payload: don't update protocol context if we can't find a description

Since commit
20b1131c07acd2fc ("payload: fix stacked headers protocol context tracking")
we deref null pointer if we can't find a description for the desired
protocol, so "ip protocol 254" crashes while testing protocols 6 or 17
(tcp, udp) works.

Also add a test case for this.

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1072
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/payload.c b/src/payload.c
index ac0e917a3123424d3a1efdeae687e1fafe4fa1db..9ba980a5de27d2409e427c7776e09f2f6e50e994 100644 (file)
--- a/src/payload.c
+++ b/src/payload.c
@@ -85,6 +85,9 @@ static void payload_expr_pctx_update(struct proto_ctx *ctx,
        base = ctx->protocol[left->payload.base].desc;
        desc = proto_find_upper(base, proto);
 
+       if (!desc)
+               return;
+
        assert(desc->base <= PROTO_BASE_MAX);
        if (desc->base == base->base) {
                assert(base->length > 0);

diff --git a/tests/py/ip/ip.t b/tests/py/ip/ip.t
index 594136cb437762a3fc8711dc54055cc2fcb4afe6..a265b757cceccbf7bc4e102d6052649d73ea9678 100644 (file)
--- a/tests/py/ip/ip.t
+++ b/tests/py/ip/ip.t
@@ -75,6 +75,9 @@ ip protocol != tcp;ok;ip protocol != 6
 ip protocol { icmp, esp, ah, comp, udp, udplite, tcp, dccp, sctp} accept;ok;ip protocol { 33, 136, 17, 51, 50, 6, 132, 1, 108} accept
 - ip protocol != { icmp, esp, ah, comp, udp, udplite, tcp, dccp, sctp} accept;ok
 
+ip protocol 255;ok
+ip protocol 256;fail
+
 ip checksum 13172 drop;ok
 ip checksum 22;ok
 ip checksum != 233;ok

diff --git a/tests/py/ip/ip.t.payload b/tests/py/ip/ip.t.payload
index 3bd3358fa15b9d1a14c201888303afb12bf970e2..15cc59042af8ca31ab84bd6bce23f3aa9d164de4 100644 (file)
--- a/tests/py/ip/ip.t.payload
+++ b/tests/py/ip/ip.t.payload
@@ -204,6 +204,11 @@ ip test-ip4 input
   [ lookup reg 1 set __set%d ]
   [ immediate reg 0 accept ]
 
+# ip protocol 255
+ip test-ip4 input
+  [ payload load 1b @ network header + 9 => reg 1 ]
+  [ cmp eq reg 1 0x000000ff ]
+
 # ip checksum 13172 drop
 ip test-ip4 input
   [ payload load 2b @ network header + 10 => reg 1 ]

diff --git a/tests/py/ip/ip.t.payload.inet b/tests/py/ip/ip.t.payload.inet
index ef4692e33e65944638b87cde0c567cfe60a9bda1..e495246e3011d082cc39029fd943eb7b3e1e9066 100644 (file)
--- a/tests/py/ip/ip.t.payload.inet
+++ b/tests/py/ip/ip.t.payload.inet
@@ -268,6 +268,13 @@ inet test-inet input
   [ lookup reg 1 set __set%d ]
   [ immediate reg 0 accept ]
 
+# ip protocol 255
+ip test-ip4 input
+  [ meta load nfproto => reg 1 ]
+  [ cmp eq reg 1 0x00000002 ]
+  [ payload load 1b @ network header + 9 => reg 1 ]
+  [ cmp eq reg 1 0x000000ff ]
+
 # ip checksum 13172 drop
 inet test-inet input
   [ meta load nfproto => reg 1 ]

diff --git a/tests/py/ip/ip.t.payload.netdev b/tests/py/ip/ip.t.payload.netdev
index 4feaa2789bd9d39cc475fcd5b461a822abe4877a..8eaee4cfd00a450c1e00e285abbf7d5183255751 100644 (file)
--- a/tests/py/ip/ip.t.payload.netdev
+++ b/tests/py/ip/ip.t.payload.netdev
@@ -204,6 +204,13 @@ netdev test-netdev ingress
   [ lookup reg 1 set __set%d ]
   [ immediate reg 0 accept ]
 
+# ip protocol 255
+ip test-ip4 input
+  [ meta load protocol => reg 1 ]
+  [ cmp eq reg 1 0x00000008 ]
+  [ payload load 1b @ network header + 9 => reg 1 ]
+  [ cmp eq reg 1 0x000000ff ]
+
 # ip checksum 13172 drop
 netdev test-netdev ingress 
   [ meta load protocol => reg 1 ]