Skip to content

Commit df2a601

Browse files
davem330davem330
committed
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Florian Westhal says: ==================== netfilter: bugfixes for net The following set contains four netfilter patches for your *net* tree. When there are multiple Contact headers in a SIP message its possible the next headers won't be found because the SIP helper confuses relative and absolute offsets in the message. From Igor Ryzhov. Make the nft_concat_range self-test support socat, this makes the selftest pass on my test VM, from myself. nf_conntrack_irc helper can be tricked into opening a local port forward that the client never requested by embedding a DCC message in a PING request sent to the client. Fix from David Leadbeater. Both have been broken since the kernel 2.6.x days. The 'osf' match might indicate success while it could not find anything, broken since 5.2 . Fix from Pablo Neira. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2 parents 26b1224 + 559c36c commit df2a601

File tree

4 files changed

+86
-21
lines changed

4 files changed

+86
-21
lines changed

‎net/netfilter/nf_conntrack_irc.c

Lines changed: 28 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -157,15 +157,37 @@ static int help(struct sk_buff *skb, unsigned int protoff,
157157
data = ib_ptr;
158158
data_limit = ib_ptr + datalen;
159159

160-
/* strlen("\1DCC SENT t AAAAAAAA P\1\n")=24
161-
* 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */
162-
while (data < data_limit - (19 + MINMATCHLEN)) {
163-
if (memcmp(data, "\1DCC ", 5)) {
160+
/* Skip any whitespace */
161+
while (data < data_limit - 10) {
162+
if (*data == ' ' || *data == '\r' || *data == '\n')
163+
data++;
164+
else
165+
break;
166+
}
167+
168+
/* strlen("PRIVMSG x ")=10 */
169+
if (data < data_limit - 10) {
170+
if (strncasecmp("PRIVMSG ", data, 8))
171+
goto out;
172+
data += 8;
173+
}
174+
175+
/* strlen(" :\1DCC SENT t AAAAAAAA P\1\n")=26
176+
* 7+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=26
177+
*/
178+
while (data < data_limit - (21 + MINMATCHLEN)) {
179+
/* Find first " :", the start of message */
180+
if (memcmp(data, " :", 2)) {
164181
data++;
165182
continue;
166183
}
184+
data += 2;
185+
186+
/* then check that place only for the DCC command */
187+
if (memcmp(data, "\1DCC ", 5))
188+
goto out;
167189
data += 5;
168-
/* we have at least (19+MINMATCHLEN)-5 bytes valid data left */
190+
/* we have at least (21+MINMATCHLEN)-(2+5) bytes valid data left */
169191

170192
iph = ip_hdr(skb);
171193
pr_debug("DCC found in master %pI4:%u %pI4:%u\n",
@@ -181,7 +203,7 @@ static int help(struct sk_buff *skb, unsigned int protoff,
181203
pr_debug("DCC %s detected\n", dccprotos[i]);
182204

183205
/* we have at least
184-
* (19+MINMATCHLEN)-5-dccprotos[i].matchlen bytes valid
206+
* (21+MINMATCHLEN)-7-dccprotos[i].matchlen bytes valid
185207
* data left (== 14/13 bytes) */
186208
if (parse_dcc(data, data_limit, &dcc_ip,
187209
&dcc_port, &addr_beg_p, &addr_end_p)) {

‎net/netfilter/nf_conntrack_sip.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -477,7 +477,7 @@ static int ct_sip_walk_headers(const struct nf_conn *ct, const char *dptr,
477477
return ret;
478478
if (ret == 0)
479479
break;
480-
dataoff += *matchoff;
480+
dataoff = *matchoff;
481481
}
482482
*in_header = 0;
483483
}
@@ -489,7 +489,7 @@ static int ct_sip_walk_headers(const struct nf_conn *ct, const char *dptr,
489489
break;
490490
if (ret == 0)
491491
return ret;
492-
dataoff += *matchoff;
492+
dataoff = *matchoff;
493493
}
494494

495495
if (in_header)

‎net/netfilter/nfnetlink_osf.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -269,6 +269,7 @@ bool nf_osf_find(const struct sk_buff *skb,
269269
struct nf_osf_hdr_ctx ctx;
270270
const struct tcphdr *tcp;
271271
struct tcphdr _tcph;
272+
bool found = false;
272273

273274
memset(&ctx, 0, sizeof(ctx));
274275

@@ -283,10 +284,11 @@ bool nf_osf_find(const struct sk_buff *skb,
283284

284285
data->genre = f->genre;
285286
data->version = f->version;
287+
found = true;
286288
break;
287289
}
288290

289-
return true;
291+
return found;
290292
}
291293
EXPORT_SYMBOL_GPL(nf_osf_find);
292294

‎tools/testing/selftests/netfilter/nft_concat_range.sh

Lines changed: 53 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ src
9191
start 1
9292
count 5
9393
src_delta 2000
94-
tools sendip nc bash
94+
tools sendip socat nc bash
9595
proto udp
9696
9797
race_repeat 3
@@ -116,7 +116,7 @@ src
116116
start 10
117117
count 5
118118
src_delta 2000
119-
tools sendip nc bash
119+
tools sendip socat nc bash
120120
proto udp6
121121
122122
race_repeat 3
@@ -141,7 +141,7 @@ src
141141
start 1
142142
count 5
143143
src_delta 2000
144-
tools sendip nc bash
144+
tools sendip socat nc bash
145145
proto udp
146146
147147
race_repeat 0
@@ -163,7 +163,7 @@ src mac
163163
start 10
164164
count 5
165165
src_delta 2000
166-
tools sendip nc bash
166+
tools sendip socat nc bash
167167
proto udp6
168168
169169
race_repeat 0
@@ -185,7 +185,7 @@ src mac proto
185185
start 10
186186
count 5
187187
src_delta 2000
188-
tools sendip nc bash
188+
tools sendip socat nc bash
189189
proto udp6
190190
191191
race_repeat 0
@@ -207,7 +207,7 @@ src addr4
207207
start 1
208208
count 5
209209
src_delta 2000
210-
tools sendip nc bash
210+
tools sendip socat nc bash
211211
proto udp
212212
213213
race_repeat 3
@@ -227,7 +227,7 @@ src addr6 port
227227
start 10
228228
count 5
229229
src_delta 2000
230-
tools sendip nc
230+
tools sendip socat nc
231231
proto udp6
232232
233233
race_repeat 3
@@ -247,7 +247,7 @@ src mac proto addr4
247247
start 1
248248
count 5
249249
src_delta 2000
250-
tools sendip nc bash
250+
tools sendip socat nc bash
251251
proto udp
252252
253253
race_repeat 0
@@ -264,7 +264,7 @@ src mac
264264
start 1
265265
count 5
266266
src_delta 2000
267-
tools sendip nc bash
267+
tools sendip socat nc bash
268268
proto udp
269269
270270
race_repeat 0
@@ -286,7 +286,7 @@ src mac addr4
286286
start 1
287287
count 5
288288
src_delta 2000
289-
tools sendip nc bash
289+
tools sendip socat nc bash
290290
proto udp
291291
292292
race_repeat 0
@@ -337,7 +337,7 @@ src addr4
337337
start 1
338338
count 5
339339
src_delta 2000
340-
tools sendip nc
340+
tools sendip socat nc
341341
proto udp
342342
343343
race_repeat 3
@@ -363,7 +363,7 @@ src mac
363363
start 1
364364
count 1
365365
src_delta 2000
366-
tools sendip nc bash
366+
tools sendip socat nc bash
367367
proto udp
368368
369369
race_repeat 0
@@ -541,6 +541,24 @@ setup_send_udp() {
541541
dst_port=
542542
src_addr4=
543543
}
544+
elif command -v socat -v >/dev/null; then
545+
send_udp() {
546+
if [ -n "${src_addr4}" ]; then
547+
B ip addr add "${src_addr4}" dev veth_b
548+
__socatbind=",bind=${src_addr4}"
549+
if [ -n "${src_port}" ];then
550+
__socatbind="${__socatbind}:${src_port}"
551+
fi
552+
fi
553+
554+
ip addr add "${dst_addr4}" dev veth_a 2>/dev/null
555+
[ -z "${dst_port}" ] && dst_port=12345
556+
557+
echo "test4" | B socat -t 0.01 STDIN UDP4-DATAGRAM:${dst_addr4}:${dst_port}"${__socatbind}"
558+
559+
src_addr4=
560+
src_port=
561+
}
544562
elif command -v nc >/dev/null; then
545563
if nc -u -w0 1.1.1.1 1 2>/dev/null; then
546564
# OpenBSD netcat
@@ -606,6 +624,29 @@ setup_send_udp6() {
606624
dst_port=
607625
src_addr6=
608626
}
627+
elif command -v socat -v >/dev/null; then
628+
send_udp6() {
629+
ip -6 addr add "${dst_addr6}" dev veth_a nodad \
630+
2>/dev/null
631+
632+
__socatbind6=
633+
634+
if [ -n "${src_addr6}" ]; then
635+
if [ -n "${src_addr6} != "${src_addr6_added} ]; then
636+
B ip addr add "${src_addr6}" dev veth_b nodad
637+
638+
src_addr6_added=${src_addr6}
639+
fi
640+
641+
__socatbind6=",bind=[${src_addr6}]"
642+
643+
if [ -n "${src_port}" ] ;then
644+
__socatbind6="${__socatbind6}:${src_port}"
645+
fi
646+
fi
647+
648+
echo "test6" | B socat -t 0.01 STDIN UDP6-DATAGRAM:[${dst_addr6}]:${dst_port}"${__socatbind6}"
649+
}
609650
elif command -v nc >/dev/null && nc -u -w0 1.1.1.1 1 2>/dev/null; then
610651
# GNU netcat might not work with IPv6, try next tool
611652
send_udp6() {

0 commit comments

Comments
 (0)