Merge branch 'master'

2 files changed, 57 insertions, 17 deletions

diff --git a/net/ipv4/netfilter/ip_conntrack_netlink.c b/net/ipv4/netfilter/ip_conntrack_netlink.c
index d2a4fec22862..de9f4464438d 100644
--- a/net/ipv4/netfilter/ip_conntrack_netlink.c
+++ b/net/ipv4/netfilter/ip_conntrack_netlink.c
@@ -467,7 +467,7 @@ out:
 }
 #endif
 
-static const int cta_min_ip[CTA_IP_MAX] = {
+static const size_t cta_min_ip[CTA_IP_MAX] = {
         [CTA_IP_V4_SRC-1]       = sizeof(u_int32_t),
         [CTA_IP_V4_DST-1]       = sizeof(u_int32_t),
 };
@@ -497,7 +497,7 @@ ctnetlink_parse_tuple_ip(struct nfattr *attr, struct ip_conntrack_tuple *tuple)
         return 0;
 }
 
-static const int cta_min_proto[CTA_PROTO_MAX] = {
+static const size_t cta_min_proto[CTA_PROTO_MAX] = {
         [CTA_PROTO_NUM-1]       = sizeof(u_int16_t),
         [CTA_PROTO_SRC_PORT-1]  = sizeof(u_int16_t),
         [CTA_PROTO_DST_PORT-1]  = sizeof(u_int16_t),
@@ -576,7 +576,7 @@ ctnetlink_parse_tuple(struct nfattr *cda[], struct ip_conntrack_tuple *tuple,
 }
 
 #ifdef CONFIG_IP_NF_NAT_NEEDED
-static const int cta_min_protonat[CTA_PROTONAT_MAX] = {
+static const size_t cta_min_protonat[CTA_PROTONAT_MAX] = {
         [CTA_PROTONAT_PORT_MIN-1]       = sizeof(u_int16_t),
         [CTA_PROTONAT_PORT_MAX-1]       = sizeof(u_int16_t),
 };
@@ -614,6 +614,11 @@ static int ctnetlink_parse_nat_proto(struct nfattr *attr,
         return 0;
 }
 
+static const size_t cta_min_nat[CTA_NAT_MAX] = {
+        [CTA_NAT_MINIP-1]       = sizeof(u_int32_t),
+        [CTA_NAT_MAXIP-1]       = sizeof(u_int32_t),
+};
+
 static inline int
 ctnetlink_parse_nat(struct nfattr *cda[],
                     const struct ip_conntrack *ct, struct ip_nat_range *range)
@@ -627,6 +632,9 @@ ctnetlink_parse_nat(struct nfattr *cda[],
         
         nfattr_parse_nested(tb, CTA_NAT_MAX, cda[CTA_NAT-1]);
 
+        if (nfattr_bad_size(tb, CTA_NAT_MAX, cta_min_nat))
+                return -EINVAL;
+
         if (tb[CTA_NAT_MINIP-1])
                 range->min_ip = *(u_int32_t *)NFA_DATA(tb[CTA_NAT_MINIP-1]);
 
@@ -667,6 +675,14 @@ ctnetlink_parse_help(struct nfattr *attr, char **helper_name)
         return 0;
 }
 
+static const size_t cta_min[CTA_MAX] = {
+        [CTA_STATUS-1]          = sizeof(u_int32_t),
+        [CTA_TIMEOUT-1]         = sizeof(u_int32_t),
+        [CTA_MARK-1]            = sizeof(u_int32_t),
+        [CTA_USE-1]             = sizeof(u_int32_t),
+        [CTA_ID-1]              = sizeof(u_int32_t)
+};
+
 static int
 ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb, 
                         struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
@@ -678,6 +694,9 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
 
         DEBUGP("entered %s\n", __FUNCTION__);
 
+        if (nfattr_bad_size(cda, CTA_MAX, cta_min))
+                return -EINVAL;
+
         if (cda[CTA_TUPLE_ORIG-1])
                 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG);
         else if (cda[CTA_TUPLE_REPLY-1])
@@ -760,6 +779,9 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 return 0;
         }
 
+        if (nfattr_bad_size(cda, CTA_MAX, cta_min))
+                return -EINVAL;
+
         if (cda[CTA_TUPLE_ORIG-1])
                 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG);
         else if (cda[CTA_TUPLE_REPLY-1])
@@ -1047,6 +1069,9 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
 
         DEBUGP("entered %s\n", __FUNCTION__);
 
+        if (nfattr_bad_size(cda, CTA_MAX, cta_min))
+                return -EINVAL;
+
         if (cda[CTA_TUPLE_ORIG-1]) {
                 err = ctnetlink_parse_tuple(cda, &otuple, CTA_TUPLE_ORIG);
                 if (err < 0)
@@ -1252,6 +1277,11 @@ out:
         return skb->len;
 }
 
+static const size_t cta_min_exp[CTA_EXPECT_MAX] = {
+        [CTA_EXPECT_TIMEOUT-1]          = sizeof(u_int32_t),
+        [CTA_EXPECT_ID-1]               = sizeof(u_int32_t)
+};
+
 static int
 ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb, 
                      struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
@@ -1263,6 +1293,9 @@ ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
 
         DEBUGP("entered %s\n", __FUNCTION__);
 
+        if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
+                return -EINVAL;
+
         if (nlh->nlmsg_flags & NLM_F_DUMP) {
                 struct nfgenmsg *msg = NLMSG_DATA(nlh);
                 u32 rlen;
@@ -1333,6 +1366,9 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
         struct ip_conntrack_helper *h;
         int err;
 
+        if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
+                return -EINVAL;
+
         if (cda[CTA_EXPECT_TUPLE-1]) {
                 /* delete a single expect by tuple */
                 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE);
@@ -1462,6 +1498,9 @@ ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
 
         DEBUGP("entered %s\n", __FUNCTION__);   
 
+        if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
+                return -EINVAL;
+
         if (!cda[CTA_EXPECT_TUPLE-1]
             || !cda[CTA_EXPECT_MASK-1]
             || !cda[CTA_EXPECT_MASTER-1])
@@ -1504,29 +1543,22 @@ static struct notifier_block ctnl_notifier_exp = {
 
 static struct nfnl_callback ctnl_cb[IPCTNL_MSG_MAX] = {
         [IPCTNL_MSG_CT_NEW]             = { .call = ctnetlink_new_conntrack,
-                                            .attr_count = CTA_MAX,
-                                            .cap_required = CAP_NET_ADMIN },
+                                            .attr_count = CTA_MAX, },
         [IPCTNL_MSG_CT_GET]             = { .call = ctnetlink_get_conntrack,
-                                            .attr_count = CTA_MAX,
-                                            .cap_required = CAP_NET_ADMIN },
+                                            .attr_count = CTA_MAX, },
         [IPCTNL_MSG_CT_DELETE]          = { .call = ctnetlink_del_conntrack,
-                                            .attr_count = CTA_MAX,
-                                            .cap_required = CAP_NET_ADMIN },
+                                            .attr_count = CTA_MAX, },
         [IPCTNL_MSG_CT_GET_CTRZERO]     = { .call = ctnetlink_get_conntrack,
-                                            .attr_count = CTA_MAX,
-                                            .cap_required = CAP_NET_ADMIN },
+                                            .attr_count = CTA_MAX, },
 };
 
 static struct nfnl_callback ctnl_exp_cb[IPCTNL_MSG_EXP_MAX] = {
         [IPCTNL_MSG_EXP_GET]            = { .call = ctnetlink_get_expect,
-                                            .attr_count = CTA_EXPECT_MAX,
-                                            .cap_required = CAP_NET_ADMIN },
+                                            .attr_count = CTA_EXPECT_MAX, },
         [IPCTNL_MSG_EXP_NEW]            = { .call = ctnetlink_new_expect,
-                                            .attr_count = CTA_EXPECT_MAX,
-                                            .cap_required = CAP_NET_ADMIN },
+                                            .attr_count = CTA_EXPECT_MAX, },
         [IPCTNL_MSG_EXP_DELETE]         = { .call = ctnetlink_del_expect,
-                                            .attr_count = CTA_EXPECT_MAX,
-                                            .cap_required = CAP_NET_ADMIN },
+                                            .attr_count = CTA_EXPECT_MAX, },
 };
 
 static struct nfnetlink_subsystem ctnl_subsys = {
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
index 468c6003b4c7..ee3b7d6c4d2e 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
@@ -357,6 +357,10 @@ nfattr_failure:
         return -1;
 }
 
+static const size_t cta_min_tcp[CTA_PROTOINFO_TCP_MAX] = {
+        [CTA_PROTOINFO_TCP_STATE-1]     = sizeof(u_int8_t),
+};
+
 static int nfattr_to_tcp(struct nfattr *cda[], struct ip_conntrack *ct)
 {
         struct nfattr *attr = cda[CTA_PROTOINFO_TCP-1];
@@ -369,6 +373,9 @@ static int nfattr_to_tcp(struct nfattr *cda[], struct ip_conntrack *ct)
 
         nfattr_parse_nested(tb, CTA_PROTOINFO_TCP_MAX, attr);
 
+        if (nfattr_bad_size(tb, CTA_PROTOINFO_TCP_MAX, cta_min_tcp))
+                return -EINVAL;
+
         if (!tb[CTA_PROTOINFO_TCP_STATE-1])
                 return -EINVAL;
 
@@ -814,6 +821,7 @@ static u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_PUSH|TH_ACK|TH_URG) + 1] =
 {
         [TH_SYN]                        = 1,
         [TH_SYN|TH_ACK]                 = 1,
+        [TH_SYN|TH_PUSH]                = 1,
         [TH_SYN|TH_ACK|TH_PUSH]         = 1,
         [TH_RST]                        = 1,
         [TH_RST|TH_ACK]                 = 1,