lkml.org 
[lkml]   [2017]   [Feb]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 173/306] netfilter: nf_conntrack_sip: extend request line validation
    3.16.40-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Ulrich Weber <ulrich.weber@riverbed.com>

    commit 444f901742d054a4cd5ff045871eac5131646cfb upstream.

    on SIP requests, so a fragmented TCP SIP packet from an allow header starting with
    INVITE,NOTIFY,OPTIONS,REFER,REGISTER,UPDATE,SUBSCRIBE
    Content-Length: 0

    will not bet interpreted as an INVITE request. Also Request-URI must start with an alphabetic character.

    Confirm with RFC 3261
    Request-Line = Method SP Request-URI SP SIP-Version CRLF

    Fixes: 30f33e6dee80 ("[NETFILTER]: nf_conntrack_sip: support method specific request/response handling")
    Signed-off-by: Ulrich Weber <ulrich.weber@riverbed.com>
    Acked-by: Marco Angaroni <marcoangaroni@gmail.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    [bwh: Backported to 3.16: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    net/netfilter/nf_conntrack_sip.c | 5 ++++-
    1 file changed, 4 insertions(+), 1 deletion(-)

    --- a/net/netfilter/nf_conntrack_sip.c
    +++ b/net/netfilter/nf_conntrack_sip.c
    @@ -1434,9 +1434,12 @@ static int process_sip_request(struct sk
    handler = &sip_handlers[i];
    if (handler->request == NULL)
    continue;
    - if (*datalen < handler->len ||
    + if (*datalen < handler->len + 2 ||
    strnicmp(*dptr, handler->method, handler->len))
    continue;
    + if ((*dptr)[handler->len] != ' ' ||
    + !isalpha((*dptr)[handler->len+1]))
    + continue;

    if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CSEQ,
    &matchoff, &matchlen) <= 0) {
    \
     
     \ /
      Last update: 2017-02-16 00:52    [W:4.023 / U:0.176 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site