Commit 54b553e2 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 



Pablo Neira Ayuso says:

====================
Netfilter updates for net-next

The following patchset contains three Netfilter updates, they are:

* Fix wrong usage of skb_header_pointer in the DCCP protocol helper that
  has been there for quite some time. It was resulting in copying the dccp
  header to a pointer allocated in the stack. Fortunately, this pointer
  provides room for the dccp header is 4 bytes long, so no crashes have been
  reported so far. From Daniel Borkmann.

* Use format string to print in the invocation of nf_log_packet(), again
  in the DCCP helper. Also from Daniel Borkmann.

* Revert "netfilter: avoid get_random_bytes call" as prandom32 does not
  guarantee enough entropy when being calling this at boot time, that may
  happen when reloading the rule.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 80077935 b22f5126

net/netfilter/nf_conntrack_proto_dccp.c

+5 −5
Original line number Diff line number Diff line
@@ -428,7 +428,7 @@ static bool dccp_new(struct nf_conn *ct, const struct sk_buff *skb, 
	const char *msg;

	u_int8_t state;



	dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &dh);

	dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh);

	BUG_ON(dh == NULL);



	state = dccp_state_table[CT_DCCP_ROLE_CLIENT][dh->dccph_type][CT_DCCP_NONE];
@@ -457,7 +457,7 @@ static bool dccp_new(struct nf_conn *ct, const struct sk_buff *skb, 
out_invalid:

	if (LOG_INVALID(net, IPPROTO_DCCP))

		nf_log_packet(net, nf_ct_l3num(ct), 0, skb, NULL, NULL,

			      NULL, msg);

			      NULL, "%s", msg);

	return false;

}
@@ -486,7 +486,7 @@ static int dccp_packet(struct nf_conn *ct, const struct sk_buff *skb, 
	u_int8_t type, old_state, new_state;

	enum ct_dccp_roles role;



	dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &dh);

	dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh);

	BUG_ON(dh == NULL);

	type = dh->dccph_type;
@@ -577,7 +577,7 @@ static int dccp_error(struct net *net, struct nf_conn *tmpl, 
	unsigned int cscov;

	const char *msg;



	dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &dh);

	dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh);

	if (dh == NULL) {

		msg = "nf_ct_dccp: short packet ";

		goto out_invalid;
@@ -614,7 +614,7 @@ static int dccp_error(struct net *net, struct nf_conn *tmpl, 


out_invalid:

	if (LOG_INVALID(net, IPPROTO_DCCP))

		nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL, msg);

		nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL, "%s", msg);

	return -NF_ACCEPT;

}

net/netfilter/nfnetlink_log.c

+8 −0
Original line number Diff line number Diff line
@@ -28,6 +28,8 @@ 
#include <linux/proc_fs.h>

#include <linux/security.h>

#include <linux/list.h>

#include <linux/jhash.h>

#include <linux/random.h>

#include <linux/slab.h>

#include <net/sock.h>

#include <net/netfilter/nf_log.h>
@@ -73,6 +75,7 @@ struct nfulnl_instance { 
};



#define INSTANCE_BUCKETS	16

static unsigned int hash_init;



static int nfnl_log_net_id __read_mostly;
@@ -1064,6 +1067,11 @@ static int __init nfnetlink_log_init(void) 
{

	int status = -ENOMEM;



	/* it's not really all that important to have a random value, so

	 * we can do this from the init function, even if there hasn't

	 * been that much entropy yet */

	get_random_bytes(&hash_init, sizeof(hash_init));



	netlink_register_notifier(&nfulnl_rtnl_notifier);

	status = nfnetlink_subsys_register(&nfulnl_subsys);

	if (status < 0) {

net/netfilter/nft_hash.c

+1 −1
Original line number Diff line number Diff line
@@ -164,7 +164,7 @@ static int nft_hash_init(const struct nft_set *set, 
	unsigned int cnt, i;



	if (unlikely(!nft_hash_rnd_initted)) {

		nft_hash_rnd = prandom_u32();

		get_random_bytes(&nft_hash_rnd, 4);

		nft_hash_rnd_initted = true;

	}

net/netfilter/xt_RATEEST.c

+1 −1
Original line number Diff line number Diff line
@@ -100,7 +100,7 @@ static int xt_rateest_tg_checkentry(const struct xt_tgchk_param *par) 
	int ret;



	if (unlikely(!rnd_inited)) {

		jhash_rnd = prandom_u32();

		get_random_bytes(&jhash_rnd, sizeof(jhash_rnd));

		rnd_inited = true;

	}

net/netfilter/xt_connlimit.c

+1 −1
Original line number Diff line number Diff line
@@ -229,7 +229,7 @@ static int connlimit_mt_check(const struct xt_mtchk_param *par) 
		u_int32_t rand;



		do {

			rand = prandom_u32();

			get_random_bytes(&rand, sizeof(rand));

		} while (!rand);

		cmpxchg(&connlimit_rnd, 0, rand);

	}

CRA Git | Maintained and supported by SUSTech CRA and CCSE