netfilter: nf_conntrack_irc: Fix forged IP logic

Ensure the match happens in the right direction, previously the
destination used was the server, not the NAT host, as the comment
shows the code intended.

Additionally nf_nat_irc uses port 0 as a signal and there's no valid way
it can appear in a DCC message, so consider port 0 also forged.

Fixes: 869f37d8e48f ("[NETFILTER]: nf_conntrack/nf_nat: add IRC helper port")
Signed-off-by: David Leadbeater <dgl@dgl.cx>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
CVE-2022-2663
(cherry picked from commit 0efe125cfb99e6773a7434f3463f7c2fa28f3a43)
Signed-off-by: John Cabaj <john.cabaj@canonical.com>
Acked-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Acked-by: Luke Nowakowski-Krijger <luke.nowakowskikrijger@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
index 08ee4e760a3d2551ad689dfb4167555e82a99737..18b90e334b5bd997674b4d974397f568df61fb22 100644 (file)
--- a/net/netfilter/nf_conntrack_irc.c
+++ b/net/netfilter/nf_conntrack_irc.c
@@ -188,8 +188,9 @@ static int help(struct sk_buff *skb, unsigned int protoff,
 
                        /* dcc_ip can be the internal OR external (NAT'ed) IP */
                        tuple = &ct->tuplehash[dir].tuple;
-                       if (tuple->src.u3.ip != dcc_ip &&
-                           tuple->dst.u3.ip != dcc_ip) {
+                       if ((tuple->src.u3.ip != dcc_ip &&
+                            ct->tuplehash[!dir].tuple.dst.u3.ip != dcc_ip) ||
+                           dcc_port == 0) {
                                net_warn_ratelimited("Forged DCC command from %pI4: %pI4:%u\n",
                                                     &tuple->src.u3.ip,
                                                     &dcc_ip, dcc_port);