[PATCH nf-next] netfilter: nf_conntrack_expect: bail out on insert dead expectations
Pablo Neira Ayuso <[email protected]>
| Newsgroups | gmane.comp.security.firewalls.netfilter.devel |
|---|---|
| Message-ID | <[email protected]> |
If the NF_CT_EXPECT_DEAD expectation flag is set on, bail out on
insertion. Moreover, add also DEBUG_NET_WARN_ON_ONCE() since this should
not ever happen. This is hardening commit b8b09dc2bf35 ("netfilter:
nf_conntrack_expect: use conntrack GC to reap expectations").
Signed-off-by: Pablo Neira Ayuso <[email protected]>
---
Based on a patch recently posted on the ML.
net/netfilter/nf_conntrack_expect.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 10b130a7b230..f1f0c582db5d 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -528,6 +528,12 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect,
int ret;
spin_lock_bh(&nf_conntrack_expect_lock);
+ if (expect->flags & NF_CT_EXPECT_DEAD) {
+ DEBUG_NET_WARN_ON_ONCE(1);
+ ret = -EINVAL;
+ goto out;
+ }
+
master_help = nfct_help(expect->master);
if (!master_help) {
ret = -ESHUTDOWN;
--
2.47.3