Commit 917b61fa authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: ctnetlink: ignore explicit helper on new expectations 



Use the existing master conntrack helper, anything else is not really
supported and it just makes validation more complicated, so just ignore
what helper userspace suggests for this expectation.

This was uncovered when validating CTA_EXPECT_CLASS via different helper
provided by userspace than the existing master conntrack helper:

  BUG: KASAN: slab-out-of-bounds in nf_ct_expect_related_report+0x2479/0x27c0
  Read of size 4 at addr ffff8880043fe408 by task poc/102
  Call Trace:
   nf_ct_expect_related_report+0x2479/0x27c0
   ctnetlink_create_expect+0x22b/0x3b0
   ctnetlink_new_expect+0x4bd/0x5c0
   nfnetlink_rcv_msg+0x67a/0x950
   netlink_rcv_skb+0x120/0x350

Allowing to read kernel memory bytes off the expectation boundary.

CTA_EXPECT_HELP_NAME is still used to offer the helper name to userspace
via netlink dump.

Fixes: bd077937 ("netfilter: nfnetlink_queue: allow to attach expectations to conntracks")
Reported-by: default avatarQi Tang <tpluszz77@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 35177c68

net/netfilter/nf_conntrack_netlink.c

+9 −45
Original line number Diff line number Diff line
@@ -2636,7 +2636,6 @@ static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = { 


static struct nf_conntrack_expect *

ctnetlink_alloc_expect(const struct nlattr *const cda[], struct nf_conn *ct,

		       struct nf_conntrack_helper *helper,

		       struct nf_conntrack_tuple *tuple,

		       struct nf_conntrack_tuple *mask);
@@ -2865,7 +2864,6 @@ ctnetlink_glue_attach_expect(const struct nlattr *attr, struct nf_conn *ct, 
{

	struct nlattr *cda[CTA_EXPECT_MAX+1];

	struct nf_conntrack_tuple tuple, mask;

	struct nf_conntrack_helper *helper = NULL;

	struct nf_conntrack_expect *exp;

	int err;
@@ -2879,17 +2877,8 @@ ctnetlink_glue_attach_expect(const struct nlattr *attr, struct nf_conn *ct, 
	if (err < 0)

		return err;



	if (cda[CTA_EXPECT_HELP_NAME]) {

		const char *helpname = nla_data(cda[CTA_EXPECT_HELP_NAME]);



		helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),

						    nf_ct_protonum(ct));

		if (helper == NULL)

			return -EOPNOTSUPP;

	}



	exp = ctnetlink_alloc_expect((const struct nlattr * const *)cda, ct,

				     helper, &tuple, &mask);

				     &tuple, &mask);

	if (IS_ERR(exp))

		return PTR_ERR(exp);
@@ -3528,11 +3517,11 @@ ctnetlink_parse_expect_nat(const struct nlattr *attr, 


static struct nf_conntrack_expect *

ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,

		       struct nf_conntrack_helper *helper,

		       struct nf_conntrack_tuple *tuple,

		       struct nf_conntrack_tuple *mask)

{

	struct net *net = read_pnet(&ct->ct_net);

	struct nf_conntrack_helper *helper;

	struct nf_conntrack_expect *exp;

	struct nf_conn_help *help;

	u32 class = 0;
@@ -3542,7 +3531,11 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct, 
	if (!help)

		return ERR_PTR(-EOPNOTSUPP);



	if (cda[CTA_EXPECT_CLASS] && helper) {

	helper = rcu_dereference(help->helper);

	if (!helper)

		return ERR_PTR(-EOPNOTSUPP);



	if (cda[CTA_EXPECT_CLASS]) {

		class = ntohl(nla_get_be32(cda[CTA_EXPECT_CLASS]));

		if (class > helper->expect_class_max)

			return ERR_PTR(-EINVAL);
@@ -3576,8 +3569,6 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct, 
#ifdef CONFIG_NF_CONNTRACK_ZONES

	exp->zone = ct->zone;

#endif

	if (!helper)

		helper = rcu_dereference(help->helper);

	rcu_assign_pointer(exp->helper, helper);

	exp->tuple = *tuple;

	exp->mask.src.u3 = mask->src.u3;
@@ -3609,7 +3600,6 @@ ctnetlink_create_expect(struct net *net, 
{

	struct nf_conntrack_tuple tuple, mask, master_tuple;

	struct nf_conntrack_tuple_hash *h = NULL;

	struct nf_conntrack_helper *helper = NULL;

	struct nf_conntrack_expect *exp;

	struct nf_conn *ct;

	int err;
@@ -3635,33 +3625,7 @@ ctnetlink_create_expect(struct net *net, 
	ct = nf_ct_tuplehash_to_ctrack(h);



	rcu_read_lock();

	if (cda[CTA_EXPECT_HELP_NAME]) {

		const char *helpname = nla_data(cda[CTA_EXPECT_HELP_NAME]);



		helper = __nf_conntrack_helper_find(helpname, u3,

						    nf_ct_protonum(ct));

		if (helper == NULL) {

			rcu_read_unlock();

#ifdef CONFIG_MODULES

			if (request_module("nfct-helper-%s", helpname) < 0) {

				err = -EOPNOTSUPP;

				goto err_ct;

			}

			rcu_read_lock();

			helper = __nf_conntrack_helper_find(helpname, u3,

							    nf_ct_protonum(ct));

			if (helper) {

				err = -EAGAIN;

				goto err_rcu;

			}

			rcu_read_unlock();

#endif

			err = -EOPNOTSUPP;

			goto err_ct;

		}

	}



	exp = ctnetlink_alloc_expect(cda, ct, helper, &tuple, &mask);

	exp = ctnetlink_alloc_expect(cda, ct, &tuple, &mask);

	if (IS_ERR(exp)) {

		err = PTR_ERR(exp);

		goto err_rcu;
@@ -3671,8 +3635,8 @@ ctnetlink_create_expect(struct net *net, 
	nf_ct_expect_put(exp);

err_rcu:

	rcu_read_unlock();

err_ct:

	nf_ct_put(ct);



	return err;

}