mirror of
https://github.com/torvalds/linux.git
synced 2024-09-25 01:13:04 +00:00
[NETFILTER]: nf_conntrack: check address family when finding protocol module
__nf_conntrack_{l3}proto_find() doesn't check the passed protocol family, then it's possible to touch out of the array which has only AF_MAX items. Spotted by Pablo Neira Ayuso. Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp> Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
34f9a2e4de
commit
ddc8d029ac
|
@ -88,12 +88,6 @@ extern struct nf_conntrack_l3proto *nf_ct_l3protos[AF_MAX];
|
||||||
extern int nf_conntrack_l3proto_register(struct nf_conntrack_l3proto *proto);
|
extern int nf_conntrack_l3proto_register(struct nf_conntrack_l3proto *proto);
|
||||||
extern void nf_conntrack_l3proto_unregister(struct nf_conntrack_l3proto *proto);
|
extern void nf_conntrack_l3proto_unregister(struct nf_conntrack_l3proto *proto);
|
||||||
|
|
||||||
static inline struct nf_conntrack_l3proto *
|
|
||||||
__nf_ct_l3proto_find(u_int16_t l3proto)
|
|
||||||
{
|
|
||||||
return nf_ct_l3protos[l3proto];
|
|
||||||
}
|
|
||||||
|
|
||||||
extern struct nf_conntrack_l3proto *
|
extern struct nf_conntrack_l3proto *
|
||||||
nf_ct_l3proto_find_get(u_int16_t l3proto);
|
nf_ct_l3proto_find_get(u_int16_t l3proto);
|
||||||
|
|
||||||
|
@ -103,4 +97,13 @@ extern void nf_ct_l3proto_put(struct nf_conntrack_l3proto *p);
|
||||||
extern struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4;
|
extern struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4;
|
||||||
extern struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6;
|
extern struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6;
|
||||||
extern struct nf_conntrack_l3proto nf_conntrack_generic_l3proto;
|
extern struct nf_conntrack_l3proto nf_conntrack_generic_l3proto;
|
||||||
|
|
||||||
|
static inline struct nf_conntrack_l3proto *
|
||||||
|
__nf_ct_l3proto_find(u_int16_t l3proto)
|
||||||
|
{
|
||||||
|
if (unlikely(l3proto >= AF_MAX))
|
||||||
|
return &nf_conntrack_generic_l3proto;
|
||||||
|
return nf_ct_l3protos[l3proto];
|
||||||
|
}
|
||||||
|
|
||||||
#endif /*_NF_CONNTRACK_L3PROTO_H*/
|
#endif /*_NF_CONNTRACK_L3PROTO_H*/
|
||||||
|
|
|
@ -188,7 +188,7 @@ extern struct nf_conntrack_protocol nf_conntrack_generic_protocol;
|
||||||
struct nf_conntrack_protocol *
|
struct nf_conntrack_protocol *
|
||||||
__nf_ct_proto_find(u_int16_t l3proto, u_int8_t protocol)
|
__nf_ct_proto_find(u_int16_t l3proto, u_int8_t protocol)
|
||||||
{
|
{
|
||||||
if (unlikely(nf_ct_protos[l3proto] == NULL))
|
if (unlikely(l3proto >= AF_MAX || nf_ct_protos[l3proto] == NULL))
|
||||||
return &nf_conntrack_generic_protocol;
|
return &nf_conntrack_generic_protocol;
|
||||||
|
|
||||||
return nf_ct_protos[l3proto][protocol];
|
return nf_ct_protos[l3proto][protocol];
|
||||||
|
|
Loading…
Reference in New Issue
Block a user