[{"id":3684833,"web_url":"http://patchwork.ozlabs.org/comment/3684833/","msgid":"","list_archive_url":null,"date":"2026-04-30T16:21:24","subject":"Re: [PATCH net-next 2/2] netfilter: nf_conntrack_amanda: reject port\n values above 65535","submitter":{"id":1315,"url":"http://patchwork.ozlabs.org/api/people/1315/","name":"Pablo Neira Ayuso","email":"pablo@netfilter.org"},"content":"Hi,\n\nOn Thu, Apr 30, 2026 at 09:45:15PM +0530, HACKE-RC wrote:\n> amanda_help() converts the result of simple_strtoul() to __be16 via\n> htons() without checking the parsed value fits in 16 bits. The\n> existing len > 5 guard limits strings to five digits, capping the\n> parseable range at 99999, but values 65536-99999 still silently\n> truncate on the htons() conversion.\n> \n> Use an intermediate unsigned long and reject out-of-range values\n> before converting to network byte order.\n> \n> Fixes: 16958900578b (\"[NETFILTER]: nf_conntrack/nf_nat: add amanda helper port\")\n> Signed-off-by: HACKE-RC \n> ---\n> net/netfilter/nf_conntrack_amanda.c | 10 ++++++----\n> 1 file changed, 6 insertions(+), 4 deletions(-)\n> \n> diff --git a/net/netfilter/nf_conntrack_amanda.c b/net/netfilter/nf_conntrack_amanda.c\n> index d2c09e8dd..58d6c9f29 100644\n> --- a/net/netfilter/nf_conntrack_amanda.c\n> +++ b/net/netfilter/nf_conntrack_amanda.c\n> @@ -88,11 +88,12 @@ static int amanda_help(struct sk_buff *skb,\n> \tstruct nf_conntrack_expect *exp;\n> \tstruct nf_conntrack_tuple *tuple;\n> \tunsigned int dataoff, start, stop, off, i;\n> +\tnf_nat_amanda_hook_fn *nf_nat_amanda;\n> \tchar pbuf[sizeof(\"65535\")], *tmp;\n> +\tunsigned long parsed_port;\n> +\tint ret = NF_ACCEPT;\n> \tu_int16_t len;\n> \t__be16 port;\n> -\tint ret = NF_ACCEPT;\n> -\tnf_nat_amanda_hook_fn *nf_nat_amanda;\n> \n> \t/* Only look at packets from the Amanda server */\n> \tif (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL)\n> @@ -132,10 +133,11 @@ static int amanda_help(struct sk_buff *skb,\n> \t\t\tbreak;\n> \t\tpbuf[len] = '\\0';\n> \n> -\t\tport = htons(simple_strtoul(pbuf, &tmp, 10));\n> +\t\tparsed_port = simple_strtoul(pbuf, &tmp, 10);\n\nWhile being here, I would replace this simple_strtoul by a parser\nwhich does not rely on nul-terminated strings.\n\nA similar patch went in for the sip helper recently, maybe you can\njust take such function to parse ports, move it to the\nnf_conntrack_helper core so it can be shared by helpers.\n\n> \t\tlen = tmp - pbuf;\n> -\t\tif (port == 0 || len > 5)\n> +\t\tif (parsed_port == 0 || parsed_port > 65535 || len > 5)\n> \t\t\tbreak;\n> +\t\tport = htons(parsed_port);\n> \n> \t\texp = nf_ct_expect_alloc(ct);\n> \t\tif (exp == NULL) {\n> -- \n> 2.54.0\n>","headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=netfilter.org header.i=@netfilter.org\n header.a=rsa-sha256 header.s=2025 header.b=Dhc0qfwc;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c15:e001:75::12fc:5321; helo=sin.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-12346-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org\n header.b=\"Dhc0qfwc\"","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=217.70.190.124","smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=netfilter.org","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=netfilter.org"],"Received":["from sin.lore.kernel.org (sin.lore.kernel.org\n [IPv6:2600:3c15:e001:75::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g604r3T8vz1yHZ\n\tfor ; Fri, 01 May 2026 02:29:48 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sin.lore.kernel.org (Postfix) with ESMTP id E036930374C4\n\tfor ; Thu, 30 Apr 2026 16:21:33 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id B446E4657F3;\n\tThu, 30 Apr 2026 16:21:30 +0000 (UTC)","from mail.netfilter.org (mail.netfilter.org [217.70.190.124])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 0B20834D4CC;\n\tThu, 30 Apr 2026 16:21:28 +0000 (UTC)","from netfilter.org (mail-agni [217.70.190.124])\n\tby mail.netfilter.org (Postfix) with UTF8SMTPSA id 24C1460265;\n\tThu, 30 Apr 2026 18:21:27 +0200 (CEST)"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1777566090; cv=none;\n b=QaflLQO9SMTvwR6EdXskiqT+e7WI8vzGPsyFa7d1gR0LAm2F/2J9txHMIRZt8bYc6josEu8Py9nLBen+77fuq9ePqL1AcQqhJ39yH6FvoyS9TPFiOZoLxh5TpvyoeDC/GScTQvgx4jXJJcX8dumUx5rua/oTcKOj5+AKU2/V2XE=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1777566090; c=relaxed/simple;\n\tbh=ai6+QVjyr+hlKt887iNpLWeIMLjufD7i076g2yHFK6o=;\n\th=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version:\n\t Content-Type:Content-Disposition:In-Reply-To;\n b=TP/Lu5J1aD/0/pJZPs+TnEORvt24Y6ZB5Wwz3xBDxMdfat+2ykFo1xBIQotU+RteZg/Dpqdh4vU+PYiUiTHqhiPWorABxq1ceJHVXBkW2cO+4Ip5Fnv/2NqO0NBPGh1SjoSDRVgrp1QVdHeHQKr/tNy8bs4poiXbdNqL4YQoHuQ=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=netfilter.org;\n spf=pass smtp.mailfrom=netfilter.org;\n dkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org\n header.b=Dhc0qfwc; arc=none smtp.client-ip=217.70.190.124","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=netfilter.org;\n\ts=2025; t=1777566087;\n\tbh=Mfb7idhAW77GRVWo14Dge1zqfEz94ADSCClG6QGYrks=;\n\th=Date:From:To:Cc:Subject:References:In-Reply-To:From;\n\tb=Dhc0qfwc9o+8SlyGPFA59cNGDTXu1D+rO/uLDn+KBFAKIZbB7yho60O6ELKIabmtA\n\t zMfNXyRxtMtKsvOI7cWYtDhVkqMUnnn0VLOF0mGr9SB5MR2gMWR1/fiBr+4nFyn6tA\n\t al65FDDAQqZhSKMSfl3YSCC3kd9mXahZD0CUcRXr5kLi9q6Jo8yDORheVNUjwE+nNM\n\t q+Y1YbVOUDTh98dkuHhzet+2KrKnpUW6Qm1CnEwODVkfgF+O3bpmGm9dsFjSvgBzQF\n\t V+IQyTb2nIJtCvYtCvoc93Rak0xVzZ/0WzVdY+gwtTyl9fShvAF9fKT0PEfdmQ66ye\n\t GE7nmIxSBSvfQ==","Date":"Thu, 30 Apr 2026 18:21:24 +0200","From":"Pablo Neira Ayuso ","To":"HACKE-RC ","Cc":"Florian Westphal , Phil Sutter ,\n\t\"David S . Miller\" ,\n\tEric Dumazet ,\n\tJakub Kicinski , Paolo Abeni ,\n\tSimon Horman , netfilter-devel@vger.kernel.org,\n\tcoreteam@netfilter.org, netdev@vger.kernel.org,\n\tlinux-kernel@vger.kernel.org","Subject":"Re: [PATCH net-next 2/2] netfilter: nf_conntrack_amanda: reject port\n values above 65535","Message-ID":"","References":"<20260430161515.3449513-3-rc@rexion.ai>","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","Content-Type":"text/plain; charset=utf-8","Content-Disposition":"inline","In-Reply-To":"<20260430161515.3449513-3-rc@rexion.ai>"}}]