Skip to content

Commit

Permalink
netfilter: ipset: Fix wraparound in hash:*net* types
Browse files Browse the repository at this point in the history 
Fix wraparound bug which could lead to memory exhaustion when adding an
x.x.x.x-255.255.255.255 range to any hash:*net* types.

Fixes Netfilter's bugzilla id #1212, reported by Thomas Schwark.

Fixes: 48596a8 ("netfilter: ipset: Fix adding an IPv4 range containing more than 2^31 addresses")
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  • Loading branch information
Jozsef Kadlecsik authored and Pablo Neira Ayuso committed Jan 31, 2018
1 parent da17c73 commit 0b8d907
Show file tree
Hide file tree
Showing 6 changed files with 63 additions and 63 deletions.
26 changes: 13 additions & 13 deletions net/netfilter/ipset/ip_set_hash_ipportnet.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -168,7 +168,7 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
struct hash_ipportnet4_elem e = { .cidr = HOST_MASK - 1 };
struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
u32 ip = 0, ip_to = 0, p = 0, port, port_to;
u32 ip2_from = 0, ip2_to = 0, ip2_last, ip2;
u32 ip2_from = 0, ip2_to = 0, ip2;
bool with_ports = false;
u8 cidr;
int ret;
Expand Down Expand Up @@ -269,32 +269,32 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
ip_set_mask_from_to(ip2_from, ip2_to, e.cidr + 1);
}

if (retried)
if (retried) {
ip = ntohl(h->next.ip);
p = ntohs(h->next.port);
ip2 = ntohl(h->next.ip2);
} else {
p = port;
ip2 = ip2_from;
}
for (; ip <= ip_to; ip++) {
e.ip = htonl(ip);
p = retried && ip == ntohl(h->next.ip) ? ntohs(h->next.port)
: port;
for (; p <= port_to; p++) {
e.port = htons(p);
ip2 = retried &&
ip == ntohl(h->next.ip) &&
p == ntohs(h->next.port)
? ntohl(h->next.ip2) : ip2_from;
while (ip2 <= ip2_to) {
do {
e.ip2 = htonl(ip2);
ip2_last = ip_set_range_to_cidr(ip2, ip2_to,
&cidr);
ip2 = ip_set_range_to_cidr(ip2, ip2_to, &cidr);
e.cidr = cidr - 1;
ret = adtfn(set, &e, &ext, &ext, flags);

if (ret && !ip_set_eexist(ret, flags))
return ret;

ret = 0;
ip2 = ip2_last + 1;
}
} while (ip2++ < ip2_to);
ip2 = ip2_from;
}
p = port;
}
return ret;
}
Expand Down
9 changes: 4 additions & 5 deletions net/netfilter/ipset/ip_set_hash_net.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,7 @@ hash_net4_uadt(struct ip_set *set, struct nlattr *tb[],
ipset_adtfn adtfn = set->variant->adt[adt];
struct hash_net4_elem e = { .cidr = HOST_MASK };
struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
u32 ip = 0, ip_to = 0, last;
u32 ip = 0, ip_to = 0;
int ret;

if (tb[IPSET_ATTR_LINENO])
Expand Down Expand Up @@ -193,16 +193,15 @@ hash_net4_uadt(struct ip_set *set, struct nlattr *tb[],
}
if (retried)
ip = ntohl(h->next.ip);
while (ip <= ip_to) {
do {
e.ip = htonl(ip);
last = ip_set_range_to_cidr(ip, ip_to, &e.cidr);
ip = ip_set_range_to_cidr(ip, ip_to, &e.cidr);
ret = adtfn(set, &e, &ext, &ext, flags);
if (ret && !ip_set_eexist(ret, flags))
return ret;

ret = 0;
ip = last + 1;
}
} while (ip++ < ip_to);
return ret;
}

Expand Down
9 changes: 4 additions & 5 deletions net/netfilter/ipset/ip_set_hash_netiface.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -200,7 +200,7 @@ hash_netiface4_uadt(struct ip_set *set, struct nlattr *tb[],
ipset_adtfn adtfn = set->variant->adt[adt];
struct hash_netiface4_elem e = { .cidr = HOST_MASK, .elem = 1 };
struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
u32 ip = 0, ip_to = 0, last;
u32 ip = 0, ip_to = 0;
int ret;

if (tb[IPSET_ATTR_LINENO])
Expand Down Expand Up @@ -255,17 +255,16 @@ hash_netiface4_uadt(struct ip_set *set, struct nlattr *tb[],

if (retried)
ip = ntohl(h->next.ip);
while (ip <= ip_to) {
do {
e.ip = htonl(ip);
last = ip_set_range_to_cidr(ip, ip_to, &e.cidr);
ip = ip_set_range_to_cidr(ip, ip_to, &e.cidr);
ret = adtfn(set, &e, &ext, &ext, flags);

if (ret && !ip_set_eexist(ret, flags))
return ret;

ret = 0;
ip = last + 1;
}
} while (ip++ < ip_to);
return ret;
}

Expand Down
28 changes: 14 additions & 14 deletions net/netfilter/ipset/ip_set_hash_netnet.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -169,8 +169,8 @@ hash_netnet4_uadt(struct ip_set *set, struct nlattr *tb[],
ipset_adtfn adtfn = set->variant->adt[adt];
struct hash_netnet4_elem e = { };
struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
u32 ip = 0, ip_to = 0, last;
u32 ip2 = 0, ip2_from = 0, ip2_to = 0, last2;
u32 ip = 0, ip_to = 0;
u32 ip2 = 0, ip2_from = 0, ip2_to = 0;
int ret;

if (tb[IPSET_ATTR_LINENO])
Expand Down Expand Up @@ -247,27 +247,27 @@ hash_netnet4_uadt(struct ip_set *set, struct nlattr *tb[],
ip_set_mask_from_to(ip2_from, ip2_to, e.cidr[1]);
}

if (retried)
if (retried) {
ip = ntohl(h->next.ip[0]);
ip2 = ntohl(h->next.ip[1]);
} else {
ip2 = ip2_from;
}

while (ip <= ip_to) {
do {
e.ip[0] = htonl(ip);
last = ip_set_range_to_cidr(ip, ip_to, &e.cidr[0]);
ip2 = (retried &&
ip == ntohl(h->next.ip[0])) ? ntohl(h->next.ip[1])
: ip2_from;
while (ip2 <= ip2_to) {
ip = ip_set_range_to_cidr(ip, ip_to, &e.cidr[0]);
do {
e.ip[1] = htonl(ip2);
last2 = ip_set_range_to_cidr(ip2, ip2_to, &e.cidr[1]);
ip2 = ip_set_range_to_cidr(ip2, ip2_to, &e.cidr[1]);
ret = adtfn(set, &e, &ext, &ext, flags);
if (ret && !ip_set_eexist(ret, flags))
return ret;

ret = 0;
ip2 = last2 + 1;
}
ip = last + 1;
}
} while (ip2++ < ip2_to);
ip2 = ip2_from;
} while (ip++ < ip_to);
return ret;
}

Expand Down
19 changes: 10 additions & 9 deletions net/netfilter/ipset/ip_set_hash_netport.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -161,7 +161,7 @@ hash_netport4_uadt(struct ip_set *set, struct nlattr *tb[],
ipset_adtfn adtfn = set->variant->adt[adt];
struct hash_netport4_elem e = { .cidr = HOST_MASK - 1 };
struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
u32 port, port_to, p = 0, ip = 0, ip_to = 0, last;
u32 port, port_to, p = 0, ip = 0, ip_to = 0;
bool with_ports = false;
u8 cidr;
int ret;
Expand Down Expand Up @@ -239,25 +239,26 @@ hash_netport4_uadt(struct ip_set *set, struct nlattr *tb[],
ip_set_mask_from_to(ip, ip_to, e.cidr + 1);
}

if (retried)
if (retried) {
ip = ntohl(h->next.ip);
while (ip <= ip_to) {
p = ntohs(h->next.port);
} else {
p = port;
}
do {
e.ip = htonl(ip);
last = ip_set_range_to_cidr(ip, ip_to, &cidr);
ip = ip_set_range_to_cidr(ip, ip_to, &cidr);
e.cidr = cidr - 1;
p = retried && ip == ntohl(h->next.ip) ? ntohs(h->next.port)
: port;
for (; p <= port_to; p++) {
e.port = htons(p);
ret = adtfn(set, &e, &ext, &ext, flags);

if (ret && !ip_set_eexist(ret, flags))
return ret;

ret = 0;
}
ip = last + 1;
}
p = port;
} while (ip++ < ip_to);
return ret;
}

Expand Down
35 changes: 18 additions & 17 deletions net/netfilter/ipset/ip_set_hash_netportnet.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -184,8 +184,8 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
ipset_adtfn adtfn = set->variant->adt[adt];
struct hash_netportnet4_elem e = { };
struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
u32 ip = 0, ip_to = 0, ip_last, p = 0, port, port_to;
u32 ip2_from = 0, ip2_to = 0, ip2_last, ip2;
u32 ip = 0, ip_to = 0, p = 0, port, port_to;
u32 ip2_from = 0, ip2_to = 0, ip2;
bool with_ports = false;
int ret;

Expand Down Expand Up @@ -288,33 +288,34 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
ip_set_mask_from_to(ip2_from, ip2_to, e.cidr[1]);
}

if (retried)
if (retried) {
ip = ntohl(h->next.ip[0]);
p = ntohs(h->next.port);
ip2 = ntohl(h->next.ip[1]);
} else {
p = port;
ip2 = ip2_from;
}

while (ip <= ip_to) {
do {
e.ip[0] = htonl(ip);
ip_last = ip_set_range_to_cidr(ip, ip_to, &e.cidr[0]);
p = retried && ip == ntohl(h->next.ip[0]) ? ntohs(h->next.port)
: port;
ip = ip_set_range_to_cidr(ip, ip_to, &e.cidr[0]);
for (; p <= port_to; p++) {
e.port = htons(p);
ip2 = (retried && ip == ntohl(h->next.ip[0]) &&
p == ntohs(h->next.port)) ? ntohl(h->next.ip[1])
: ip2_from;
while (ip2 <= ip2_to) {
do {
e.ip[1] = htonl(ip2);
ip2_last = ip_set_range_to_cidr(ip2, ip2_to,
&e.cidr[1]);
ip2 = ip_set_range_to_cidr(ip2, ip2_to,
&e.cidr[1]);
ret = adtfn(set, &e, &ext, &ext, flags);
if (ret && !ip_set_eexist(ret, flags))
return ret;

ret = 0;
ip2 = ip2_last + 1;
}
} while (ip2++ < ip2_to);
ip2 = ip2_from;
}
ip = ip_last + 1;
}
p = port;
} while (ip++ < ip_to);
return ret;
}

Expand Down

0 comments on commit 0b8d907

Please sign in to comment.