netdev - [PATCH net] netfilter: set skb transport_header before calling sctp_compute

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sun,  3 Mar 2019 16:17:21 +0800
From:   Xin Long <lucien.xin@...il.com>
To:     network dev <netdev@...r.kernel.org>,
        netfilter-devel@...r.kernel.org
Cc:     Marcelo Ricardo Leitner <marcelo.leitner@...il.com>,
        Neil Horman <nhorman@...driver.com>, pablo@...filter.org
Subject: [PATCH net] netfilter: set skb transport_header before calling sctp_compute_cksum

sctp_hdr(skb) only works when skb->transport_header is set
properly.

But in the path of nf_conntrack_in:

  sctp_packet() -> sctp_error() -> sctp_compute_cksum().

skb->transport_header is not guaranteed to be right value
for sctp. It will cause to fail to check the checksum for
sctp packets.

So fix it by setting skb transport_header before calling
sctp_compute_cksum().

Fixes: e6d8b64b34aa ("net: sctp: fix and consolidate SCTP checksumming code")
Reported-by: Li Shuang <shuali@...hat.com>
Signed-off-by: Xin Long <lucien.xin@...il.com>
Acked-by: Neil Horman <nhorman@...driver.com>
---
 net/netfilter/nf_conntrack_proto_sctp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index d53e3e7..6b53cd2 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -343,7 +343,9 @@ static bool sctp_error(struct sk_buff *skb,
 			logmsg = "nf_ct_sctp: failed to read header ";
 			goto out_invalid;
 		}
-		sh = (const struct sctphdr *)(skb->data + dataoff);
+		/* sctp_compute_cksum() depends on correct transport header */
+		skb_set_transport_header(skb, dataoff);
+		sh = sctp_hdr(skb);
 		if (sh->checksum != sctp_compute_cksum(skb, dataoff)) {
 			logmsg = "nf_ct_sctp: bad CRC ";
 			goto out_invalid;
-- 
2.1.0