lkml.org 
[lkml]   [2009]   [Apr]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 24/58] netfilter: {ip, ip6, arp}_tables: fix incorrect loop detection
    2.6.27-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Patrick McHardy <kaber@trash.net>

    upstream commit: 1f9352ae2253a97b07b34dcf16ffa3b4ca12c558

    Commit e1b4b9f ([NETFILTER]: {ip,ip6,arp}_tables: fix exponential worst-case
    search for loops) introduced a regression in the loop detection algorithm,
    causing sporadic incorrectly detected loops.

    When a chain has already been visited during the check, it is treated as
    having a standard target containing a RETURN verdict directly at the
    beginning in order to not check it again. The real target of the first
    rule is then incorrectly treated as STANDARD target and checked not to
    contain invalid verdicts.

    Fix by making sure the rule does actually contain a standard target.

    Based on patch by Francis Dupont <Francis_Dupont@isc.org>
    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    ---
    net/ipv4/netfilter/arp_tables.c | 4 +++-
    net/ipv4/netfilter/ip_tables.c | 4 +++-
    net/ipv6/netfilter/ip6_tables.c | 4 +++-
    3 files changed, 9 insertions(+), 3 deletions(-)

    --- a/net/ipv4/netfilter/arp_tables.c
    +++ b/net/ipv4/netfilter/arp_tables.c
    @@ -372,7 +372,9 @@ static int mark_source_chains(struct xt_
    && unconditional(&e->arp)) || visited) {
    unsigned int oldpos, size;

    - if (t->verdict < -NF_MAX_VERDICT - 1) {
    + if ((strcmp(t->target.u.user.name,
    + ARPT_STANDARD_TARGET) == 0) &&
    + t->verdict < -NF_MAX_VERDICT - 1) {
    duprintf("mark_source_chains: bad "
    "negative verdict (%i)\n",
    t->verdict);
    --- a/net/ipv4/netfilter/ip_tables.c
    +++ b/net/ipv4/netfilter/ip_tables.c
    @@ -502,7 +502,9 @@ mark_source_chains(struct xt_table_info
    && unconditional(&e->ip)) || visited) {
    unsigned int oldpos, size;

    - if (t->verdict < -NF_MAX_VERDICT - 1) {
    + if ((strcmp(t->target.u.user.name,
    + IPT_STANDARD_TARGET) == 0) &&
    + t->verdict < -NF_MAX_VERDICT - 1) {
    duprintf("mark_source_chains: bad "
    "negative verdict (%i)\n",
    t->verdict);
    --- a/net/ipv6/netfilter/ip6_tables.c
    +++ b/net/ipv6/netfilter/ip6_tables.c
    @@ -529,7 +529,9 @@ mark_source_chains(struct xt_table_info
    && unconditional(&e->ipv6)) || visited) {
    unsigned int oldpos, size;

    - if (t->verdict < -NF_MAX_VERDICT - 1) {
    + if ((strcmp(t->target.u.user.name,
    + IP6T_STANDARD_TARGET) == 0) &&
    + t->verdict < -NF_MAX_VERDICT - 1) {
    duprintf("mark_source_chains: bad "
    "negative verdict (%i)\n",
    t->verdict);



    \
     
     \ /
      Last update: 2009-04-30 00:33    [W:0.032 / U:238.352 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site