netfilter: conntrack: dccp: treat SYNC/SYNCACK as invalid if no prior state
commit 6613b6173d
upstream.
When first DCCP packet is SYNC or SYNCACK, we insert a new conntrack
that has an un-initialized timeout value, i.e. such entry could be
reaped at any time.
Mark them as INVALID and only ignore SYNC/SYNCACK when connection had
an old state.
Reported-by: syzbot+6f18401420df260e37ed@syzkaller.appspotmail.com
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
pull/10/head
parent
caf3d4bd62
commit
c764f22b2f
|
@ -243,14 +243,14 @@ dccp_state_table[CT_DCCP_ROLE_MAX + 1][DCCP_PKT_SYNCACK + 1][CT_DCCP_MAX + 1] =
|
|||
* We currently ignore Sync packets
|
||||
*
|
||||
* sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
|
||||
sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
|
||||
sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
|
||||
},
|
||||
[DCCP_PKT_SYNCACK] = {
|
||||
/*
|
||||
* We currently ignore SyncAck packets
|
||||
*
|
||||
* sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
|
||||
sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
|
||||
sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
|
||||
},
|
||||
},
|
||||
[CT_DCCP_ROLE_SERVER] = {
|
||||
|
@ -371,14 +371,14 @@ dccp_state_table[CT_DCCP_ROLE_MAX + 1][DCCP_PKT_SYNCACK + 1][CT_DCCP_MAX + 1] =
|
|||
* We currently ignore Sync packets
|
||||
*
|
||||
* sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
|
||||
sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
|
||||
sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
|
||||
},
|
||||
[DCCP_PKT_SYNCACK] = {
|
||||
/*
|
||||
* We currently ignore SyncAck packets
|
||||
*
|
||||
* sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
|
||||
sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
|
||||
sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
|
||||
},
|
||||
},
|
||||
};
|
||||
|
|
Loading…
Reference in New Issue