| Message ID | 20211210153127.i7kqadosjgw6qiqp@zenon.in.qult.net |
|---|---|
| State | Accepted |
| Delegated to: | Pablo Neira |
| Headers | show |
| Series | [v3] netfilter: fix regression in looped (broad|multi)cast's MAC handling | expand |
On Fri, Dec 10, 2021 at 04:31:27PM +0100, Ignacy Gawędzki wrote: > In commit 5648b5e1169f ("netfilter: nfnetlink_queue: fix OOB when mac > header was cleared"), the test for non-empty MAC header introduced in > commit 2c38de4c1f8da7 ("netfilter: fix looped (broad|multi)cast's MAC > handling") has been replaced with a test for a set MAC header. > > This breaks the case when the MAC header has been reset (using > skb_reset_mac_header), as is the case with looped-back multicast > packets. As a result, the packets ending up in NFQUEUE get a bogus > hwaddr interpreted from the first bytes of the IP header. > > This patch adds a test for a non-empty MAC header in addition to the > test for a set MAC header. The same two tests are also implemented in > nfnetlink_log.c, where the initial code of commit 2c38de4c1f8da7 > ("netfilter: fix looped (broad|multi)cast's MAC handling") has not been > touched, but where supposedly the same situation may happen. Applied to nf, thanks
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c index 691ef4cffdd9..7f83f9697fc1 100644 --- a/net/netfilter/nfnetlink_log.c +++ b/net/netfilter/nfnetlink_log.c @@ -556,7 +556,8 @@ __build_packet_message(struct nfnl_log_net *log, goto nla_put_failure; if (indev && skb->dev && - skb->mac_header != skb->network_header) { + skb_mac_header_was_set(skb) && + skb_mac_header_len(skb) != 0) { struct nfulnl_msg_packet_hw phw; int len; diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c index 4acc4b8e9fe5..959527708e38 100644 --- a/net/netfilter/nfnetlink_queue.c +++ b/net/netfilter/nfnetlink_queue.c @@ -560,7 +560,8 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, goto nla_put_failure; if (indev && entskb->dev && - skb_mac_header_was_set(entskb)) { + skb_mac_header_was_set(entskb) && + skb_mac_header_len(entskb) != 0) { struct nfqnl_msg_packet_hw phw; int len;
In commit 5648b5e1169f ("netfilter: nfnetlink_queue: fix OOB when mac header was cleared"), the test for non-empty MAC header introduced in commit 2c38de4c1f8da7 ("netfilter: fix looped (broad|multi)cast's MAC handling") has been replaced with a test for a set MAC header. This breaks the case when the MAC header has been reset (using skb_reset_mac_header), as is the case with looped-back multicast packets. As a result, the packets ending up in NFQUEUE get a bogus hwaddr interpreted from the first bytes of the IP header. This patch adds a test for a non-empty MAC header in addition to the test for a set MAC header. The same two tests are also implemented in nfnetlink_log.c, where the initial code of commit 2c38de4c1f8da7 ("netfilter: fix looped (broad|multi)cast's MAC handling") has not been touched, but where supposedly the same situation may happen. Fixes: 5648b5e1169f ("netfilter: nfnetlink_queue: fix OOB when mac header was cleared") Signed-off-by: Ignacy Gawędzki <ignacy.gawedzki@green-communications.fr> Reviewed-by: Florian Westphal <fw@strlen.de> --- changelog: v3: reword commit message again v2: reword commit message net/netfilter/nfnetlink_log.c | 3 ++- net/netfilter/nfnetlink_queue.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)