diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2012-06-18 17:29:53 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2012-06-19 01:24:52 +0200 |
| commit | 32f5376003920a8bc1bd97c6cddcf42df0b6a833 (patch) | |
| tree | e88905596468131aa76f99709a1c4e6972f529b6 | |
| parent | fd7462de461949e36d70f5b0bc17b98c5a00729c (diff) | |
| download | kernel_goldelico_gta04-32f5376003920a8bc1bd97c6cddcf42df0b6a833.zip kernel_goldelico_gta04-32f5376003920a8bc1bd97c6cddcf42df0b6a833.tar.gz kernel_goldelico_gta04-32f5376003920a8bc1bd97c6cddcf42df0b6a833.tar.bz2 | |
netfilter: nf_ct_helper: disable automatic helper re-assignment of different type
This patch modifies __nf_ct_try_assign_helper in a way that invalidates support
for the following scenario:
1) attach the helper A for first time when the conntrack is created
2) attach new (different) helper B due to changes the reply tuple caused by NAT
eg. port redirection from TCP/21 to TCP/5060 with both FTP and SIP helpers
loaded, which seems to be a quite unorthodox scenario.
I can provide a more elaborated patch to support this scenario but explicit
helper attachment provides a better solution for this since now the use can
attach the helpers consistently, without relying on the automatic helper
lookup magic.
This patch fixes a possible out of bound zeroing of the conntrack helper
extension if the helper B uses more memory for its private data than
helper A.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| -rw-r--r-- | net/netfilter/nf_conntrack_helper.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c index 2918ec2..c4bc637 100644 --- a/net/netfilter/nf_conntrack_helper.c +++ b/net/netfilter/nf_conntrack_helper.c @@ -229,7 +229,13 @@ int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl, goto out; } } else { - memset(help->data, 0, helper->data_len); + /* We only allow helper re-assignment of the same sort since + * we cannot reallocate the helper extension area. + */ + if (help->helper != helper) { + RCU_INIT_POINTER(help->helper, NULL); + goto out; + } } rcu_assign_pointer(help->helper, helper); |