Patch "netfilter: nf_conntrack_sip: fix ct_sip_walk_headers" has been added to the 5.4-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    netfilter: nf_conntrack_sip: fix ct_sip_walk_headers

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     netfilter-nf_conntrack_sip-fix-ct_sip_walk_headers.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit c2afdc6a165d3592b116170a62125ff94f37d61d
Author: Igor Ryzhov <iryzhov@xxxxxxxxxx>
Date:   Wed Jun 5 12:32:40 2019 +0300

    netfilter: nf_conntrack_sip: fix ct_sip_walk_headers
    
    [ Upstream commit 39aebedeaaa95757f5c1f2ddb5f43fdddbf478ca ]
    
    ct_sip_next_header and ct_sip_get_header return an absolute
    value of matchoff, not a shift from current dataoff.
    So dataoff should be assigned matchoff, not incremented by it.
    
    This issue can be seen in the scenario when there are multiple
    Contact headers and the first one is using a hostname and other headers
    use IP addresses. In this case, ct_sip_walk_headers will work as follows:
    
    The first ct_sip_get_header call to will find the first Contact header
    but will return -1 as the header uses a hostname. But matchoff will
    be changed to the offset of this header. After that, dataoff should be
    set to matchoff, so that the next ct_sip_get_header call find the next
    Contact header. But instead of assigning dataoff to matchoff, it is
    incremented by it, which is not correct, as matchoff is an absolute
    value of the offset. So on the next call to the ct_sip_get_header,
    dataoff will be incorrect, and the next Contact header may not be
    found at all.
    
    Fixes: 05e3ced297fe ("[NETFILTER]: nf_conntrack_sip: introduce SIP-URI parsing helper")
    Signed-off-by: Igor Ryzhov <iryzhov@xxxxxxxxxx>
    Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index b83dc9bf0a5d..78fd9122b70c 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -477,7 +477,7 @@ static int ct_sip_walk_headers(const struct nf_conn *ct, const char *dptr,
 				return ret;
 			if (ret == 0)
 				break;
-			dataoff += *matchoff;
+			dataoff = *matchoff;
 		}
 		*in_header = 0;
 	}
@@ -489,7 +489,7 @@ static int ct_sip_walk_headers(const struct nf_conn *ct, const char *dptr,
 			break;
 		if (ret == 0)
 			return ret;
-		dataoff += *matchoff;
+		dataoff = *matchoff;
 	}
 
 	if (in_header)



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux