Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 96fffb4f authored by Phil Sutter's avatar Phil Sutter Committed by Pablo Neira Ayuso
Browse files

netfilter: ip6t_SYNPROXY: fix NULL pointer dereference 



This happens when networking namespaces are enabled.

Suggested-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarPhil Sutter <phil@nwl.cc>
Acked-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent f58e5aa7

net/ipv6/netfilter/ip6t_SYNPROXY.c

+10 −8
Original line number Diff line number Diff line
@@ -37,12 +37,13 @@ synproxy_build_ip(struct sk_buff *skb, const struct in6_addr *saddr, 
}



static void

synproxy_send_tcp(const struct sk_buff *skb, struct sk_buff *nskb,

synproxy_send_tcp(const struct synproxy_net *snet,

		  const struct sk_buff *skb, struct sk_buff *nskb,

		  struct nf_conntrack *nfct, enum ip_conntrack_info ctinfo,

		  struct ipv6hdr *niph, struct tcphdr *nth,

		  unsigned int tcp_hdr_size)

{

	struct net *net = nf_ct_net((struct nf_conn *)nfct);

	struct net *net = nf_ct_net(snet->tmpl);

	struct dst_entry *dst;

	struct flowi6 fl6;
@@ -83,7 +84,8 @@ synproxy_send_tcp(const struct sk_buff *skb, struct sk_buff *nskb, 
}



static void

synproxy_send_client_synack(const struct sk_buff *skb, const struct tcphdr *th,

synproxy_send_client_synack(const struct synproxy_net *snet,

			    const struct sk_buff *skb, const struct tcphdr *th,

			    const struct synproxy_options *opts)

{

	struct sk_buff *nskb;
@@ -119,7 +121,7 @@ synproxy_send_client_synack(const struct sk_buff *skb, const struct tcphdr *th, 


	synproxy_build_options(nth, opts);



	synproxy_send_tcp(skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,

	synproxy_send_tcp(snet, skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,

			  niph, nth, tcp_hdr_size);

}
@@ -163,7 +165,7 @@ synproxy_send_server_syn(const struct synproxy_net *snet, 


	synproxy_build_options(nth, opts);



	synproxy_send_tcp(skb, nskb, &snet->tmpl->ct_general, IP_CT_NEW,

	synproxy_send_tcp(snet, skb, nskb, &snet->tmpl->ct_general, IP_CT_NEW,

			  niph, nth, tcp_hdr_size);

}
@@ -203,7 +205,7 @@ synproxy_send_server_ack(const struct synproxy_net *snet, 


	synproxy_build_options(nth, opts);



	synproxy_send_tcp(skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);

	synproxy_send_tcp(snet, skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);

}



static void
@@ -241,7 +243,7 @@ synproxy_send_client_ack(const struct synproxy_net *snet, 


	synproxy_build_options(nth, opts);



	synproxy_send_tcp(skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);

	synproxy_send_tcp(snet, skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);

}



static bool
@@ -301,7 +303,7 @@ synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par) 
					  XT_SYNPROXY_OPT_SACK_PERM |

					  XT_SYNPROXY_OPT_ECN);



		synproxy_send_client_synack(skb, th, &opts);

		synproxy_send_client_synack(snet, skb, th, &opts);

		return NF_DROP;



	} else if (th->ack && !(th->fin || th->rst || th->syn)) {