mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-30 14:19:16 +00:00
Code Issues Releases Wiki Activity

netfilter: x_tables: check error target size too

Browse source 
Check that userspace ERROR target (custom user-defined chains) match
expected format, and the chain name is null terminated.

This is irrelevant for kernel, but iptables itself relies on sane input
when it dumps rules from kernel.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Florian Westphal 2018-02-27 19:42:28 +01:00 committed by Pablo Neira Ayuso
parent 07a9da51b4
commit 472ebdcd15
1 changed files with 23 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
net/netfilter/x_tables.c
View file

@ -654,6 +654,11 @@ struct compat_xt_standard_target {
compat_uint_t verdict;
};
struct compat_xt_error_target {
struct compat_xt_entry_target t;
char errorname[XT_FUNCTION_MAXNAMELEN];
};
static bool verdict_ok(int verdict)
{
if (verdict > 0)
@ -679,6 +684,12 @@ static bool verdict_ok(int verdict)
return false;
}
static bool error_tg_ok(unsigned int usersize, unsigned int kernsize,
const char *msg, unsigned int msglen)
{
return usersize == kernsize && strnlen(msg, msglen) < msglen;
}
int xt_compat_check_entry_offsets(const void *base, const char *elems,
unsigned int target_offset,
unsigned int next_offset)
@ -708,6 +719,12 @@ int xt_compat_check_entry_offsets(const void *base, const char *elems,
if (!verdict_ok(st->verdict))
return -EINVAL;
} else if (strcmp(t->u.user.name, XT_ERROR_TARGET) == 0) {
const struct compat_xt_error_target *et = (const void *)t;
if (!error_tg_ok(t->u.target_size, sizeof(*et),
et->errorname, sizeof(et->errorname)))
return -EINVAL;
}
/* compat_xt_entry match has less strict alignment requirements,
@ -796,6 +813,12 @@ int xt_check_entry_offsets(const void *base,
if (!verdict_ok(st->verdict))
return -EINVAL;
} else if (strcmp(t->u.user.name, XT_ERROR_TARGET) == 0) {
const struct xt_error_target *et = (const void *)t;
if (!error_tg_ok(t->u.target_size, sizeof(*et),
et->errorname, sizeof(et->errorname)))
return -EINVAL;
}
return xt_check_entry_match(elems, base + target_offset,