netdev - Re: [PATCH 2/3] netfilter: Create revision 2 of xt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 23 Jun 2016 13:16:30 +0200
From:	Pablo Neira Ayuso <pablo@...filter.org>
To:	Vishwanath Pai <vpai@...mai.com>
Cc:	kaber@...sh.net, kadlec@...ckhole.kfki.hu,
	netfilter-devel@...r.kernel.org, coreteam@...filter.org,
	johunt@...mai.com, netdev@...r.kernel.org, pai.vishwain@...il.com
Subject: Re: [PATCH 2/3] netfilter: Create revision 2 of xt_hashlimit to
 support higher pps rates

On Wed, Jun 01, 2016 at 08:11:38PM -0400, Vishwanath Pai wrote:
> +static void
> +cfg_copy(struct hashlimit_cfg2 *to, void *from, int revision)
> +{
> +	if (revision == 1) {
> +		struct hashlimit_cfg1 *cfg = (struct hashlimit_cfg1 *)from;
> +
> +		to->mode = cfg->mode;
> +		to->avg = cfg->avg;
> +		to->burst = cfg->burst;
> +		to->size = cfg->size;
> +		to->max = cfg->max;
> +		to->gc_interval = cfg->gc_interval;
> +		to->expire = cfg->expire;
> +		to->srcmask = cfg->srcmask;
> +		to->dstmask = cfg->dstmask;
> +	} else if (revision == 2) {
> +		memcpy(to, from, sizeof(struct hashlimit_cfg2));
> +	} else {
> +		BUG();

BUG here is probably too much, this halts the system. I can see we
only use this somewhere else in this code. Instead, I'd suggest you
propagate an error back to userspace if this ever happen.

I would like to see if this spots any problem with our test
infrastructure under iptables/.

Thanks.