lkml.org 
[lkml]   [2022]   [Aug]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.19 195/365] netfilter: nf_ct_irc: cap packet search space to 4k
    Date
    From: Florian Westphal <fw@strlen.de>

    commit 976bf59c69cd2e2c17f0ab20a14c0e700cba0f15 upstream.

    This uses a pseudo-linearization scheme with a 64k global buffer,
    but BIG TCP arrival means IPv6 TCP stack can generate skbs
    that exceed this size.

    In practice, IRC commands are not expected to exceed 512 bytes, plus
    this is interactive protocol, so we should not see large packets
    in practice.

    Given most IRC connections nowadays use TLS so this helper could also be
    removed in the near future.

    Fixes: 7c4e983c4f3c ("net: allow gso_max_size to exceed 65536")
    Fixes: 0fe79f28bfaf ("net: allow gro_max_size to exceed 65536")
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/netfilter/nf_conntrack_irc.c | 12 +++++++++---
    1 file changed, 9 insertions(+), 3 deletions(-)

    diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
    index 08ee4e760a3d..1796c456ac98 100644
    --- a/net/netfilter/nf_conntrack_irc.c
    +++ b/net/netfilter/nf_conntrack_irc.c
    @@ -39,6 +39,7 @@ unsigned int (*nf_nat_irc_hook)(struct sk_buff *skb,
    EXPORT_SYMBOL_GPL(nf_nat_irc_hook);

    #define HELPER_NAME "irc"
    +#define MAX_SEARCH_SIZE 4095

    MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
    MODULE_DESCRIPTION("IRC (DCC) connection tracking helper");
    @@ -121,6 +122,7 @@ static int help(struct sk_buff *skb, unsigned int protoff,
    int i, ret = NF_ACCEPT;
    char *addr_beg_p, *addr_end_p;
    typeof(nf_nat_irc_hook) nf_nat_irc;
    + unsigned int datalen;

    /* If packet is coming from IRC server */
    if (dir == IP_CT_DIR_REPLY)
    @@ -140,8 +142,12 @@ static int help(struct sk_buff *skb, unsigned int protoff,
    if (dataoff >= skb->len)
    return NF_ACCEPT;

    + datalen = skb->len - dataoff;
    + if (datalen > MAX_SEARCH_SIZE)
    + datalen = MAX_SEARCH_SIZE;
    +
    spin_lock_bh(&irc_buffer_lock);
    - ib_ptr = skb_header_pointer(skb, dataoff, skb->len - dataoff,
    + ib_ptr = skb_header_pointer(skb, dataoff, datalen,
    irc_buffer);
    if (!ib_ptr) {
    spin_unlock_bh(&irc_buffer_lock);
    @@ -149,7 +155,7 @@ static int help(struct sk_buff *skb, unsigned int protoff,
    }

    data = ib_ptr;
    - data_limit = ib_ptr + skb->len - dataoff;
    + data_limit = ib_ptr + datalen;

    /* strlen("\1DCC SENT t AAAAAAAA P\1\n")=24
    * 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */
    @@ -251,7 +257,7 @@ static int __init nf_conntrack_irc_init(void)
    irc_exp_policy.max_expected = max_dcc_channels;
    irc_exp_policy.timeout = dcc_timeout;

    - irc_buffer = kmalloc(65536, GFP_KERNEL);
    + irc_buffer = kmalloc(MAX_SEARCH_SIZE + 1, GFP_KERNEL);
    if (!irc_buffer)
    return -ENOMEM;

    --
    2.37.2


    \
     
     \ /
      Last update: 2022-08-23 10:48    [W:3.911 / U:0.112 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site