Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 93052169 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'master' of git://1984.lsi.us.es/nf 

Pablo Neira Ayuso say:

====================
The following patchset contains four updates for your net tree, they are:

* Fix crash on timewait sockets, since the TCP early demux was added,
  in nfnetlink_log, from Eric Dumazet.

* Fix broken syslog log-level for xt_LOG and ebt_log since printk format was
  converted from <.> to a 2 bytes pattern using ASCII SOH, from Joe Perches.

* Two security fixes for the TCP connection tracking targeting off-path attacks,
  from Jozsef Kadlecsik. The problem was discovered by Jan Wrobel and it is
  documented in: http://mixedbit.org/reflection_scan/reflection_scan.pdf

.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents bdfc87f7 16af511a

net/bridge/netfilter/ebt_log.c

+1 −1
Original line number Diff line number Diff line
@@ -80,7 +80,7 @@ ebt_log_packet(u_int8_t pf, unsigned int hooknum, 
	unsigned int bitmask;



	spin_lock_bh(&ebt_log_lock);

	printk("<%c>%s IN=%s OUT=%s MAC source = %pM MAC dest = %pM proto = 0x%04x",

	printk(KERN_SOH "%c%s IN=%s OUT=%s MAC source = %pM MAC dest = %pM proto = 0x%04x",

	       '0' + loginfo->u.log.level, prefix,

	       in ? in->name : "", out ? out->name : "",

	       eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest,

net/netfilter/nf_conntrack_proto_tcp.c

+10 −19
Original line number Diff line number Diff line
@@ -158,21 +158,18 @@ static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = { 
 *	sCL -> sSS

 */

/* 	     sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2	*/

/*synack*/ { sIV, sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG, sSR },

/*synack*/ { sIV, sIV, sSR, sIV, sIV, sIV, sIV, sIV, sIV, sSR },

/*

 *	sNO -> sIV	Too late and no reason to do anything

 *	sSS -> sIV	Client can't send SYN and then SYN/ACK

 *	sS2 -> sSR	SYN/ACK sent to SYN2 in simultaneous open

 *	sSR -> sIG

 *	sES -> sIG	Error: SYNs in window outside the SYN_SENT state

 *			are errors. Receiver will reply with RST

 *			and close the connection.

 *			Or we are not in sync and hold a dead connection.

 *	sFW -> sIG

 *	sCW -> sIG

 *	sLA -> sIG

 *	sTW -> sIG

 *	sCL -> sIG

 *	sSR -> sSR	Late retransmitted SYN/ACK in simultaneous open

 *	sES -> sIV	Invalid SYN/ACK packets sent by the client

 *	sFW -> sIV

 *	sCW -> sIV

 *	sLA -> sIV

 *	sTW -> sIV

 *	sCL -> sIV

 */

/* 	     sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2	*/

/*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
@@ -633,15 +630,9 @@ static bool tcp_in_window(const struct nf_conn *ct, 
		ack = sack = receiver->td_end;

	}



	if (seq == end

	    && (!tcph->rst

		|| (seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)))

	if (tcph->rst && seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)

		/*

		 * Packets contains no data: we assume it is valid

		 * and check the ack value only.

		 * However RST segments are always validated by their

		 * SEQ number, except when seq == 0 (reset sent answering

		 * SYN.

		 * RST sent answering SYN.

		 */

		seq = end = sender->td_end;

net/netfilter/nfnetlink_log.c

+8 −6
Original line number Diff line number Diff line
@@ -381,6 +381,7 @@ __build_packet_message(struct nfulnl_instance *inst, 
	struct nlmsghdr *nlh;

	struct nfgenmsg *nfmsg;

	sk_buff_data_t old_tail = inst->skb->tail;

	struct sock *sk;



	nlh = nlmsg_put(inst->skb, 0, 0,

			NFNL_SUBSYS_ULOG << 8 | NFULNL_MSG_PACKET,
@@ -499,18 +500,19 @@ __build_packet_message(struct nfulnl_instance *inst, 
	}



	/* UID */

	if (skb->sk) {

		read_lock_bh(&skb->sk->sk_callback_lock);

		if (skb->sk->sk_socket && skb->sk->sk_socket->file) {

			struct file *file = skb->sk->sk_socket->file;

	sk = skb->sk;

	if (sk && sk->sk_state != TCP_TIME_WAIT) {

		read_lock_bh(&sk->sk_callback_lock);

		if (sk->sk_socket && sk->sk_socket->file) {

			struct file *file = sk->sk_socket->file;

			__be32 uid = htonl(file->f_cred->fsuid);

			__be32 gid = htonl(file->f_cred->fsgid);

			read_unlock_bh(&skb->sk->sk_callback_lock);

			read_unlock_bh(&sk->sk_callback_lock);

			if (nla_put_be32(inst->skb, NFULA_UID, uid) ||

			    nla_put_be32(inst->skb, NFULA_GID, gid))

				goto nla_put_failure;

		} else

			read_unlock_bh(&skb->sk->sk_callback_lock);

			read_unlock_bh(&sk->sk_callback_lock);

	}



	/* local sequence number */

net/netfilter/xt_LOG.c

+19 −18
Original line number Diff line number Diff line
@@ -145,6 +145,19 @@ static int dump_tcp_header(struct sbuff *m, const struct sk_buff *skb, 
	return 0;

}



static void dump_sk_uid_gid(struct sbuff *m, struct sock *sk)

{

	if (!sk || sk->sk_state == TCP_TIME_WAIT)

		return;



	read_lock_bh(&sk->sk_callback_lock);

	if (sk->sk_socket && sk->sk_socket->file)

		sb_add(m, "UID=%u GID=%u ",

			sk->sk_socket->file->f_cred->fsuid,

			sk->sk_socket->file->f_cred->fsgid);

	read_unlock_bh(&sk->sk_callback_lock);

}



/* One level of recursion won't kill us */

static void dump_ipv4_packet(struct sbuff *m,

			const struct nf_loginfo *info,
@@ -361,14 +374,8 @@ static void dump_ipv4_packet(struct sbuff *m, 
	}



	/* Max length: 15 "UID=4294967295 " */

	if ((logflags & XT_LOG_UID) && !iphoff && skb->sk) {

		read_lock_bh(&skb->sk->sk_callback_lock);

		if (skb->sk->sk_socket && skb->sk->sk_socket->file)

			sb_add(m, "UID=%u GID=%u ",

				skb->sk->sk_socket->file->f_cred->fsuid,

				skb->sk->sk_socket->file->f_cred->fsgid);

		read_unlock_bh(&skb->sk->sk_callback_lock);

	}

	if ((logflags & XT_LOG_UID) && !iphoff)

		dump_sk_uid_gid(m, skb->sk);



	/* Max length: 16 "MARK=0xFFFFFFFF " */

	if (!iphoff && skb->mark)
@@ -436,8 +443,8 @@ log_packet_common(struct sbuff *m, 
		  const struct nf_loginfo *loginfo,

		  const char *prefix)

{

	sb_add(m, "<%d>%sIN=%s OUT=%s ", loginfo->u.log.level,

	       prefix,

	sb_add(m, KERN_SOH "%c%sIN=%s OUT=%s ",

	       '0' + loginfo->u.log.level, prefix,

	       in ? in->name : "",

	       out ? out->name : "");

#ifdef CONFIG_BRIDGE_NETFILTER
@@ -717,14 +724,8 @@ static void dump_ipv6_packet(struct sbuff *m, 
	}



	/* Max length: 15 "UID=4294967295 " */

	if ((logflags & XT_LOG_UID) && recurse && skb->sk) {

		read_lock_bh(&skb->sk->sk_callback_lock);

		if (skb->sk->sk_socket && skb->sk->sk_socket->file)

			sb_add(m, "UID=%u GID=%u ",

				skb->sk->sk_socket->file->f_cred->fsuid,

				skb->sk->sk_socket->file->f_cred->fsgid);

		read_unlock_bh(&skb->sk->sk_callback_lock);

	}

	if ((logflags & XT_LOG_UID) && recurse)

		dump_sk_uid_gid(m, skb->sk);



	/* Max length: 16 "MARK=0xFFFFFFFF " */

	if (!recurse && skb->mark)