Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c1e7dc91 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: nfnetlink_log: fix maximum packet length logged to userspace 



don't try to queue payloads > 0xffff - NLA_HDRLEN, it does not work.
The nla length includes the size of the nla struct, so anything larger
results in u16 integer overflow.

This patch is similar to
9cefbbc9 (netfilter: nfnetlink_queue: cleanup copy_range usage).

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 9dfa1dfe

net/netfilter/nfnetlink_log.c

+5 −3
Original line number Diff line number Diff line
@@ -43,7 +43,8 @@ 
#define NFULNL_NLBUFSIZ_DEFAULT	NLMSG_GOODSIZE

#define NFULNL_TIMEOUT_DEFAULT 	100	/* every second */

#define NFULNL_QTHRESH_DEFAULT 	100	/* 100 packets */

#define NFULNL_COPY_RANGE_MAX	0xFFFF	/* max packet size is limited by 16-bit struct nfattr nfa_len field */

/* max packet size is limited by 16-bit struct nfattr nfa_len field */

#define NFULNL_COPY_RANGE_MAX	(0xFFFF - NLA_HDRLEN)



#define PRINTR(x, args...)	do { if (net_ratelimit()) \

				     printk(x, ## args); } while (0);
@@ -252,6 +253,8 @@ nfulnl_set_mode(struct nfulnl_instance *inst, u_int8_t mode, 


	case NFULNL_COPY_PACKET:

		inst->copy_mode = mode;

		if (range == 0)

			range = NFULNL_COPY_RANGE_MAX;

		inst->copy_range = min_t(unsigned int,

					 range, NFULNL_COPY_RANGE_MAX);

		break;
@@ -679,8 +682,7 @@ nfulnl_log_packet(struct net *net, 
		break;



	case NFULNL_COPY_PACKET:

		if (inst->copy_range == 0

		    || inst->copy_range > skb->len)

		if (inst->copy_range > skb->len)

			data_len = skb->len;

		else

			data_len = inst->copy_range;