Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cba85b53 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by David S. Miller
Browse files

netfilter: fix export secctx error handling 



In 1ae4de0c, the secctx was exported
via the /proc/net/netfilter/nf_conntrack and ctnetlink interfaces
instead of the secmark.

That patch introduced the use of security_secid_to_secctx() which may
return a non-zero value on error.

In one of my setups, I have NF_CONNTRACK_SECMARK enabled but no
security modules. Thus, security_secid_to_secctx() returns a negative
value that results in the breakage of the /proc and `conntrack -L'
outputs. To fix this, we skip the inclusion of secctx if the
aforementioned function fails.

This patch also fixes the dynamic netlink message size calculation
if security_secid_to_secctx() returns an error, since its logic is
also wrong.

This problem exists in Linux kernel >= 2.6.37.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f682cefa

net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c

+1 −1
Original line number Diff line number Diff line
@@ -97,7 +97,7 @@ static int ct_show_secctx(struct seq_file *s, const struct nf_conn *ct) 


	ret = security_secid_to_secctx(ct->secmark, &secctx, &len);

	if (ret)

		return ret;

		return 0;



	ret = seq_printf(s, "secctx=%s ", secctx);

net/netfilter/nf_conntrack_netlink.c

+14 −11
Original line number Diff line number Diff line
@@ -254,7 +254,7 @@ ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct) 


	ret = security_secid_to_secctx(ct->secmark, &secctx, &len);

	if (ret)

		return ret;

		return 0;



	ret = -1;

	nest_secctx = nla_nest_start(skb, CTA_SECCTX | NLA_F_NESTED);
@@ -453,16 +453,22 @@ ctnetlink_counters_size(const struct nf_conn *ct) 
	       ;

}



#ifdef CONFIG_NF_CONNTRACK_SECMARK

static int ctnetlink_nlmsg_secctx_size(const struct nf_conn *ct)

static inline int

ctnetlink_secctx_size(const struct nf_conn *ct)

{

	int len;

#ifdef CONFIG_NF_CONNTRACK_SECMARK

	int len, ret;



	security_secid_to_secctx(ct->secmark, NULL, &len);

	ret = security_secid_to_secctx(ct->secmark, NULL, &len);

	if (ret)

		return 0;



	return sizeof(char) * len;

}

	return nla_total_size(0) /* CTA_SECCTX */

	       + nla_total_size(sizeof(char) * len); /* CTA_SECCTX_NAME */

#else

	return 0;

#endif

}



static inline size_t

ctnetlink_nlmsg_size(const struct nf_conn *ct)
@@ -479,10 +485,7 @@ ctnetlink_nlmsg_size(const struct nf_conn *ct) 
	       + nla_total_size(0) /* CTA_PROTOINFO */

	       + nla_total_size(0) /* CTA_HELP */

	       + nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */

#ifdef CONFIG_NF_CONNTRACK_SECMARK

	       + nla_total_size(0) /* CTA_SECCTX */

	       + nla_total_size(ctnetlink_nlmsg_secctx_size(ct)) /* CTA_SECCTX_NAME */

#endif

	       + ctnetlink_secctx_size(ct)

#ifdef CONFIG_NF_NAT_NEEDED

	       + 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */

	       + 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */

net/netfilter/nf_conntrack_standalone.c

+1 −1
Original line number Diff line number Diff line
@@ -118,7 +118,7 @@ static int ct_show_secctx(struct seq_file *s, const struct nf_conn *ct) 


	ret = security_secid_to_secctx(ct->secmark, &secctx, &len);

	if (ret)

		return ret;

		return 0;



	ret = seq_printf(s, "secctx=%s ", secctx);