len = len;
+
 	priv->sreg = nft_parse_register(tb[NFTA_BITWISE_SREG]);
 	err = nft_validate_register_load(priv->sreg, priv->len);
 	if (err < 0)

Signature · 1 line

2.8.1

Laura Garcia Liebana

author

2016-08-10 19:32 UTC #2 lore raw

PATCH 2/5 netfilter: nf_tables: Check u32 load in u8 nft_byteorder attribute

In reply to Laura Garcia Liebana

Fix the direct assignment from u32 data input into the len and size attributes with a size of u8.

Signed-off-by Laura Garcia Liebana <[email protected]>

---
 net/netfilter/nft_byteorder.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

net/netfilter/nft_byteorder.c +11 -2

index b78c28b..fdd23d5 100644
@@ -100,6 +100,7 @@ static int nft_byteorder_init(const struct nft_ctx *ctx,
 {
 	struct nft_byteorder *priv = nft_expr_priv(expr);
 	int err;
+	u32 len, size;
 
 	if (tb[NFTA_BYTEORDER_SREG] == NULL ||
 	    tb[NFTA_BYTEORDER_DREG] == NULL ||

@@ -117,7 +118,10 @@ static int nft_byteorder_init(const struct nft_ctx *ctx,
 		return -EINVAL;
 	}
 
-	priv->size = ntohl(nla_get_be32(tb[NFTA_BYTEORDER_SIZE]));
+	size = ntohl(nla_get_be32(tb[NFTA_BYTEORDER_SIZE]));
+	if (size > U8_MAX)
+		return -EINVAL;
+	priv->size = size;
 	switch (priv->size) {
 	case 2:
 	case 4:

@@ -128,7 +132,12 @@ static int nft_byteorder_init(const struct nft_ctx *ctx,
 	}
 
 	priv->sreg = nft_parse_register(tb[NFTA_BYTEORDER_SREG]);
-	priv->len  = ntohl(nla_get_be32(tb[NFTA_BYTEORDER_LEN]));
+
+	len  = ntohl(nla_get_be32(tb[NFTA_BYTEORDER_LEN]));
+	if (len > U8_MAX)
+		return -EINVAL;
+	priv->len = len;
+
 	err = nft_validate_register_load(priv->sreg, priv->len);
 	if (err < 0)
 		return err;

Signature · 1 line

2.8.1

Laura Garcia Liebana

author

2016-08-10 19:40 UTC #3 lore raw

PATCH 3/5 netfilter: nf_tables: Check u32 load in u8 nft_cmp attribute

In reply to Laura Garcia Liebana

Fix the direct assignment from u32 data input into the len attribute with a size of u8.

Signed-off-by Laura Garcia Liebana <[email protected]>

---
 net/netfilter/nft_cmp.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

net/netfilter/nft_cmp.c +4 -1

index e25b35d..ca247e5 100644
@@ -84,8 +84,11 @@ static int nft_cmp_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
 	if (err < 0)
 		return err;
 
-	priv->op  = ntohl(nla_get_be32(tb[NFTA_CMP_OP]));
+	if (desc.len > U8_MAX)
+		return -EINVAL;
 	priv->len = desc.len;
+	priv->op  = ntohl(nla_get_be32(tb[NFTA_CMP_OP]));
+
 	return 0;
 }

Signature · 1 line

2.8.1

Laura Garcia Liebana

author

2016-08-10 19:25 UTC #4 lore raw

PATCH 4/5 netfilter: nf_tables: Check u32 load in u8 nft_immediate attribute

In reply to Laura Garcia Liebana

Fix the direct assignment from u32 data input into the dlen attribute with a size of u8.

Signed-off-by Laura Garcia Liebana <[email protected]>

---
 net/netfilter/nft_immediate.c | 3 +++
 1 file changed, 3 insertions(+)

net/netfilter/nft_immediate.c +3 -0

index db3b746..6de590c 100644
@@ -53,6 +53,9 @@ static int nft_immediate_init(const struct nft_ctx *ctx,
 			    tb[NFTA_IMMEDIATE_DATA]);
 	if (err < 0)
 		return err;
+
+	if (desc.len > U8_MAX)
+		return -EINVAL;
 	priv->dlen = desc.len;
 
 	priv->dreg = nft_parse_register(tb[NFTA_IMMEDIATE_DREG]);

Signature · 1 line

2.8.1

Laura Garcia Liebana

author

2016-08-10 19:11 UTC #5 lore raw

PATCH 5/5 netfilter: nf_tables: Check u32 load in u8 nft_nat attribute

In reply to Laura Garcia Liebana

Fix the direct assignment from u32 data input into the family attribute with a size of u8.

Signed-off-by Laura Garcia Liebana <[email protected]>

---
 net/netfilter/nft_nat.c | 2 ++
 1 file changed, 2 insertions(+)

net/netfilter/nft_nat.c +2 -0

index ee2d717..74f8293 100644
@@ -148,6 +148,8 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
 	family = ntohl(nla_get_be32(tb[NFTA_NAT_FAMILY]));
 	if (family != ctx->afi->family)
 		return -EOPNOTSUPP;
+	if (family > U8_MAX)
+		return -EINVAL;
 
 	switch (family) {
 	case NFPROTO_IPV4:

Signature · 1 line

2.8.1

Pablo Neira Ayuso

maintainer

2016-08-11 23:36 UTC #6 lore raw

In reply to Laura Garcia Liebana

Quoted 2 lines · Laura Garcia Liebana

The following patchset adds a check during the load of an u32 value into an u8 attribute which can cause an overflow.

Could you collapse them all in one single patch?

You can probably use this title:

netfilter: nf_tables: Check for overflow of u8 fields from u32 netlink attributes

And explicitly refer to 4da449ae1df in the description to link it to this one.

Thanks.