/* * netsniff-ng - the packet sniffing beast * Copyright 2009, 2010 Daniel Borkmann. * Copyright 2010 Emmanuel Roullit. * Subject to the GPL, version 2. */ #include #include #include /* for ntohs() */ #include /* for inet_ntop() */ #include "proto.h" #include "protos.h" #include "csum.h" #include "dissector_eth.h" #include "ipv6.h" #include "geoip.h" #include "pkt_buff.h" extern void ipv6(struct pkt_buff *pkt); extern void ipv6_less(struct pkt_buff *pkt); void ipv6(struct pkt_buff *pkt) { uint8_t traffic_class; uint32_t flow_label; char src_ip[INET6_ADDRSTRLEN]; char dst_ip[INET6_ADDRSTRLEN]; struct ipv6hdr *ip = (struct ipv6hdr *) pkt_pull(pkt, sizeof(*ip)); struct sockaddr_in6 sas, sad; const char *city, *region, *country; if (ip == NULL) return; traffic_class = (ip->priority << 4) | ((ip->flow_lbl[0] & 0xF0) >> 4); flow_label = ((ip->flow_lbl[0] & 0x0F) << 8) | (ip->flow_lbl[1] << 4) | ip->flow_lbl[2]; inet_ntop(AF_INET6, &ip->saddr, src_ip, sizeof(src_ip)); inet_ntop(AF_INET6, &ip->daddr, dst_ip, sizeof(dst_ip)); tprintf(" [ IPv6 "); tprintf("Addr (%s => %s), ", src_ip, dst_ip); tprintf("Version (%u), ", ip->version); tprintf("TrafficClass (%u), ", traffic_class); tprintf("FlowLabel (%u), ", flow_label); tprintf("Len (%u), ", ntohs(ip->payload_len)); tprintf("NextHdr (%u), ", ip->nexthdr); tprintf("HopLimit (%u)", ip->hop_limit); tprintf(" ]\n"); memset(&sas, 0, sizeof(sas)); sas.sin6_family = PF_INET6; memcpy(&sas.sin6_addr, &ip->saddr, sizeof(ip->saddr)); memset(&sad, 0, sizeof(sad)); sad.sin6_family = PF_INET6; memcpy(&sad.sin6_addr, &ip->daddr, sizeof(ip->daddr)); if (geoip_working()) { tprintf("\t[ Geo ("); if ((country = geoip6_country_name(sas))) { tprintf("%s", country); if ((region = geoip6_region_name(sas))) tprintf(" / %s", region); if ((city = geoip6_city_name(sas))) tprintf(" / %s", city); } else { tprintf("local"); } tprintf(" => "); if ((country = geoip6_country_name(sad))) { tprintf("%s", country); if ((region = geoip6_region_name(sad))) tprintf(" / %s", region); if ((city = geoip6_city_name(sad))) tprintf(" / %s", city); } else { tprintf("local"); } tprintf(") ]\n"); } pkt_set_proto(pkt, ð_lay3, ip->nexthdr); } void ipv6_less(struct pkt_buff *pkt) { char src_ip[INET6_ADDRSTRLEN]; char dst_ip[INET6_ADDRSTRLEN]; struct ipv6hdr *ip = (struct ipv6hdr *) pkt_pull(pkt, sizeof(*ip)); if (ip == NULL) return; inet_ntop(AF_INET6, &ip->saddr, src_ip, sizeof(src_ip)); inet_ntop(AF_INET6, &ip->daddr, dst_ip, sizeof(dst_ip)); tprintf(" %s/%s Len %u", src_ip, dst_ip, ntohs(ip->payload_len)); pkt_set_proto(pkt, ð_lay3, ip->nexthdr); } struct protocol ipv6_ops = { .key = 0x86DD, .print_full = ipv6, .print_less = ipv6_less, }; ype='hidden' name='id' value='c502faf94153bd0fedc5389a936f728a659cc6ab'/>


context:
space:
mode:

author	Daniel Borkmann <daniel@iogearbox.net>	2017-02-08 01:19:43 +0100
committer	David S. Miller <davem@davemloft.net>	2017-02-08 14:40:03 -0500
commit	c502faf94153bd0fedc5389a936f728a659cc6ab (patch)
tree	603e482c1467bc7d156623c9b83df0cee514d6aa
parent	8ef9594764617e3fd4500205b080b53c45c14c4b (diff)

bpf, lpm: fix overflows in trie_alloc checks

Cap the maximum (total) value size and bail out if larger than KMALLOC_MAX_SIZE as otherwise it doesn't make any sense to proceed further, since we're guaranteed to fail to allocate elements anyway in lpm_trie_node_alloc(); likleyhood of failure is still high for large values, though, similarly as with htab case in non-prealloc. Next, make sure that cost vars are really u64 instead of size_t, so that we don't overflow on 32 bit and charge only tiny map.pages against memlock while allowing huge max_entries; cap also the max cost like we do with other map types. Fixes: b95a5c4db09b ("bpf: add a longest prefix match trie map implementation") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>

Diffstat

-rw-r--r--

kernel/bpf/lpm_trie.c

1 files changed, 27 insertions, 9 deletions