diff options
| author | Phil Sutter <phil@nwl.cc> | 2021-06-11 20:06:45 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-10-10 22:53:34 +0300 |
| commit | e18216cd0ec7fef9bb87cf8b4124bc1212e5add1 (patch) | |
| tree | 0d53a4d87e6abdeef44ba49a80da93f808d0c7a1 /net | |
| parent | 152b8ac839c97ab1c26669869a9ca400e05807dc (diff) | |
| download | linux-e18216cd0ec7fef9bb87cf8b4124bc1212e5add1.tar.xz | |
netfilter: nft_exthdr: Search chunks in SCTP packets only
[ Upstream commit 5acc44f39458f43dac9724cefa4da29847cfe997 ]
Since user space does not generate a payload dependency, plain sctp
chunk matches cause searching in non-SCTP packets, too. Avoid this
potential mis-interpretation of packet data by checking pkt->tprot.
Fixes: 133dc203d77df ("netfilter: nft_exthdr: Support SCTP chunks")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/nft_exthdr.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c index b4682aeabab9..274c5f008518 100644 --- a/net/netfilter/nft_exthdr.c +++ b/net/netfilter/nft_exthdr.c @@ -371,6 +371,9 @@ static void nft_exthdr_sctp_eval(const struct nft_expr *expr, const struct sctp_chunkhdr *sch; struct sctp_chunkhdr _sch; + if (pkt->tprot != IPPROTO_SCTP) + goto err; + do { sch = skb_header_pointer(pkt->skb, offset, sizeof(_sch), &_sch); if (!sch || !sch->length) @@ -391,7 +394,7 @@ static void nft_exthdr_sctp_eval(const struct nft_expr *expr, } offset += SCTP_PAD4(ntohs(sch->length)); } while (offset < pkt->skb->len); - +err: if (priv->flags & NFT_EXTHDR_F_PRESENT) nft_reg_store8(dest, false); else |