From: Pablo Neira Ayuso <pablo@netfilter•org>
To: netfilter-devel@vger•kernel.org
Cc: davem@davemloft•net, netdev@vger•kernel.org
Subject: [PATCH 08/30] netfilter: x_tables: check error target size too
Date: Mon, 12 Mar 2018 18:58:58 +0100 [thread overview]
Message-ID: <20180312175920.9022-9-pablo@netfilter.org> (raw)
In-Reply-To: <20180312175920.9022-1-pablo@netfilter.org>
From: Florian Westphal <fw@strlen•de>
Check that userspace ERROR target (custom user-defined chains) match
expected format, and the chain name is null terminated.
This is irrelevant for kernel, but iptables itself relies on sane input
when it dumps rules from kernel.
Signed-off-by: Florian Westphal <fw@strlen•de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter•org>
---
net/netfilter/x_tables.c | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 2e4d423e58e6..f045bb4f7063 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -654,6 +654,11 @@ struct compat_xt_standard_target {
compat_uint_t verdict;
};
+struct compat_xt_error_target {
+ struct compat_xt_entry_target t;
+ char errorname[XT_FUNCTION_MAXNAMELEN];
+};
+
static bool verdict_ok(int verdict)
{
if (verdict > 0)
@@ -679,6 +684,12 @@ static bool verdict_ok(int verdict)
return false;
}
+static bool error_tg_ok(unsigned int usersize, unsigned int kernsize,
+ const char *msg, unsigned int msglen)
+{
+ return usersize == kernsize && strnlen(msg, msglen) < msglen;
+}
+
int xt_compat_check_entry_offsets(const void *base, const char *elems,
unsigned int target_offset,
unsigned int next_offset)
@@ -708,6 +719,12 @@ int xt_compat_check_entry_offsets(const void *base, const char *elems,
if (!verdict_ok(st->verdict))
return -EINVAL;
+ } else if (strcmp(t->u.user.name, XT_ERROR_TARGET) == 0) {
+ const struct compat_xt_error_target *et = (const void *)t;
+
+ if (!error_tg_ok(t->u.target_size, sizeof(*et),
+ et->errorname, sizeof(et->errorname)))
+ return -EINVAL;
}
/* compat_xt_entry match has less strict alignment requirements,
@@ -796,6 +813,12 @@ int xt_check_entry_offsets(const void *base,
if (!verdict_ok(st->verdict))
return -EINVAL;
+ } else if (strcmp(t->u.user.name, XT_ERROR_TARGET) == 0) {
+ const struct xt_error_target *et = (const void *)t;
+
+ if (!error_tg_ok(t->u.target_size, sizeof(*et),
+ et->errorname, sizeof(et->errorname)))
+ return -EINVAL;
}
return xt_check_entry_match(elems, base + target_offset,
--
2.11.0
next prev parent reply other threads:[~2018-03-12 17:59 UTC|newest]
Thread overview: 42+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-12 17:58 [PATCH 00/30] Netfilter/IPVS updates for net-next Pablo Neira Ayuso
2018-03-12 17:58 ` [PATCH 01/30] netfilter: nf_tables: nf_tables_obj_lookup_byhandle() can be static Pablo Neira Ayuso
2018-03-12 17:58 ` [PATCH 02/30] netfilter: nfnetlink_acct: remove useless parameter Pablo Neira Ayuso
2018-03-12 17:58 ` [PATCH 03/30] netfilter: xt_cluster: get rid of xt_cluster_ipv6_is_multicast Pablo Neira Ayuso
2018-03-12 17:58 ` [PATCH 04/30] netfilter: nf_conntrack_broadcast: remove useless parameter Pablo Neira Ayuso
2018-03-12 17:58 ` [PATCH 05/30] netfilter: ipt_ah: return boolean instead of integer Pablo Neira Ayuso
2018-03-12 17:58 ` [PATCH 06/30] netfilter: unlock xt_table earlier in __do_replace Pablo Neira Ayuso
2018-03-12 17:58 ` [PATCH 07/30] netfilter: x_tables: check standard verdicts in core Pablo Neira Ayuso
2018-03-12 17:58 ` Pablo Neira Ayuso [this message]
2018-03-12 17:58 ` [PATCH 09/30] netfilter: x_tables: move hook entry checks into core Pablo Neira Ayuso
2018-03-12 17:59 ` [PATCH 10/30] netfilter: x_tables: enforce unique and ascending entry points Pablo Neira Ayuso
2018-03-12 17:59 ` [PATCH 11/30] netfilter: x_tables: cap allocations at 512 mbyte Pablo Neira Ayuso
2018-03-12 17:59 ` [PATCH 12/30] netfilter: x_tables: limit allocation requests for blob rule heads Pablo Neira Ayuso
2018-03-12 17:59 ` [PATCH 13/30] netfilter: x_tables: add counters allocation wrapper Pablo Neira Ayuso
2018-03-12 17:59 ` [PATCH 14/30] netfilter: compat: prepare xt_compat_init_offsets to return errors Pablo Neira Ayuso
2018-03-12 17:59 ` [PATCH 15/30] netfilter: compat: reject huge allocation requests Pablo Neira Ayuso
2018-03-12 17:59 ` [PATCH 16/30] netfilter: x_tables: make sure compat af mutex is held Pablo Neira Ayuso
2018-03-12 17:59 ` [PATCH 17/30] netfilter: x_tables: ensure last rule in base chain matches underflow/policy Pablo Neira Ayuso
2018-03-12 17:59 ` [PATCH 18/30] netfilter: make xt_rateest hash table per net Pablo Neira Ayuso
2018-03-12 17:59 ` [PATCH 19/30] netfilter: xt_limit: Spelling s/maxmum/maximum/ Pablo Neira Ayuso
2018-03-12 17:59 ` [PATCH 20/30] netfilter: nf_flow_table: use IP_CT_DIR_* values for FLOW_OFFLOAD_DIR_* Pablo Neira Ayuso
2018-03-12 17:59 ` [PATCH 21/30] netfilter: nf_flow_table: clean up flow_offload_alloc Pablo Neira Ayuso
2018-03-12 17:59 ` [PATCH 22/30] ipv6: make ip6_dst_mtu_forward inline Pablo Neira Ayuso
2018-03-12 17:59 ` [PATCH 23/30] netfilter: nf_flow_table: cache mtu in struct flow_offload_tuple Pablo Neira Ayuso
2018-03-12 17:59 ` [PATCH 24/30] netfilter: nf_flow_table: rename nf_flow_table.c to nf_flow_table_core.c Pablo Neira Ayuso
2018-03-12 17:59 ` [PATCH 25/30] netfilter: x_tables: fix build with CONFIG_COMPAT=n Pablo Neira Ayuso
2018-03-12 17:59 ` [PATCH 26/30] ipvs: use true and false for boolean values Pablo Neira Ayuso
2018-03-12 17:59 ` [PATCH 27/30] netfilter: nf_tables: handle rt0 and rt2 properly Pablo Neira Ayuso
2018-03-12 17:59 ` [PATCH 28/30] netfilter: Refactor nf_conncount Pablo Neira Ayuso
2018-03-12 17:59 ` [PATCH 29/30] netfilter: conncount: Support count only use case Pablo Neira Ayuso
2018-03-12 17:59 ` [PATCH 30/30] netfilter: nft_ct: add NFT_CT_{SRC,DST}_{IP,IP6} Pablo Neira Ayuso
2018-03-12 18:58 ` [PATCH 00/30] Netfilter/IPVS updates for net-next David Miller
2018-03-12 19:30 ` Felix Fietkau
2018-03-12 20:01 ` David Miller
2018-03-12 20:22 ` Felix Fietkau
2018-03-13 13:41 ` Florian Westphal
2018-03-13 15:34 ` David Miller
2018-03-13 15:39 ` Florian Westphal
2018-03-14 18:38 ` Pablo Neira Ayuso
2018-03-16 16:23 ` David Miller
2018-03-16 16:39 ` Guy Shattah
2018-03-16 16:41 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180312175920.9022-9-pablo@netfilter.org \
--to=pablo@netfilter$(echo .)org \
--cc=davem@davemloft$(echo .)net \
--cc=netdev@vger$(echo .)kernel.org \
--cc=netfilter-devel@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox