lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

netfilter: fix export secctx error handling

Browse Source 
In 1ae4de0cdf, the secctx was exported
via the /proc/net/netfilter/nf_conntrack and ctnetlink interfaces
instead of the secmark.

That patch introduced the use of security_secid_to_secctx() which may
return a non-zero value on error.

In one of my setups, I have NF_CONNTRACK_SECMARK enabled but no
security modules. Thus, security_secid_to_secctx() returns a negative
value that results in the breakage of the /proc and `conntrack -L'
outputs. To fix this, we skip the inclusion of secctx if the
aforementioned function fails.

This patch also fixes the dynamic netlink message size calculation
if security_secid_to_secctx() returns an error, since its logic is
also wrong.

This problem exists in Linux kernel >= 2.6.37.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Pablo Neira Ayuso
2011-01-06 11:25:00 -08:00
committed by David S. Miller
parent f682cefa5a
commit cba85b532e
3 changed files with 16 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
View File

@@ -97,7 +97,7 @@ static int ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
ret = security_secid_to_secctx(ct->secmark, &secctx, &len); ret = security_secid_to_secctx(ct->secmark, &secctx, &len);
if (ret) if (ret)
return ret; return 0;
ret = seq_printf(s, "secctx=%s ", secctx); ret = seq_printf(s, "secctx=%s ", secctx);

25
net/netfilter/nf_conntrack_netlink.c
View File

@@ -254,7 +254,7 @@ ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct)
ret = security_secid_to_secctx(ct->secmark, &secctx, &len); ret = security_secid_to_secctx(ct->secmark, &secctx, &len);
if (ret) if (ret)
return ret; return 0;
ret = -1; ret = -1;
nest_secctx = nla_nest_start(skb, CTA_SECCTX | NLA_F_NESTED); nest_secctx = nla_nest_start(skb, CTA_SECCTX | NLA_F_NESTED);
@@ -453,16 +453,22 @@ ctnetlink_counters_size(const struct nf_conn *ct)
; ;
} }
#ifdef CONFIG_NF_CONNTRACK_SECMARK static inline int
static int ctnetlink_nlmsg_secctx_size(const struct nf_conn *ct) ctnetlink_secctx_size(const struct nf_conn *ct)
{ {
int len; #ifdef CONFIG_NF_CONNTRACK_SECMARK
int len, ret;
security_secid_to_secctx(ct->secmark, NULL, &len); ret = security_secid_to_secctx(ct->secmark, NULL, &len);
if (ret)
return 0;
return sizeof(char) * len; return nla_total_size(0) /* CTA_SECCTX */
} + nla_total_size(sizeof(char) * len); /* CTA_SECCTX_NAME */
#else
return 0;
#endif #endif
}
static inline size_t static inline size_t
ctnetlink_nlmsg_size(const struct nf_conn *ct) ctnetlink_nlmsg_size(const struct nf_conn *ct)
@@ -479,10 +485,7 @@ ctnetlink_nlmsg_size(const struct nf_conn *ct)
+ nla_total_size(0) /* CTA_PROTOINFO */ + nla_total_size(0) /* CTA_PROTOINFO */
+ nla_total_size(0) /* CTA_HELP */ + nla_total_size(0) /* CTA_HELP */
+ nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */ + nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */
#ifdef CONFIG_NF_CONNTRACK_SECMARK + ctnetlink_secctx_size(ct)
+ nla_total_size(0) /* CTA_SECCTX */
+ nla_total_size(ctnetlink_nlmsg_secctx_size(ct)) /* CTA_SECCTX_NAME */
#endif
#ifdef CONFIG_NF_NAT_NEEDED #ifdef CONFIG_NF_NAT_NEEDED
+ 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */ + 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */
+ 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */ + 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */

2
net/netfilter/nf_conntrack_standalone.c
View File

@@ -118,7 +118,7 @@ static int ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
ret = security_secid_to_secctx(ct->secmark, &secctx, &len); ret = security_secid_to_secctx(ct->secmark, &secctx, &len);
if (ret) if (ret)
return ret; return 0;
ret = seq_printf(s, "secctx=%s ", secctx); ret = seq_printf(s, "secctx=%s ", secctx);