diff options
| author | Florian Westphal <fw@strlen.de> | 2016-06-06 21:52:28 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2016-06-07 00:54:22 +0200 |
| commit | 3503738f77cdbe521da1054a37f59ac2e442b4cf (patch) | |
| tree | 144d072b8baee81558c1334b47c5d7186d888f2c | |
| parent | ba145d3ee951c5c90cd00bb317f06ddbb0451539 (diff) | |
payload: don't update protocol context if we can't find a description
Since commit
20b1131c07acd2fc ("payload: fix stacked headers protocol context tracking")
we deref null pointer if we can't find a description for the desired
protocol, so "ip protocol 254" crashes while testing protocols 6 or 17
(tcp, udp) works.
Also add a test case for this.
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1072
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
| -rw-r--r-- | src/payload.c | 3 | ||||
| -rw-r--r-- | tests/py/ip/ip.t | 3 | ||||
| -rw-r--r-- | tests/py/ip/ip.t.payload | 5 | ||||
| -rw-r--r-- | tests/py/ip/ip.t.payload.inet | 7 | ||||
| -rw-r--r-- | tests/py/ip/ip.t.payload.netdev | 7 |
5 files changed, 25 insertions, 0 deletions
diff --git a/src/payload.c b/src/payload.c index ac0e917a..9ba980a5 100644 --- a/src/payload.c +++ b/src/payload.c @@ -85,6 +85,9 @@ static void payload_expr_pctx_update(struct proto_ctx *ctx, base = ctx->protocol[left->payload.base].desc; desc = proto_find_upper(base, proto); + if (!desc) + return; + assert(desc->base <= PROTO_BASE_MAX); if (desc->base == base->base) { assert(base->length > 0); diff --git a/tests/py/ip/ip.t b/tests/py/ip/ip.t index 594136cb..a265b757 100644 --- a/tests/py/ip/ip.t +++ b/tests/py/ip/ip.t @@ -75,6 +75,9 @@ ip protocol != tcp;ok;ip protocol != 6 ip protocol { icmp, esp, ah, comp, udp, udplite, tcp, dccp, sctp} accept;ok;ip protocol { 33, 136, 17, 51, 50, 6, 132, 1, 108} accept - ip protocol != { icmp, esp, ah, comp, udp, udplite, tcp, dccp, sctp} accept;ok +ip protocol 255;ok +ip protocol 256;fail + ip checksum 13172 drop;ok ip checksum 22;ok ip checksum != 233;ok diff --git a/tests/py/ip/ip.t.payload b/tests/py/ip/ip.t.payload index 3bd3358f..15cc5904 100644 --- a/tests/py/ip/ip.t.payload +++ b/tests/py/ip/ip.t.payload @@ -204,6 +204,11 @@ ip test-ip4 input [ lookup reg 1 set __set%d ] [ immediate reg 0 accept ] +# ip protocol 255 +ip test-ip4 input + [ payload load 1b @ network header + 9 => reg 1 ] + [ cmp eq reg 1 0x000000ff ] + # ip checksum 13172 drop ip test-ip4 input [ payload load 2b @ network header + 10 => reg 1 ] diff --git a/tests/py/ip/ip.t.payload.inet b/tests/py/ip/ip.t.payload.inet index ef4692e3..e495246e 100644 --- a/tests/py/ip/ip.t.payload.inet +++ b/tests/py/ip/ip.t.payload.inet @@ -268,6 +268,13 @@ inet test-inet input [ lookup reg 1 set __set%d ] [ immediate reg 0 accept ] +# ip protocol 255 +ip test-ip4 input + [ meta load nfproto => reg 1 ] + [ cmp eq reg 1 0x00000002 ] + [ payload load 1b @ network header + 9 => reg 1 ] + [ cmp eq reg 1 0x000000ff ] + # ip checksum 13172 drop inet test-inet input [ meta load nfproto => reg 1 ] diff --git a/tests/py/ip/ip.t.payload.netdev b/tests/py/ip/ip.t.payload.netdev index 4feaa278..8eaee4cf 100644 --- a/tests/py/ip/ip.t.payload.netdev +++ b/tests/py/ip/ip.t.payload.netdev @@ -204,6 +204,13 @@ netdev test-netdev ingress [ lookup reg 1 set __set%d ] [ immediate reg 0 accept ] +# ip protocol 255 +ip test-ip4 input + [ meta load protocol => reg 1 ] + [ cmp eq reg 1 0x00000008 ] + [ payload load 1b @ network header + 9 => reg 1 ] + [ cmp eq reg 1 0x000000ff ] + # ip checksum 13172 drop netdev test-netdev ingress [ meta load protocol => reg 1 ] |