Received: by 2002:a05:6a10:a0d1:0:0:0:0 with SMTP id j17csp243083pxa; Tue, 4 Aug 2020 04:38:05 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzv5Ss4kMMfHYQjI7CfHX5fz/fD1zTGZ7M54bc0DRv0JbBBO4hou/PY1QB47TJeDI5rK8sS X-Received: by 2002:a17:906:3a51:: with SMTP id a17mr20986702ejf.433.1596541085171; Tue, 04 Aug 2020 04:38:05 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1596541085; cv=none; d=google.com; s=arc-20160816; b=gI9u+TtXn8/9p2qDaUf4c/PFUwbbnAQqXYjHsy8S5elv9KuBJ2hzwyThUCbgRvGFgw Q5gXxYKFlUKI7tkm/q/ia3tZqtjk+XEfziYZqZFynMbDiLZJMEI43TjfIk94graLzJrB 2yo4rwdzX81VoeKZqLEvhknh+fxA7NnGw6iGrKR3itSo8RbEdpEvosVSxnT91oBAGa4X izOtrAmJF1blKJQV3PV9AeB1EMHZVgkl8I4ehWeTQJIELIjmsXt6l1PQrEYFrqvcQvAy eQAye+4ifK4/XsHEMDBMuy6oEAY4QsIqwtRy24sV7oyCNytliz4GAc3o1UW5yd+oRqwh iY5g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:user-agent:in-reply-to :content-disposition:mime-version:references:message-id:subject:cc :to:from:date; bh=Ia7dtEJdAftl/ub+FVUvh15jdapteC9oupsm0rKQUbg=; b=OQEwQcVna18CB25MeyKKM+tgFick9bal/iWGC48Mgz1QjxshKBF9suDsa0iga1Tq+L k/baHwS8P7J/lO3styxTaD+uoPCTi92Rj3D2YQGZxnLAyk+cEdJmmuVWbw8/Tl2AgS/P jffmBxfIxFeIPawDWM6i7XnMLwCf1JTZUl5GjlFS26oGVUkUlcLUoROVrFqjTb1BMnP5 2OdiCTx5o5BCsamA6iPvzpFy0KgJPARWho1SSO7rezFnytF+qZAcYIknVcLr3prVml+3 s74BdaaAMcjGSbY0JIK2LWfXn/P42YCtEZzoVhciMZ+JFYDESa4kZPoeSbib030N/zyp rOwA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id f16si13671907edy.386.2020.08.04.04.37.41; Tue, 04 Aug 2020 04:38:05 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728902AbgHDLhU (ORCPT + 99 others); Tue, 4 Aug 2020 07:37:20 -0400 Received: from correo.us.es ([193.147.175.20]:57980 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728157AbgHDLhT (ORCPT ); Tue, 4 Aug 2020 07:37:19 -0400 Received: from antivirus1-rhel7.int (unknown [192.168.2.11]) by mail.us.es (Postfix) with ESMTP id CDAD7F2DED for ; Tue, 4 Aug 2020 13:37:17 +0200 (CEST) Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id BFB36DA853 for ; Tue, 4 Aug 2020 13:37:17 +0200 (CEST) Received: by antivirus1-rhel7.int (Postfix, from userid 99) id AF996DA84B; Tue, 4 Aug 2020 13:37:17 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on antivirus1-rhel7.int X-Spam-Level: X-Spam-Status: No, score=-108.2 required=7.5 tests=ALL_TRUSTED,BAYES_50, SMTPAUTH_US2,USER_IN_WELCOMELIST,USER_IN_WHITELIST autolearn=disabled version=3.4.1 Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id 76A96DA73D; Tue, 4 Aug 2020 13:37:15 +0200 (CEST) Received: from 192.168.1.97 (192.168.1.97) by antivirus1-rhel7.int (F-Secure/fsigk_smtp/550/antivirus1-rhel7.int); Tue, 04 Aug 2020 13:37:15 +0200 (CEST) X-Virus-Status: clean(F-Secure/fsigk_smtp/550/antivirus1-rhel7.int) Received: from us.es (unknown [213.143.49.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: 1984lsi) by entrada.int (Postfix) with ESMTPSA id EF7F042EE38E; Tue, 4 Aug 2020 13:37:14 +0200 (CEST) Date: Tue, 4 Aug 2020 13:37:11 +0200 X-SMTPAUTHUS: auth mail.us.es From: Pablo Neira Ayuso To: William Mcvicker Cc: security@kernel.org, Jozsef Kadlecsik , Florian Westphal , "David S. Miller" , Alexey Kuznetsov , Hideaki YOSHIFUJI , netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-team@android.com, stable@vger.kernel.org Subject: Re: [PATCH v2 1/1] netfilter: nat: add a range check for l3/l4 protonum Message-ID: <20200804113711.GA20988@salvia> References: <20200727175720.4022402-1-willmcvicker@google.com> <20200727175720.4022402-2-willmcvicker@google.com> <20200729214607.GA30831@salvia> <20200731002611.GA1035680@google.com> <20200731175115.GA16982@salvia> <20200731181633.GA1209076@google.com> <20200803183156.GA3084830@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20200803183156.GA3084830@google.com> User-Agent: Mutt/1.10.1 (2018-07-13) X-Virus-Scanned: ClamAV using ClamSMTP Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi, This patch is much smaller and if you confirm this is address the issue, then this is awesome. On Mon, Aug 03, 2020 at 06:31:56PM +0000, William Mcvicker wrote: [...] > diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c > index 31fa94064a62..56d310f8b29a 100644 > --- a/net/netfilter/nf_conntrack_netlink.c > +++ b/net/netfilter/nf_conntrack_netlink.c > @@ -1129,6 +1129,8 @@ ctnetlink_parse_tuple(const struct nlattr * const cda[], > if (!tb[CTA_TUPLE_IP]) > return -EINVAL; > > + if (l3num >= NFPROTO_NUMPROTO) > + return -EINVAL; l3num can only be either NFPROTO_IPV4 or NFPROTO_IPV6. Other than that, bail out with EOPNOTSUPP. Thank you.