leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
2690d97ade
linux/net/netfilter
History
Daniel Borkmann 2690d97ade netfilter: nf_nat: fix access to uninitialized buffer in IRC NAT helper 
Commit 5901b6be88 attempted to introduce IPv6 support into
IRC NAT helper. By doing so, the following code seemed to be removed
by accident:

  ip = ntohl(exp->master->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip);
  sprintf(buffer, "%u %u", ip, port);
  pr_debug("nf_nat_irc: inserting '%s' == %pI4, port %u\n", buffer, &ip, port);

This leads to the fact that buffer[] was left uninitialized and
contained some stack value. When we call nf_nat_mangle_tcp_packet(),
we call strlen(buffer) on excatly this uninitialized buffer. If we
are unlucky and the skb has enough tailroom, we overwrite resp. leak
contents with values that sit on our stack into the packet and send
that out to the receiver.

Since the rather informal DCC spec [1] does not seem to specify
IPv6 support right now, we log such occurences so that admins can
act accordingly, and drop the packet. I've looked into XChat source,
and IPv6 is not supported there: addresses are in u32 and print
via %u format string.

Therefore, restore old behaviour as in IPv4, use snprintf(). The
IRC helper does not support IPv6 by now. By this, we can safely use
strlen(buffer) in nf_nat_mangle_tcp_packet() and prevent a buffer
overflow. Also simplify some code as we now have ct variable anyway.

  [1] http://www.irchelp.org/irchelp/rfc/ctcpspec.html

Fixes: 5901b6be88 ("netfilter: nf_nat: support IPv6 in IRC NAT helper")
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Harald Welte <laforge@gnumonks.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2014-01-06 14:17:17 +01:00
..
ipset netfilter: ipset: fix incorret comparison in hash_netnet4_data_equal() 2013-11-25 22:42:18 +01:00
ipvs ipvs: correct usage/allocation of seqadj ext in ipvs 2013-12-27 12:30:02 +09:00
core.c netfilter: pass hook ops to hookfn 2013-10-14 11:29:31 +02:00
Kconfig netfilter: fix connlimit Kconfig prompt string 2013-11-13 23:31:11 +01:00
Makefile netfilter: nf_tables: Add support for IPv6 NAT 2013-10-14 18:00:58 +02:00
nf_conntrack_acct.c netfilter: introduce nf_conn_acct structure 2013-11-03 21:48:49 +01:00
nf_conntrack_amanda.c netfilter: add my copyright statements 2013-04-18 20:27:55 +02:00
nf_conntrack_broadcast.c
nf_conntrack_core.c netfilter: nf_conntrack: decrement global counter after object release 2013-11-18 14:07:19 +01:00
nf_conntrack_ecache.c netfilter: add my copyright statements 2013-04-18 20:27:55 +02:00
nf_conntrack_expect.c netfilter: ctnetlink: fix incorrect NAT expectation dumping 2013-07-15 11:14:51 +02:00
nf_conntrack_extend.c netfilter: nf_ct_ext: support variable length extensions 2012-06-16 15:08:49 +02:00
nf_conntrack_ftp.c netfilter: Implement RFC 1123 for FTP conntrack 2013-05-27 13:32:43 +02:00
nf_conntrack_h323_asn1.c
nf_conntrack_h323_main.c netfilter: nf_conntrack: fix rt6i_gateway checks for H.323 helper 2013-10-21 18:37:01 -04:00
nf_conntrack_h323_types.c
nf_conntrack_helper.c netfilter: add my copyright statements 2013-04-18 20:27:55 +02:00
nf_conntrack_irc.c netfilter: add my copyright statements 2013-04-18 20:27:55 +02:00
nf_conntrack_l3proto_generic.c
nf_conntrack_labels.c netfilter: connlabels: remove unneeded includes 2013-07-31 16:39:18 +02:00
nf_conntrack_netbios_ns.c
nf_conntrack_netlink.c netfilter: ctnetlink: account both directions in one step 2013-11-03 21:49:32 +01:00
nf_conntrack_pptp.c netfilter: add my copyright statements 2013-04-18 20:27:55 +02:00
nf_conntrack_proto_dccp.c netfilter: nf_log: prepare net namespace support for loggers 2013-04-05 20:12:54 +02:00
nf_conntrack_proto_generic.c netfilter: nf_conntrack: generalize nf_ct_l4proto_net 2012-07-04 19:37:22 +02:00
nf_conntrack_proto_gre.c netfilter: add my copyright statements 2013-04-18 20:27:55 +02:00
nf_conntrack_proto_sctp.c netfilter: add my copyright statements 2013-04-18 20:27:55 +02:00
nf_conntrack_proto_tcp.c netfilter: add SYNPROXY core/target 2013-08-28 00:27:54 +02:00
nf_conntrack_proto_udp.c netfilter: add my copyright statements 2013-04-18 20:27:55 +02:00
nf_conntrack_proto_udplite.c netfilter: nf_log: prepare net namespace support for loggers 2013-04-05 20:12:54 +02:00
nf_conntrack_proto.c netfilter: nf_conntrack: don't send destroy events from iterator 2013-08-09 12:03:33 +02:00
nf_conntrack_sane.c netfilter: nf_ct_helper: better logging for dropped packets 2013-02-19 02:48:05 +01:00
nf_conntrack_seqadj.c netfilter: WARN about wrong usage of sequence number adjustments 2013-12-27 12:29:54 +09:00
nf_conntrack_sip.c netfilter: nf_ct_sip: consolidate NAT hook functions 2013-10-01 12:47:09 +02:00
nf_conntrack_snmp.c netfilter: nf_ct_snmp: add include file 2013-01-18 00:28:18 +01:00
nf_conntrack_standalone.c net: Convert uses of typedef ctl_table to struct ctl_table 2013-06-13 02:36:09 -07:00
nf_conntrack_tftp.c netfilter: add my copyright statements 2013-04-18 20:27:55 +02:00
nf_conntrack_timeout.c netfilter: nf_ct_timeout: move initialization out of pernet_operations 2013-01-23 12:56:02 +01:00
nf_conntrack_timestamp.c netfilter: nf_ct_timestamp: Fix BUG_ON after netns deletion 2013-12-20 14:58:29 +01:00
nf_internals.h net: misc: Remove extern from function prototypes 2013-10-19 19:12:11 -04:00
nf_log.c net: Convert uses of typedef ctl_table to struct ctl_table 2013-06-13 02:36:09 -07:00
nf_nat_amanda.c netfilter: add my copyright statements 2013-04-18 20:27:55 +02:00
nf_nat_core.c netfilter: nf_nat: move alloc_null_binding to nf_nat_core.c 2013-10-14 11:29:39 +02:00
nf_nat_ftp.c netfilter: nf_ct_helper: better logging for dropped packets 2013-02-19 02:48:05 +01:00
nf_nat_helper.c netfilter: nf_conntrack: make sequence number adjustments usuable without NAT 2013-08-28 00:26:48 +02:00
nf_nat_irc.c netfilter: nf_nat: fix access to uninitialized buffer in IRC NAT helper 2014-01-06 14:17:17 +01:00
nf_nat_proto_common.c netfilter: add protocol independent NAT core 2012-08-30 03:00:14 +02:00
nf_nat_proto_dccp.c netfilter: add protocol independent NAT core 2012-08-30 03:00:14 +02:00
nf_nat_proto_sctp.c net/sctp: Refactor SCTP skb checksum computation 2013-07-27 20:07:15 -07:00
nf_nat_proto_tcp.c netfilter: add protocol independent NAT core 2012-08-30 03:00:14 +02:00
nf_nat_proto_udp.c netfilter: add protocol independent NAT core 2012-08-30 03:00:14 +02:00
nf_nat_proto_udplite.c netfilter: add protocol independent NAT core 2012-08-30 03:00:14 +02:00
nf_nat_proto_unknown.c netfilter: add protocol independent NAT core 2012-08-30 03:00:14 +02:00
nf_nat_sip.c netfilter: nf_ct_sip: consolidate NAT hook functions 2013-10-01 12:47:09 +02:00
nf_nat_tftp.c netfilter: nf_ct_helper: better logging for dropped packets 2013-02-19 02:48:05 +01:00
nf_queue.c netfilter: move skb_gso_segment into nfnetlink_queue module 2013-04-29 20:09:05 +02:00
nf_sockopt.c
nf_synproxy_core.c netfilter: synproxy: correct wscale option passing 2013-11-18 12:53:38 +01:00
nf_tables_api.c netfilter: nf_tables: fix wrong datatype in nft_validate_data_load() 2013-12-28 22:32:28 +01:00
nf_tables_core.c netfilter: nf_tables: add trace support 2013-10-14 18:01:02 +02:00
nfnetlink_acct.c netfilter: nfnetlink_acct: fix incomplete dumping of objects 2013-06-05 12:36:36 +02:00
nfnetlink_cthelper.c netfilter: check return code from nla_parse_tested 2013-06-20 11:20:13 +02:00
nfnetlink_cttimeout.c netfilter: cttimeout: allow to set/get default protocol timeouts 2013-10-01 13:17:39 +02:00
nfnetlink_log.c netfilter: nfnetlink_log: unset nf_loggers for netns when unloading module 2013-12-17 23:19:03 +01:00
nfnetlink_queue_core.c netfilter: nfnetlink_queue: use proper net namespace to allocate skb 2013-10-01 12:20:31 +02:00
nfnetlink_queue_ct.c netfilter: nf_conntrack: make sequence number adjustments usuable without NAT 2013-08-28 00:26:48 +02:00
nfnetlink.c nfnetlink: do not ack malformed messages 2013-11-08 15:12:11 -05:00
nft_bitwise.c netfilter: nf_tables: expression ops overloading 2013-10-14 17:16:08 +02:00
nft_byteorder.c netfilter: nf_tables: expression ops overloading 2013-10-14 17:16:08 +02:00
nft_cmp.c netfilter: nf_tables: add compatibility layer for x_tables 2013-10-14 18:00:04 +02:00
nft_compat.c netfilter: nft_compat: fix error path in nft_parse_compat() 2013-11-18 12:53:41 +01:00
nft_counter.c netfilter: nf_tables: expression ops overloading 2013-10-14 17:16:08 +02:00
nft_ct.c netfilter: nf_tables: expression ops overloading 2013-10-14 17:16:08 +02:00
nft_expr_template.c netfilter: nf_tables: expression ops overloading 2013-10-14 17:16:08 +02:00
nft_exthdr.c netfilter: nft_exthdr: call ipv6_find_hdr() with explicitly initialized offset 2013-12-20 11:25:10 +01:00
nft_hash.c netfilter: nf_tables: add netlink set API 2013-10-14 17:16:07 +02:00
nft_immediate.c netfilter: nf_tables: add compatibility layer for x_tables 2013-10-14 18:00:04 +02:00
nft_limit.c netfilter: nf_tables: expression ops overloading 2013-10-14 17:16:08 +02:00
nft_log.c netfilter: nf_tables: expression ops overloading 2013-10-14 17:16:08 +02:00
nft_lookup.c netfilter: nf_tables: expression ops overloading 2013-10-14 17:16:08 +02:00
nft_meta_target.c netfilter: add nftables 2013-10-14 17:15:48 +02:00
nft_meta.c netfilter: nf_tables: expression ops overloading 2013-10-14 17:16:08 +02:00
nft_nat.c netfilter: nft_nat: Fix endianness issue reported by sparse 2013-10-28 17:41:49 +01:00
nft_payload.c netfilter: nf_tables: nft_payload: fix transport header base 2013-10-14 18:00:56 +02:00
nft_rbtree.c netfilter: nf_tables: add netlink set API 2013-10-14 17:16:07 +02:00
x_tables.c netfilter: x_tables: fix ordering of jumpstack allocation and table update 2013-10-22 10:11:29 +02:00
xt_addrtype.c netfilter: xt_addrtype: fix trivial typo 2013-07-31 16:36:25 +02:00
xt_AUDIT.c netfilter: xt_AUDIT: only generate audit log when audit enabled 2013-03-04 14:45:25 +01:00
xt_bpf.c netfilter: x_tables: add xt_bpf match 2013-01-21 12:20:19 +01:00
xt_CHECKSUM.c
xt_CLASSIFY.c
xt_cluster.c
xt_comment.c
xt_connbytes.c netfilter: introduce nf_conn_acct structure 2013-11-03 21:48:49 +01:00
xt_connlabel.c netfilter: add connlabel conntrack extension 2013-01-18 00:28:15 +01:00
xt_connlimit.c hlist: drop the node parameter from iterators 2013-02-27 19:10:24 -08:00
xt_connmark.c
xt_CONNSECMARK.c
xt_conntrack.c netfilter: add my copyright statements 2013-04-18 20:27:55 +02:00
xt_cpu.c
xt_CT.c netfilter: xt_CT: optimize XT_CT_NOTRACK 2013-05-23 11:09:29 +02:00
xt_dccp.c
xt_devgroup.c
xt_dscp.c
xt_DSCP.c
xt_ecn.c
xt_esp.c
xt_hashlimit.c netfilter: xt_hashlimit: fix proc entry leak in netns destroy path 2013-12-07 22:46:51 +01:00
xt_helper.c
xt_hl.c
xt_HL.c
xt_HMARK.c ipv6: Move ipv6_find_hdr() out of Netfilter code. 2012-11-09 17:05:07 -08:00
xt_IDLETIMER.c
xt_iprange.c
xt_ipvs.c ipvs: API change to avoid rescan of IPv6 exthdr 2012-09-28 11:34:33 +09:00
xt_LED.c
xt_length.c
xt_limit.c netfilter: add my copyright statements 2013-04-18 20:27:55 +02:00
xt_LOG.c netfilter: xt_LOG: fix mark logging for IPv6 packets 2013-05-29 12:29:18 +02:00
xt_mac.c netfilter: Convert compare_ether_addr to ether_addr_equal 2012-05-09 20:49:18 -04:00
xt_mark.c
xt_multiport.c
xt_nat.c netfilter: xt_nat: fix incorrect hooks for SNAT and DNAT targets 2012-10-15 13:39:12 +02:00
xt_NETMAP.c netfilter: combine ipt_NETMAP and ip6t_NETMAP 2012-09-21 12:11:08 +02:00
xt_nfacct.c
xt_NFLOG.c netfilter: log: netns NULL ptr bug when calling from conntrack 2013-05-15 14:11:07 +02:00
xt_NFQUEUE.c netfilter: xt_NFQUEUE: fix --queue-bypass regression 2013-10-29 13:05:54 +01:00
xt_osf.c netfilter: nf_log: prepare net namespace support for loggers 2013-04-05 20:12:54 +02:00
xt_owner.c userns: xt_owner: Add basic user namespace support. 2012-08-14 21:55:30 -07:00
xt_physdev.c
xt_pkttype.c
xt_policy.c
xt_quota.c
xt_rateest.c net_sched: add 64bit rate estimators 2013-06-11 02:51:03 -07:00
xt_RATEEST.c hlist: drop the node parameter from iterators 2013-02-27 19:10:24 -08:00
xt_realm.c
xt_recent.c proc: Supply PDE attribute setting accessor functions 2013-05-01 17:29:18 -04:00
xt_REDIRECT.c netfilter: combine ipt_REDIRECT and ip6t_REDIRECT 2012-09-21 12:12:05 +02:00
xt_repldata.h
xt_sctp.c
xt_SECMARK.c
xt_set.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2013-11-15 16:47:22 -08:00
xt_socket.c netfilter: xt_socket: use sock_gen_put() 2013-10-17 10:27:25 +02:00
xt_state.c
xt_statistic.c
xt_string.c
xt_tcpmss.c
xt_TCPMSS.c netfilter: xt_TCPMSS: lookup route from proper net namespace 2013-09-27 16:18:23 +02:00
xt_TCPOPTSTRIP.c netfilter: xt_TCPOPTSTRIP: fix possible off by one access 2013-08-01 11:45:15 +02:00
xt_tcpudp.c
xt_TEE.c net: pass info struct via netdevice notifier 2013-05-28 13:11:01 -07:00
xt_time.c netfilter: xt_time: add support to ignore day transition 2012-09-24 14:29:01 +02:00
xt_TPROXY.c ipv6: make lookups simpler and faster 2013-10-09 00:01:25 -04:00
xt_TRACE.c
xt_u32.c