lkml.org 
[lkml]   [2022]   [Sep]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 066/148] netfilter: nf_conntrack_sip: fix ct_sip_walk_headers
    Date
    From: Igor Ryzhov <iryzhov@nfware.com>

    [ Upstream commit 39aebedeaaa95757f5c1f2ddb5f43fdddbf478ca ]

    ct_sip_next_header and ct_sip_get_header return an absolute
    value of matchoff, not a shift from current dataoff.
    So dataoff should be assigned matchoff, not incremented by it.

    This issue can be seen in the scenario when there are multiple
    Contact headers and the first one is using a hostname and other headers
    use IP addresses. In this case, ct_sip_walk_headers will work as follows:

    The first ct_sip_get_header call to will find the first Contact header
    but will return -1 as the header uses a hostname. But matchoff will
    be changed to the offset of this header. After that, dataoff should be
    set to matchoff, so that the next ct_sip_get_header call find the next
    Contact header. But instead of assigning dataoff to matchoff, it is
    incremented by it, which is not correct, as matchoff is an absolute
    value of the offset. So on the next call to the ct_sip_get_header,
    dataoff will be incorrect, and the next Contact header may not be
    found at all.

    Fixes: 05e3ced297fe ("[NETFILTER]: nf_conntrack_sip: introduce SIP-URI parsing helper")
    Signed-off-by: Igor Ryzhov <iryzhov@nfware.com>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/netfilter/nf_conntrack_sip.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
    index b83dc9bf0a5d..78fd9122b70c 100644
    --- a/net/netfilter/nf_conntrack_sip.c
    +++ b/net/netfilter/nf_conntrack_sip.c
    @@ -477,7 +477,7 @@ static int ct_sip_walk_headers(const struct nf_conn *ct, const char *dptr,
    return ret;
    if (ret == 0)
    break;
    - dataoff += *matchoff;
    + dataoff = *matchoff;
    }
    *in_header = 0;
    }
    @@ -489,7 +489,7 @@ static int ct_sip_walk_headers(const struct nf_conn *ct, const char *dptr,
    break;
    if (ret == 0)
    return ret;
    - dataoff += *matchoff;
    + dataoff = *matchoff;
    }

    if (in_header)
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-09-26 13:21    [W:2.846 / U:1.076 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site