summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorFlorian Westphal <fw@strlen.de>2016-06-06 21:52:28 +0200
committerFlorian Westphal <fw@strlen.de>2016-06-07 00:54:22 +0200
commit3503738f77cdbe521da1054a37f59ac2e442b4cf (patch)
tree144d072b8baee81558c1334b47c5d7186d888f2c
parentba145d3ee951c5c90cd00bb317f06ddbb0451539 (diff)
payload: don't update protocol context if we can't find a description
Since commit 20b1131c07acd2fc ("payload: fix stacked headers protocol context tracking") we deref null pointer if we can't find a description for the desired protocol, so "ip protocol 254" crashes while testing protocols 6 or 17 (tcp, udp) works. Also add a test case for this. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1072 Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
-rw-r--r--src/payload.c3
-rw-r--r--tests/py/ip/ip.t3
-rw-r--r--tests/py/ip/ip.t.payload5
-rw-r--r--tests/py/ip/ip.t.payload.inet7
-rw-r--r--tests/py/ip/ip.t.payload.netdev7
5 files changed, 25 insertions, 0 deletions
diff --git a/src/payload.c b/src/payload.c
index ac0e917a..9ba980a5 100644
--- a/src/payload.c
+++ b/src/payload.c
@@ -85,6 +85,9 @@ static void payload_expr_pctx_update(struct proto_ctx *ctx,
base = ctx->protocol[left->payload.base].desc;
desc = proto_find_upper(base, proto);
+ if (!desc)
+ return;
+
assert(desc->base <= PROTO_BASE_MAX);
if (desc->base == base->base) {
assert(base->length > 0);
diff --git a/tests/py/ip/ip.t b/tests/py/ip/ip.t
index 594136cb..a265b757 100644
--- a/tests/py/ip/ip.t
+++ b/tests/py/ip/ip.t
@@ -75,6 +75,9 @@ ip protocol != tcp;ok;ip protocol != 6
ip protocol { icmp, esp, ah, comp, udp, udplite, tcp, dccp, sctp} accept;ok;ip protocol { 33, 136, 17, 51, 50, 6, 132, 1, 108} accept
- ip protocol != { icmp, esp, ah, comp, udp, udplite, tcp, dccp, sctp} accept;ok
+ip protocol 255;ok
+ip protocol 256;fail
+
ip checksum 13172 drop;ok
ip checksum 22;ok
ip checksum != 233;ok
diff --git a/tests/py/ip/ip.t.payload b/tests/py/ip/ip.t.payload
index 3bd3358f..15cc5904 100644
--- a/tests/py/ip/ip.t.payload
+++ b/tests/py/ip/ip.t.payload
@@ -204,6 +204,11 @@ ip test-ip4 input
[ lookup reg 1 set __set%d ]
[ immediate reg 0 accept ]
+# ip protocol 255
+ip test-ip4 input
+ [ payload load 1b @ network header + 9 => reg 1 ]
+ [ cmp eq reg 1 0x000000ff ]
+
# ip checksum 13172 drop
ip test-ip4 input
[ payload load 2b @ network header + 10 => reg 1 ]
diff --git a/tests/py/ip/ip.t.payload.inet b/tests/py/ip/ip.t.payload.inet
index ef4692e3..e495246e 100644
--- a/tests/py/ip/ip.t.payload.inet
+++ b/tests/py/ip/ip.t.payload.inet
@@ -268,6 +268,13 @@ inet test-inet input
[ lookup reg 1 set __set%d ]
[ immediate reg 0 accept ]
+# ip protocol 255
+ip test-ip4 input
+ [ meta load nfproto => reg 1 ]
+ [ cmp eq reg 1 0x00000002 ]
+ [ payload load 1b @ network header + 9 => reg 1 ]
+ [ cmp eq reg 1 0x000000ff ]
+
# ip checksum 13172 drop
inet test-inet input
[ meta load nfproto => reg 1 ]
diff --git a/tests/py/ip/ip.t.payload.netdev b/tests/py/ip/ip.t.payload.netdev
index 4feaa278..8eaee4cf 100644
--- a/tests/py/ip/ip.t.payload.netdev
+++ b/tests/py/ip/ip.t.payload.netdev
@@ -204,6 +204,13 @@ netdev test-netdev ingress
[ lookup reg 1 set __set%d ]
[ immediate reg 0 accept ]
+# ip protocol 255
+ip test-ip4 input
+ [ meta load protocol => reg 1 ]
+ [ cmp eq reg 1 0x00000008 ]
+ [ payload load 1b @ network header + 9 => reg 1 ]
+ [ cmp eq reg 1 0x000000ff ]
+
# ip checksum 13172 drop
netdev test-netdev ingress
[ meta load protocol => reg 1 ]