Patchwork nftables: validate port number in inet_service_type_parse

login
register
mail settings
Submitter Phil Oester
Date Aug. 15, 2013, 5:19 p.m.
Message ID <20130815171911.GA15645@linuxace.com>
Download mbox | patch
Permalink /patch/267415/
State Accepted
Headers show

Comments

Phil Oester - Aug. 15, 2013, 5:19 p.m.
At present, nft accepts out of range port values such as in this example:

    nft add rule ip filter input tcp dport 123456 accept 

Attached patch adds checks for both integer overflow and 16 bit overflow,
and avoids getaddrinfo call in the (common) case of digit input. Example
above now produces this output:

    <cmdline>:1:36-41: Error: Service out of range
    add rule ip filter input tcp dport 123456 accept
                                       ^^^^^^

Phil

Signed-off-by: Phil Oester <kernel@linuxace.com>
Pablo Neira - Aug. 17, 2013, 10:29 a.m.
On Thu, Aug 15, 2013 at 10:19:11AM -0700, Phil Oester wrote:
> At present, nft accepts out of range port values such as in this example:
> 
>     nft add rule ip filter input tcp dport 123456 accept 
> 
> Attached patch adds checks for both integer overflow and 16 bit overflow,
> and avoids getaddrinfo call in the (common) case of digit input. Example
> above now produces this output:
> 
>     <cmdline>:1:36-41: Error: Service out of range
>     add rule ip filter input tcp dport 123456 accept
>                                        ^^^^^^

Applied, thanks Phil.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/src/datatype.c b/src/datatype.c
index 55368ee..be32851 100644
--- a/src/datatype.c
+++ b/src/datatype.c
@@ -11,6 +11,7 @@ 
 #include <stdlib.h>
 #include <string.h>
 #include <inttypes.h>
+#include <errno.h>
 #include <netdb.h>
 #include <arpa/inet.h>
 #include <linux/types.h>
@@ -500,18 +501,30 @@  static struct error_record *inet_service_type_parse(const struct expr *sym,
 {
 	struct addrinfo *ai;
 	uint16_t port;
+	uintmax_t i;
 	int err;
+	char *end;
+
+	errno = 0;
+	i = strtoumax(sym->identifier, &end, 0);
+	if (sym->identifier != end && *end == '\0') {
+		if (errno == ERANGE || i > UINT16_MAX)
+			return error(&sym->location, "Service out of range");
+
+		port = i;
+	} else {
+		err = getaddrinfo(NULL, sym->identifier, NULL, &ai);
+		if (err != 0)
+			return error(&sym->location, "Could not resolve service: %s",
+				     gai_strerror(err));
+
+		port = ((struct sockaddr_in *)ai->ai_addr)->sin_port;
+		freeaddrinfo(ai);
+	}
 
-	err = getaddrinfo(NULL, sym->identifier, NULL, &ai);
-	if (err != 0)
-		return error(&sym->location, "Could not resolve service: %s",
-			     gai_strerror(err));
-
-	port = ((struct sockaddr_in *)ai->ai_addr)->sin_port;
 	*res = constant_expr_alloc(&sym->location, &inet_service_type,
 				   BYTEORDER_BIG_ENDIAN,
 				   sizeof(port) * BITS_PER_BYTE, &port);
-	freeaddrinfo(ai);
 	return NULL;
 }