Commit 03726186 authored by Sergey Popovich's avatar Sergey Popovich Committed by Pablo Neira Ayuso
Browse files

netfilter: ipset: Check for comment netlink attribute length 



Ensure userspace supplies string not longer than
IPSET_MAX_COMMENT_SIZE.

Signed-off-by: default avatarSergey Popovich <popovich_sergei@mail.ua>
Signed-off-by: default avatarJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 728a7e69

net/netfilter/ipset/ip_set_bitmap_ip.c

+2 −1
Original line number Diff line number Diff line
@@ -364,7 +364,8 @@ static struct ip_set_type bitmap_ip_type __read_mostly = { 
		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },

		[IPSET_ATTR_BYTES]	= { .type = NLA_U64 },

		[IPSET_ATTR_PACKETS]	= { .type = NLA_U64 },

		[IPSET_ATTR_COMMENT]	= { .type = NLA_NUL_STRING },

		[IPSET_ATTR_COMMENT]	= { .type = NLA_NUL_STRING,

					    .len  = IPSET_MAX_COMMENT_SIZE },

		[IPSET_ATTR_SKBMARK]	= { .type = NLA_U64 },

		[IPSET_ATTR_SKBPRIO]	= { .type = NLA_U32 },

		[IPSET_ATTR_SKBQUEUE]	= { .type = NLA_U16 },

net/netfilter/ipset/ip_set_bitmap_ipmac.c

+2 −1
Original line number Diff line number Diff line
@@ -401,7 +401,8 @@ static struct ip_set_type bitmap_ipmac_type = { 
		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },

		[IPSET_ATTR_BYTES]	= { .type = NLA_U64 },

		[IPSET_ATTR_PACKETS]	= { .type = NLA_U64 },

		[IPSET_ATTR_COMMENT]	= { .type = NLA_NUL_STRING },

		[IPSET_ATTR_COMMENT]	= { .type = NLA_NUL_STRING,

					    .len  = IPSET_MAX_COMMENT_SIZE },

		[IPSET_ATTR_SKBMARK]	= { .type = NLA_U64 },

		[IPSET_ATTR_SKBPRIO]	= { .type = NLA_U32 },

		[IPSET_ATTR_SKBQUEUE]	= { .type = NLA_U16 },

net/netfilter/ipset/ip_set_bitmap_port.c

+2 −1
Original line number Diff line number Diff line
@@ -294,7 +294,8 @@ static struct ip_set_type bitmap_port_type = { 
		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },

		[IPSET_ATTR_BYTES]	= { .type = NLA_U64 },

		[IPSET_ATTR_PACKETS]	= { .type = NLA_U64 },

		[IPSET_ATTR_COMMENT]	= { .type = NLA_NUL_STRING },

		[IPSET_ATTR_COMMENT]	= { .type = NLA_NUL_STRING,

					    .len  = IPSET_MAX_COMMENT_SIZE },

		[IPSET_ATTR_SKBMARK]	= { .type = NLA_U64 },

		[IPSET_ATTR_SKBPRIO]	= { .type = NLA_U32 },

		[IPSET_ATTR_SKBQUEUE]	= { .type = NLA_U16 },

net/netfilter/ipset/ip_set_hash_ip.c

+2 −1
Original line number Diff line number Diff line
@@ -304,7 +304,8 @@ static struct ip_set_type hash_ip_type __read_mostly = { 
		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },

		[IPSET_ATTR_BYTES]	= { .type = NLA_U64 },

		[IPSET_ATTR_PACKETS]	= { .type = NLA_U64 },

		[IPSET_ATTR_COMMENT]	= { .type = NLA_NUL_STRING },

		[IPSET_ATTR_COMMENT]	= { .type = NLA_NUL_STRING,

					    .len  = IPSET_MAX_COMMENT_SIZE },

		[IPSET_ATTR_SKBMARK]	= { .type = NLA_U64 },

		[IPSET_ATTR_SKBPRIO]	= { .type = NLA_U32 },

		[IPSET_ATTR_SKBQUEUE]	= { .type = NLA_U16 },

net/netfilter/ipset/ip_set_hash_ipmark.c

+2 −1
Original line number Diff line number Diff line
@@ -310,7 +310,8 @@ static struct ip_set_type hash_ipmark_type __read_mostly = { 
		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },

		[IPSET_ATTR_BYTES]	= { .type = NLA_U64 },

		[IPSET_ATTR_PACKETS]	= { .type = NLA_U64 },

		[IPSET_ATTR_COMMENT]	= { .type = NLA_NUL_STRING },

		[IPSET_ATTR_COMMENT]	= { .type = NLA_NUL_STRING,

					    .len  = IPSET_MAX_COMMENT_SIZE },

		[IPSET_ATTR_SKBMARK]	= { .type = NLA_U64 },

		[IPSET_ATTR_SKBPRIO]	= { .type = NLA_U32 },

		[IPSET_ATTR_SKBQUEUE]	= { .type = NLA_U16 },

CRA Git | Maintained and supported by SUSTech CRA and CCSE