netfilter: nf_tproxy: fix possible non-linear access to transport header
authorMáté Eckl <ecklm94@gmail.com>
Thu, 5 Jul 2018 10:01:53 +0000 (12:01 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Fri, 6 Jul 2018 12:32:44 +0000 (14:32 +0200)
commit5711b4e89319c2912f20b2a4f371c1525fc9551d
tree002100bf6cd635fefaecb905337d142df28bf9ae
parentd376bef9c29b3c65aeee4e785fffcd97ef0a9a81
netfilter: nf_tproxy: fix possible non-linear access to transport header

This patch fixes a silent out-of-bound read possibility that was present
because of the misuse of this function.

Mostly it was called with a struct udphdr *hp which had only the udphdr
part linearized by the skb_header_pointer, however
nf_tproxy_get_sock_v{4,6} uses it as a tcphdr pointer, so some reads for
tcp specific attributes may be invalid.

Fixes: a583636a83ea ("inet: refactor inet[6]_lookup functions to take skb")
Signed-off-by: Máté Eckl <ecklm94@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
include/net/netfilter/nf_tproxy.h
net/ipv4/netfilter/nf_tproxy_ipv4.c
net/ipv6/netfilter/nf_tproxy_ipv6.c
net/netfilter/xt_TPROXY.c