Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf
Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Out-of-bound access to packet data from the snmp nat helper, from Jann Horn. 2) ICMP(v6) error packets are set as related traffic by conntrack, update protocol number before calling nf_nat_ipv4_manip_pkt() to use ICMP(v6) rather than the original protocol number, from Florian Westphal. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>hifive-unleashed-5.1
commit
4d73eaee24
|
@ -215,6 +215,7 @@ int nf_nat_icmp_reply_translation(struct sk_buff *skb,
|
||||||
|
|
||||||
/* Change outer to look like the reply to an incoming packet */
|
/* Change outer to look like the reply to an incoming packet */
|
||||||
nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);
|
nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);
|
||||||
|
target.dst.protonum = IPPROTO_ICMP;
|
||||||
if (!nf_nat_ipv4_manip_pkt(skb, 0, &target, manip))
|
if (!nf_nat_ipv4_manip_pkt(skb, 0, &target, manip))
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
|
|
|
@ -105,6 +105,8 @@ static void fast_csum(struct snmp_ctx *ctx, unsigned char offset)
|
||||||
int snmp_version(void *context, size_t hdrlen, unsigned char tag,
|
int snmp_version(void *context, size_t hdrlen, unsigned char tag,
|
||||||
const void *data, size_t datalen)
|
const void *data, size_t datalen)
|
||||||
{
|
{
|
||||||
|
if (datalen != 1)
|
||||||
|
return -EINVAL;
|
||||||
if (*(unsigned char *)data > 1)
|
if (*(unsigned char *)data > 1)
|
||||||
return -ENOTSUPP;
|
return -ENOTSUPP;
|
||||||
return 1;
|
return 1;
|
||||||
|
@ -114,8 +116,11 @@ int snmp_helper(void *context, size_t hdrlen, unsigned char tag,
|
||||||
const void *data, size_t datalen)
|
const void *data, size_t datalen)
|
||||||
{
|
{
|
||||||
struct snmp_ctx *ctx = (struct snmp_ctx *)context;
|
struct snmp_ctx *ctx = (struct snmp_ctx *)context;
|
||||||
__be32 *pdata = (__be32 *)data;
|
__be32 *pdata;
|
||||||
|
|
||||||
|
if (datalen != 4)
|
||||||
|
return -EINVAL;
|
||||||
|
pdata = (__be32 *)data;
|
||||||
if (*pdata == ctx->from) {
|
if (*pdata == ctx->from) {
|
||||||
pr_debug("%s: %pI4 to %pI4\n", __func__,
|
pr_debug("%s: %pI4 to %pI4\n", __func__,
|
||||||
(void *)&ctx->from, (void *)&ctx->to);
|
(void *)&ctx->from, (void *)&ctx->to);
|
||||||
|
|
|
@ -226,6 +226,7 @@ int nf_nat_icmpv6_reply_translation(struct sk_buff *skb,
|
||||||
}
|
}
|
||||||
|
|
||||||
nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);
|
nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);
|
||||||
|
target.dst.protonum = IPPROTO_ICMPV6;
|
||||||
if (!nf_nat_ipv6_manip_pkt(skb, 0, &target, manip))
|
if (!nf_nat_ipv6_manip_pkt(skb, 0, &target, manip))
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue