diff --git a/volatility3/framework/plugins/linux/netfilter.py b/volatility3/framework/plugins/linux/netfilter.py index c12c99d1e..9c8c9feb0 100644 --- a/volatility3/framework/plugins/linux/netfilter.py +++ b/volatility3/framework/plugins/linux/netfilter.py @@ -6,7 +6,7 @@ from abc import ABC, abstractmethod import logging import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from typing import Iterator, List, Tuple +from typing import Iterator, List, Tuple, Optional from volatility3 import framework from volatility3.framework import ( constants, @@ -245,7 +245,9 @@ class AbstractNetfilter(ABC): for hook_idx, hook_name in enumerate(proto.hooks): yield proto_idx, proto.name, hook_idx, hook_name - def build_nf_hook_ops_array(self, nf_hook_entries): + def build_nf_hook_ops_array( + self, nf_hook_entries + ) -> Optional[interfaces.objects.ObjectInterface]: """Function helper to build the nf_hook_ops array when it is not part of the struct 'nf_hook_entries' definition. @@ -260,16 +262,27 @@ class AbstractNetfilter(ABC): } """ nf_hook_entry_size = self.vmlinux.get_type("nf_hook_entry").size + + try: + num_hook_entries = nf_hook_entries.num_hook_entries + except exceptions.InvalidAddressException: + return None + orig_ops_addr = ( - nf_hook_entries.hooks.vol.offset - + nf_hook_entry_size * nf_hook_entries.num_hook_entries + nf_hook_entries.hooks.vol.offset + nf_hook_entry_size * num_hook_entries ) + + if not self.vmlinux._context.layers[self.vmlinux.layer_name].is_valid( + orig_ops_addr + ): + return None + orig_ops = self._context.object( object_type=self.get_symbol_fullname("array"), offset=orig_ops_addr, subtype=self.vmlinux.get_type("pointer"), layer_name=self.layer_name, - count=nf_hook_entries.num_hook_entries, + count=num_hook_entries, ) return orig_ops @@ -515,6 +528,9 @@ class NetfilterImp_4_14_to_4_16(AbstractNetfilter): nf_hook_ops_name = self.get_symbol_fullname("nf_hook_ops") nf_hook_ops_ptr_arr = self.build_nf_hook_ops_array(nf_hook_entries) + if not nf_hook_ops_ptr_arr: + return + for nf_hook_ops_ptr in nf_hook_ops_ptr_arr: nf_hook_ops = nf_hook_ops_ptr.dereference().cast(nf_hook_ops_name) yield nf_hook_ops @@ -695,6 +711,9 @@ class NetfilterNetDevImp_4_14_to_latest(AbstractNetfilterNetDev): nf_hook_ops_name = self.get_symbol_fullname("nf_hook_ops") nf_hook_ops_ptr_arr = self.build_nf_hook_ops_array(nf_hook_entries) + if not nf_hook_ops_ptr_arr: + return + for nf_hook_ops_ptr in nf_hook_ops_ptr_arr: nf_hook_ops = nf_hook_ops_ptr.dereference().cast(nf_hook_ops_name) yield nf_hook_ops