adulau/aha
1
0
Fork 0
mirror of https://github.com/adulau/aha.git synced 2025-01-04 07:03:38 +00:00
Code Issues Projects Releases Packages Wiki Activity

[NETFILTER]: Fix another crash in ip_nat_pptp

Browse source 
The PPTP NAT helper calculates the offset at which the packet needs
to be mangled as difference between two pointers to the header. With
non-linear skbs however the pointers may point to two seperate buffers
on the stack and the calculation results in a wrong offset beeing
used.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Patrick McHardy 2006-01-09 16:44:00 -08:00 committed by David S. Miller
parent 15db34702c
commit 03b9feca89
1 changed files with 27 additions and 30 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

57
net/ipv4/netfilter/ip_nat_helper_pptp.c
View file

@ -148,14 +148,14 @@ pptp_outbound_pkt(struct sk_buff **pskb,
{ {
struct ip_ct_pptp_master *ct_pptp_info = &ct->help.ct_pptp_info; struct ip_ct_pptp_master *ct_pptp_info = &ct->help.ct_pptp_info;
struct ip_nat_pptp *nat_pptp_info = &ct->nat.help.nat_pptp_info; struct ip_nat_pptp *nat_pptp_info = &ct->nat.help.nat_pptp_info;
u_int16_t msg, new_callid;
u_int16_t msg, *cid = NULL, new_callid; unsigned int cid_off;
new_callid = htons(ct_pptp_info->pns_call_id); new_callid = htons(ct_pptp_info->pns_call_id);
switch (msg = ntohs(ctlh->messageType)) { switch (msg = ntohs(ctlh->messageType)) {
case PPTP_OUT_CALL_REQUEST: case PPTP_OUT_CALL_REQUEST:
cid = &pptpReq->ocreq.callID; cid_off = offsetof(union pptp_ctrl_union, ocreq.callID);
/* FIXME: ideally we would want to reserve a call ID /* FIXME: ideally we would want to reserve a call ID
* here. current netfilter NAT core is not able to do * here. current netfilter NAT core is not able to do
* this :( For now we use TCP source port. This breaks * this :( For now we use TCP source port. This breaks
@ -172,10 +172,10 @@ pptp_outbound_pkt(struct sk_buff **pskb,
ct_pptp_info->pns_call_id = ntohs(new_callid); ct_pptp_info->pns_call_id = ntohs(new_callid);
break; break;
case PPTP_IN_CALL_REPLY: case PPTP_IN_CALL_REPLY:
cid = &pptpReq->icreq.callID; cid_off = offsetof(union pptp_ctrl_union, icreq.callID);
break; break;
case PPTP_CALL_CLEAR_REQUEST: case PPTP_CALL_CLEAR_REQUEST:
cid = &pptpReq->clrreq.callID; cid_off = offsetof(union pptp_ctrl_union, clrreq.callID);
break; break;
default: default:
DEBUGP("unknown outbound packet 0x%04x:%s\n", msg, DEBUGP("unknown outbound packet 0x%04x:%s\n", msg,
@ -197,18 +197,15 @@ pptp_outbound_pkt(struct sk_buff **pskb,
/* only OUT_CALL_REQUEST, IN_CALL_REPLY, CALL_CLEAR_REQUEST pass /* only OUT_CALL_REQUEST, IN_CALL_REPLY, CALL_CLEAR_REQUEST pass
* down to here */ * down to here */
IP_NF_ASSERT(cid);
DEBUGP("altering call id from 0x%04x to 0x%04x\n", DEBUGP("altering call id from 0x%04x to 0x%04x\n",
ntohs(*cid), ntohs(new_callid)); ntohs(*(u_int16_t *)pptpReq + cid_off), ntohs(new_callid));
/* mangle packet */ /* mangle packet */
if (ip_nat_mangle_tcp_packet(pskb, ct, ctinfo, if (ip_nat_mangle_tcp_packet(pskb, ct, ctinfo,
(void *)cid - ((void *)ctlh - sizeof(struct pptp_pkt_hdr)), cid_off + sizeof(struct pptp_pkt_hdr) +
sizeof(new_callid), sizeof(struct PptpControlHeader),
(char *)&new_callid, sizeof(new_callid), (char *)&new_callid,
sizeof(new_callid)) == 0) sizeof(new_callid)) == 0)
return NF_DROP; return NF_DROP;
return NF_ACCEPT; return NF_ACCEPT;
@ -299,7 +296,8 @@ pptp_inbound_pkt(struct sk_buff **pskb,
union pptp_ctrl_union *pptpReq) union pptp_ctrl_union *pptpReq)
{ {
struct ip_nat_pptp *nat_pptp_info = &ct->nat.help.nat_pptp_info; struct ip_nat_pptp *nat_pptp_info = &ct->nat.help.nat_pptp_info;
u_int16_t msg, new_cid = 0, new_pcid, *pcid = NULL, *cid = NULL; u_int16_t msg, new_cid = 0, new_pcid;
unsigned int pcid_off, cid_off = 0;
int ret = NF_ACCEPT, rv; int ret = NF_ACCEPT, rv;
@ -307,23 +305,23 @@ pptp_inbound_pkt(struct sk_buff **pskb,
switch (msg = ntohs(ctlh->messageType)) { switch (msg = ntohs(ctlh->messageType)) {
case PPTP_OUT_CALL_REPLY: case PPTP_OUT_CALL_REPLY:
pcid = &pptpReq->ocack.peersCallID; pcid_off = offsetof(union pptp_ctrl_union, ocack.peersCallID);
cid = &pptpReq->ocack.callID; cid_off = offsetof(union pptp_ctrl_union, ocack.callID);
break; break;
case PPTP_IN_CALL_CONNECT: case PPTP_IN_CALL_CONNECT:
pcid = &pptpReq->iccon.peersCallID; pcid_off = offsetof(union pptp_ctrl_union, iccon.peersCallID);
break; break;
case PPTP_IN_CALL_REQUEST: case PPTP_IN_CALL_REQUEST:
/* only need to nat in case PAC is behind NAT box */ /* only need to nat in case PAC is behind NAT box */
return NF_ACCEPT; return NF_ACCEPT;
case PPTP_WAN_ERROR_NOTIFY: case PPTP_WAN_ERROR_NOTIFY:
pcid = &pptpReq->wanerr.peersCallID; pcid_off = offsetof(union pptp_ctrl_union, wanerr.peersCallID);
break; break;
case PPTP_CALL_DISCONNECT_NOTIFY: case PPTP_CALL_DISCONNECT_NOTIFY:
pcid = &pptpReq->disc.callID; pcid_off = offsetof(union pptp_ctrl_union, disc.callID);
break; break;
case PPTP_SET_LINK_INFO: case PPTP_SET_LINK_INFO:
pcid = &pptpReq->setlink.peersCallID; pcid_off = offsetof(union pptp_ctrl_union, setlink.peersCallID);
break; break;
default: default:
@ -345,25 +343,24 @@ pptp_inbound_pkt(struct sk_buff **pskb,
* WAN_ERROR_NOTIFY, CALL_DISCONNECT_NOTIFY pass down here */ * WAN_ERROR_NOTIFY, CALL_DISCONNECT_NOTIFY pass down here */
/* mangle packet */ /* mangle packet */
IP_NF_ASSERT(pcid);
DEBUGP("altering peer call id from 0x%04x to 0x%04x\n", DEBUGP("altering peer call id from 0x%04x to 0x%04x\n",
ntohs(*pcid), ntohs(new_pcid)); ntohs(*(u_int16_t *)pptpReq + pcid_off), ntohs(new_pcid));
rv = ip_nat_mangle_tcp_packet(pskb, ct, ctinfo, rv = ip_nat_mangle_tcp_packet(pskb, ct, ctinfo,
(void *)pcid - ((void *)ctlh - sizeof(struct pptp_pkt_hdr)), pcid_off + sizeof(struct pptp_pkt_hdr) +
sizeof(struct PptpControlHeader),
sizeof(new_pcid), (char *)&new_pcid, sizeof(new_pcid), (char *)&new_pcid,
sizeof(new_pcid)); sizeof(new_pcid));
if (rv != NF_ACCEPT) if (rv != NF_ACCEPT)
return rv; return rv;
if (new_cid) { if (new_cid) {
IP_NF_ASSERT(cid);
DEBUGP("altering call id from 0x%04x to 0x%04x\n", DEBUGP("altering call id from 0x%04x to 0x%04x\n",
ntohs(*cid), ntohs(new_cid)); ntohs(*(u_int16_t *)pptpReq + cid_off), ntohs(new_cid));
rv = ip_nat_mangle_tcp_packet(pskb, ct, ctinfo, rv = ip_nat_mangle_tcp_packet(pskb, ct, ctinfo,
(void *)cid - ((void *)ctlh - sizeof(struct pptp_pkt_hdr)), cid_off + sizeof(struct pptp_pkt_hdr) +
sizeof(new_cid), sizeof(struct PptpControlHeader),
(char *)&new_cid, sizeof(new_cid), (char *)&new_cid,
sizeof(new_cid)); sizeof(new_cid));
if (rv != NF_ACCEPT) if (rv != NF_ACCEPT)
return rv; return rv;