Commit ba8d3b0b authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso

netfilter: nfnetlink_queue: fix maximum packet length to userspace

The packets that we send via NFQUEUE are encapsulated in the NFQA_PAYLOAD
attribute. The length of the packet in userspace is obtained via
attr->nla_len field. This field contains the size of the Netlink
attribute header plus the packet length.

If the maximum packet length is specified, ie. 65535 bytes, and
packets in the range of (65531,65535] are sent to userspace, the
attr->nla_len overflows and it reports bogus lengths to the
application.

To fix this, this patch limits the maximum packet length to 65531
bytes. If larger packet length is specified, the packet that we
send to user-space is truncated to 65531 bytes.

To support 65535 bytes packets, we have to revisit the idea of
the 32-bits Netlink attribute length.
Reported-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 7be54ca4
...@@ -526,9 +526,13 @@ nfqnl_set_mode(struct nfqnl_instance *queue, ...@@ -526,9 +526,13 @@ nfqnl_set_mode(struct nfqnl_instance *queue,
case NFQNL_COPY_PACKET: case NFQNL_COPY_PACKET:
queue->copy_mode = mode; queue->copy_mode = mode;
/* we're using struct nlattr which has 16bit nla_len */ /* We're using struct nlattr which has 16bit nla_len. Note that
if (range > 0xffff) * nla_len includes the header length. Thus, the maximum packet
queue->copy_range = 0xffff; * length that we support is 65531 bytes. We send truncated
* packets if the specified length is larger than that.
*/
if (range > 0xffff - NLA_HDRLEN)
queue->copy_range = 0xffff - NLA_HDRLEN;
else else
queue->copy_range = range; queue->copy_range = range;
break; break;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment