{"id":2221971,"url":"http://patchwork.ozlabs.org/api/patches/2221971/?format=json","web_url":"http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260410135733.46391-1-giuseppecaruso0990@gmail.com/","project":{"id":26,"url":"http://patchwork.ozlabs.org/api/projects/26/?format=json","name":"Netfilter Development","link_name":"netfilter-devel","list_id":"netfilter-devel.vger.kernel.org","list_email":"netfilter-devel@vger.kernel.org","web_url":null,"scm_url":null,"webscm_url":null,"list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"<20260410135733.46391-1-giuseppecaruso0990@gmail.com>","list_archive_url":null,"date":"2026-04-10T13:57:33","name":"[1/2] netfilter fix u16 overflow in get_port()","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"91e4c3af9068881850acddca540bc5a467410b03","submitter":{"id":93114,"url":"http://patchwork.ozlabs.org/api/people/93114/?format=json","name":"Cyber-JA","email":"giuseppecaruso0990@gmail.com"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260410135733.46391-1-giuseppecaruso0990@gmail.com/mbox/","series":[{"id":499464,"url":"http://patchwork.ozlabs.org/api/series/499464/?format=json","web_url":"http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=499464","date":"2026-04-10T13:57:33","name":"[1/2] netfilter fix u16 overflow in get_port()","version":1,"mbox":"http://patchwork.ozlabs.org/series/499464/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2221971/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2221971/checks/","tags":{},"related":[],"headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256\n header.s=20251104 header.b=T9DiJryb;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c15:e001:75::12fc:5321; helo=sin.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11812-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com\n header.b=\"T9DiJryb\"","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=209.85.128.47","smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=gmail.com","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=gmail.com"],"Received":["from sin.lore.kernel.org (sin.lore.kernel.org\n [IPv6:2600:3c15:e001:75::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fsdgB3JQ8z1yGS\n\tfor ; Fri, 10 Apr 2026 23:58:14 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sin.lore.kernel.org (Postfix) with ESMTP id 0E72A301B850\n\tfor ; Fri, 10 Apr 2026 13:58:13 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id DEE683C9EDE;\n\tFri, 10 Apr 2026 13:58:09 +0000 (UTC)","from mail-wm1-f47.google.com (mail-wm1-f47.google.com\n [209.85.128.47])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 2421D3A7859\n\tfor ; Fri, 10 Apr 2026 13:58:07 +0000 (UTC)","by mail-wm1-f47.google.com with SMTP id\n 5b1f17b1804b1-488af96f6b2so27190195e9.0\n for ;\n Fri, 10 Apr 2026 06:58:07 -0700 (PDT)","from kali.station (net-2-39-22-72.cust.vodafonedsl.it. [2.39.22.72])\n by smtp.gmail.com with ESMTPSA id\n ffacd0b85a97d-43d63de2e4csm8191131f8f.2.2026.04.10.06.58.05\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Fri, 10 Apr 2026 06:58:05 -0700 (PDT)"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1775829489; cv=none;\n b=XUv/DO/EFke72oq7vtKeI1y7kR0oDuxCizzfkfz82S4NpJN8ztFCv5CBIKndS6xU7qDFuD1bgI0YQLe1jn9Wqmef+cvOdIUtep/i9OiXHrAb+kU6fl8Xm72tColHuBtAocmeeYAJVtXBtRpD5R/+YM4P4aCkytFqYzr7yBA3eyI=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1775829489; c=relaxed/simple;\n\tbh=nw0sjGaCdrAVNDX9xZtQ9srexVTpwmtbQktOyQasq94=;\n\th=From:To:Cc:Subject:Date:Message-ID:MIME-Version;\n b=OOEYuT9LJCOd/ad5KsiqcTVUqFiHtdoOTw+Rjt+F5IOHHQalyaGLqsoJVg8U5KPBtgnDbFqL9+DKyMD2i7s99zCrUOj3MD5Wroz9xEdBhW4hb2ZDmYd1ETdC3Ag50p+PtaznNgB+xS53tjeZ0fx5YyKcBGJMzH7GLPJcUV7L54M=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=gmail.com;\n spf=pass smtp.mailfrom=gmail.com;\n dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com\n header.b=T9DiJryb; arc=none smtp.client-ip=209.85.128.47","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=gmail.com; s=20251104; t=1775829486; x=1776434286;\n darn=vger.kernel.org;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:from:to:cc:subject:date:message-id:reply-to;\n bh=mQfS+t05KHEJMgI3OsZEfkjQUbMQvFG5UKSa2caXMdU=;\n b=T9DiJrybJcCdrzkIEPy/lUN8qg5woQyYZ9zgkQQYlbY4J7MVRcsDd4a/wc8F7YqZtX\n jvDs2kjyW4KNiKDtP0YSybAVeM36RPo449IfEUwjKPHNj/n07h0uDYMRMZDSYHvdLbtq\n 13yW8Egu0EyGrfaqCZyGaKvMiZ/gRF13UeuAJ7AIa1WktZznAt/DNZbL0Z5jagQsXY/K\n ZCaHX7aHZVVZCL8MDmvM6EWfEj04ozSTzlv3VB0YJgZGD3ez1Tup1LdrsmvWggc6ypPk\n ImkZAYlMM/Ls1RzspPE8oyemYZ1sYlyYnypWPtePZQOl93IGzGunfzY7wJYsmqNDPh6W\n mYvA==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1775829486; x=1776434286;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date\n :message-id:reply-to;\n bh=mQfS+t05KHEJMgI3OsZEfkjQUbMQvFG5UKSa2caXMdU=;\n b=MK/QeH8WaswEycMg7iGaAJnlgqOFBpUHs/IhrH5l++IDXqUmCm4qBcDrvvw4GYYP8k\n F8mZek+ZFB8f8HEDAAzzDtXh5kb11G6nBRmzzjXZI2hIGhEp+x6dG8eKk0SQImoPqq+t\n 1hjAv17TzqKMQLuYxsyqryJWJz8hcdTOvHImt3lscpuK0MqeTZzimnb8oGEWtxgEuyuS\n 3YsNGDL9UxPvqh/WybUXq6bwyU1dXeusZW0SmhitQxvB+hu0+IMYgyLVwfHxd0vAtbc4\n TMJzYvwhxsgeTPbB2NIyqPzrtg8K9O1q7NWkdyyWACcQ2ucXnQ9BTFvKZjfqnpc2i15a\n nhlA==","X-Gm-Message-State":"AOJu0YySFg28ji96WNlwEQUaquxnhu5LZizrM42OPC808XeDNsgEx+zL\n\tC22b0DEgm1BhvK/rvpbY4unOri8FwUU6yZdQuDEhti3BB/d4a8W50LCHqwc9m06zQtm22w==","X-Gm-Gg":"AeBDiesnqQkk25z0kL4AZo8aSXxOUnuBiNbOQjFQGf30lRbLYX8PPEfNfTxpeEfBw6V\n\tjdsHbZTfxE9jzpyMzAaNlSn/5mlft+3olDpcNyVAezfjs6Po77yYAQuK7k3JxhdSzOMbc0lJ2ad\n\tWg0Q46uX88AzI8PbUdCEtpr03Tvxo1QThsz8SWpdepTTdvJ7ALKqRPHW53opJ2ScAowmg6BKbZv\n\tivzyyaa6eF/+rAhkaARX2+Rt36g9jNtXb5zi1b1PvLYwxNu9PLTmp69KQdSaKNfUZTYB/rTfQ2O\n\tF5eZiHx09cqSMfVt9FIO+1BJ++KKiRE+IDRzDEWqyHZXBFBe4Kkqrv3x73rtwPhMxK+FKafHuRM\n\tFhtVB+Um+5xCodtggpdg6mEC2SvpfagCKZ9Y1UU1Ox6+lvNdsMhzD1EKn8A48HF79Hh2XNhVlwT\n\td1Xx91F7X2g7e/6VJMvXHui+DTZ+/ivtFkdtEc/zQiJzqY9WahsnGvI4rdRowp3wZOXegZ","X-Received":"by 2002:a05:600c:c171:b0:488:a894:b27a with SMTP id\n 5b1f17b1804b1-488d67f0105mr45254075e9.8.1775829486246;\n Fri, 10 Apr 2026 06:58:06 -0700 (PDT)","From":"Cyber-JA ","To":"netfilter-devel@vger.kernel.org","Cc":"Giuseppe Caruso ","Subject":"[PATCH 1/2] netfilter fix u16 overflow in get_port()","Date":"Fri, 10 Apr 2026 09:57:33 -0400","Message-ID":"<20260410135733.46391-1-giuseppecaruso0990@gmail.com>","X-Mailer":"git-send-email 2.53.0","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit"},"content":"From: Giuseppe Caruso \n\ntry_number() parses comma-separated decimal values from FTP PORT and\nEPRT commands into a u_int32_t array, but does not validate that each\nvalue fits in a single octet. RFC 959 specifies that PORT parameters\nare decimal integers in the range 0-255, representing the four octets\nof an IP address followed by two octets encoding the port number.\n\nValues exceeding 255 are silently accepted. In try_rfc959(), the raw\nu32 values are combined via shift-and-OR to form the IP and port:\n\n cmd->u3.ip = htonl((array[0] << 24) | (array[1] << 16) |\n (array[2] << 8) | array[3]);\n cmd->u.tcp.port = htons((array[4] << 8) | array[5]);\n\nWhen array elements exceed 255, bits from one field bleed into adjacent\nfields after shifting, producing IP addresses and port numbers that\ndiffer from what the text representation suggests. For example,\n\"PORT 10,0,1,2,256,22\" yields port (256<<8)|22 = 65558, truncated to\nu16 = 22. This mismatch between the textual and computed values can\nconfuse network monitoring tools that parse FTP commands independently.\n\nReject the command by returning 0 (no match) when any accumulated\nvalue exceeds 255.\n\nSigned-off-by: Giuseppe Caruso \n---\n net/netfilter/nf_conntrack_ftp.c | 10 ++++++++--\n 1 file changed, 8 insertions(+), 2 deletions(-)","diff":"diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c\nindex 5e00f9123c38..680dd7560ebc 100644\n--- a/net/netfilter/nf_conntrack_ftp.c\n+++ b/net/netfilter/nf_conntrack_ftp.c\n@@ -195,7 +195,7 @@ static int try_rfc1123(const char *data, size_t dlen,\n static int get_port(const char *data, int start, size_t dlen, char delim,\n \t\t __be16 *port)\n {\n-\tu_int16_t tmp_port = 0;\n+\tu_int32_t tmp_port = 0;\n \tint i;\n \n \tfor (i = start; i < dlen; i++) {\n@@ -207,8 +207,14 @@ static int get_port(const char *data, int start, size_t dlen, char delim,\n \t\t\tpr_debug(\"get_port: return %d\\n\", tmp_port);\n \t\t\treturn i + 1;\n \t\t}\n-\t\telse if (data[i] >= '0' && data[i] <= '9')\n+\t\telse if (data[i] >= '0' && data[i] <= '9'){\n \t\t\ttmp_port = tmp_port*10 + data[i] - '0';\n+\t\t\tif (tmp_port > 65535) {\n+\t\t\t\tpr_debug(\"get_port: port %u out of range.\\n\",\n+\t\t\t\t\t tmp_port);\n+\t\t\t\tbreak;\n+\t\t\t}\n+\t\t}\n \t\telse { /* Some other crap */\n \t\t\tpr_debug(\"get_port: invalid char.\\n\");\n \t\t\tbreak;\n","prefixes":["1/2"]}