Commit 1eed4dfb authored by Tom Herbert's avatar Tom Herbert Committed by David S. Miller

flow_dissector: Add limit for number of headers to dissect

In flow dissector there are no limits to the number of nested
encapsulations or headers that might be dissected which makes for a
nice DOS attack. This patch sets a limit of the number of headers
that flow dissector will parse.

Headers includes network layer headers, transport layer headers, shim
headers for encapsulation, IPv6 extension headers, etc. The limit for
maximum number of headers to parse has be set to fifteen to account for
a reasonable number of encapsulations, extension headers, VLAN,
in a packet. Note that this limit does not supercede the STOP_AT_*
flags which may stop processing before the headers limit is reached.
Reported-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: default avatarTom Herbert <tom@quantonium.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 3a1214e8
...@@ -396,6 +396,18 @@ __skb_flow_dissect_ipv6(const struct sk_buff *skb, ...@@ -396,6 +396,18 @@ __skb_flow_dissect_ipv6(const struct sk_buff *skb,
key_ip->ttl = iph->hop_limit; key_ip->ttl = iph->hop_limit;
} }
/* Maximum number of protocol headers that can be parsed in
* __skb_flow_dissect
*/
#define MAX_FLOW_DISSECT_HDRS 15
static bool skb_flow_dissect_allowed(int *num_hdrs)
{
++*num_hdrs;
return (*num_hdrs <= MAX_FLOW_DISSECT_HDRS);
}
/** /**
* __skb_flow_dissect - extract the flow_keys struct and return it * __skb_flow_dissect - extract the flow_keys struct and return it
* @skb: sk_buff to extract the flow from, can be NULL if the rest are specified * @skb: sk_buff to extract the flow from, can be NULL if the rest are specified
...@@ -427,6 +439,7 @@ bool __skb_flow_dissect(const struct sk_buff *skb, ...@@ -427,6 +439,7 @@ bool __skb_flow_dissect(const struct sk_buff *skb,
struct flow_dissector_key_vlan *key_vlan; struct flow_dissector_key_vlan *key_vlan;
enum flow_dissect_ret fdret; enum flow_dissect_ret fdret;
bool skip_vlan = false; bool skip_vlan = false;
int num_hdrs = 0;
u8 ip_proto = 0; u8 ip_proto = 0;
bool ret; bool ret;
...@@ -714,7 +727,9 @@ bool __skb_flow_dissect(const struct sk_buff *skb, ...@@ -714,7 +727,9 @@ bool __skb_flow_dissect(const struct sk_buff *skb,
case FLOW_DISSECT_RET_OUT_GOOD: case FLOW_DISSECT_RET_OUT_GOOD:
goto out_good; goto out_good;
case FLOW_DISSECT_RET_PROTO_AGAIN: case FLOW_DISSECT_RET_PROTO_AGAIN:
goto proto_again; if (skb_flow_dissect_allowed(&num_hdrs))
goto proto_again;
goto out_good;
case FLOW_DISSECT_RET_CONTINUE: case FLOW_DISSECT_RET_CONTINUE:
case FLOW_DISSECT_RET_IPPROTO_AGAIN: case FLOW_DISSECT_RET_IPPROTO_AGAIN:
break; break;
...@@ -843,9 +858,13 @@ bool __skb_flow_dissect(const struct sk_buff *skb, ...@@ -843,9 +858,13 @@ bool __skb_flow_dissect(const struct sk_buff *skb,
/* Process result of IP proto processing */ /* Process result of IP proto processing */
switch (fdret) { switch (fdret) {
case FLOW_DISSECT_RET_PROTO_AGAIN: case FLOW_DISSECT_RET_PROTO_AGAIN:
goto proto_again; if (skb_flow_dissect_allowed(&num_hdrs))
goto proto_again;
break;
case FLOW_DISSECT_RET_IPPROTO_AGAIN: case FLOW_DISSECT_RET_IPPROTO_AGAIN:
goto ip_proto_again; if (skb_flow_dissect_allowed(&num_hdrs))
goto ip_proto_again;
break;
case FLOW_DISSECT_RET_OUT_GOOD: case FLOW_DISSECT_RET_OUT_GOOD:
case FLOW_DISSECT_RET_CONTINUE: case FLOW_DISSECT_RET_CONTINUE:
break; break;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment