Commit 47a6959f authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: allow to turn off xtables compat layer 



The compat layer needs to parse untrusted input (the ruleset)
to translate it to a 64bit compatible format.

We had a number of bugs in this department in the past, so allow users
to turn this feature off.

Add CONFIG_NETFILTER_XTABLES_COMPAT kconfig knob and make it default to y
to keep existing behaviour.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 50f2db9e

include/linux/netfilter/x_tables.h

+6 −6
Original line number Diff line number Diff line
@@ -158,7 +158,7 @@ struct xt_match { 


	/* Called when entry of this type deleted. */

	void (*destroy)(const struct xt_mtdtor_param *);

#ifdef CONFIG_COMPAT

#ifdef CONFIG_NETFILTER_XTABLES_COMPAT

	/* Called when userspace align differs from kernel space one */

	void (*compat_from_user)(void *dst, const void *src);

	int (*compat_to_user)(void __user *dst, const void *src);
@@ -169,7 +169,7 @@ struct xt_match { 
	const char *table;

	unsigned int matchsize;

	unsigned int usersize;

#ifdef CONFIG_COMPAT

#ifdef CONFIG_NETFILTER_XTABLES_COMPAT

	unsigned int compatsize;

#endif

	unsigned int hooks;
@@ -199,7 +199,7 @@ struct xt_target { 


	/* Called when entry of this type deleted. */

	void (*destroy)(const struct xt_tgdtor_param *);

#ifdef CONFIG_COMPAT

#ifdef CONFIG_NETFILTER_XTABLES_COMPAT

	/* Called when userspace align differs from kernel space one */

	void (*compat_from_user)(void *dst, const void *src);

	int (*compat_to_user)(void __user *dst, const void *src);
@@ -210,7 +210,7 @@ struct xt_target { 
	const char *table;

	unsigned int targetsize;

	unsigned int usersize;

#ifdef CONFIG_COMPAT

#ifdef CONFIG_NETFILTER_XTABLES_COMPAT

	unsigned int compatsize;

#endif

	unsigned int hooks;
@@ -452,7 +452,7 @@ xt_get_per_cpu_counter(struct xt_counters *cnt, unsigned int cpu) 


struct nf_hook_ops *xt_hook_ops_alloc(const struct xt_table *, nf_hookfn *);



#ifdef CONFIG_COMPAT

#ifdef CONFIG_NETFILTER_XTABLES_COMPAT

#include <net/compat.h>



struct compat_xt_entry_match {
@@ -533,5 +533,5 @@ int xt_compat_check_entry_offsets(const void *base, const char *elems, 
				  unsigned int target_offset,

				  unsigned int next_offset);



#endif /* CONFIG_COMPAT */

#endif /* CONFIG_NETFILTER_XTABLES_COMPAT */

#endif /* _X_TABLES_H */

include/linux/netfilter_arp/arp_tables.h

+1 −1
Original line number Diff line number Diff line
@@ -59,7 +59,7 @@ extern unsigned int arpt_do_table(struct sk_buff *skb, 
				  const struct nf_hook_state *state,

				  struct xt_table *table);



#ifdef CONFIG_COMPAT

#ifdef CONFIG_NETFILTER_XTABLES_COMPAT

#include <net/compat.h>



struct compat_arpt_entry {

include/linux/netfilter_ipv4/ip_tables.h

+1 −1
Original line number Diff line number Diff line
@@ -67,7 +67,7 @@ extern unsigned int ipt_do_table(struct sk_buff *skb, 
				 const struct nf_hook_state *state,

				 struct xt_table *table);



#ifdef CONFIG_COMPAT

#ifdef CONFIG_NETFILTER_XTABLES_COMPAT

#include <net/compat.h>



struct compat_ipt_entry {

include/linux/netfilter_ipv6/ip6_tables.h

+1 −1
Original line number Diff line number Diff line
@@ -33,7 +33,7 @@ extern unsigned int ip6t_do_table(struct sk_buff *skb, 
				  const struct nf_hook_state *state,

				  struct xt_table *table);



#ifdef CONFIG_COMPAT

#ifdef CONFIG_NETFILTER_XTABLES_COMPAT

#include <net/compat.h>



struct compat_ip6t_entry {

net/bridge/netfilter/ebt_limit.c

+2 −2
Original line number Diff line number Diff line
@@ -87,7 +87,7 @@ static int ebt_limit_mt_check(const struct xt_mtchk_param *par) 
}





#ifdef CONFIG_COMPAT

#ifdef CONFIG_NETFILTER_XTABLES_COMPAT

/*

 * no conversion function needed --

 * only avg/burst have meaningful values in userspace.
@@ -107,7 +107,7 @@ static struct xt_match ebt_limit_mt_reg __read_mostly = { 
	.checkentry	= ebt_limit_mt_check,

	.matchsize	= sizeof(struct ebt_limit_info),

	.usersize	= offsetof(struct ebt_limit_info, prev),

#ifdef CONFIG_COMPAT

#ifdef CONFIG_NETFILTER_XTABLES_COMPAT

	.compatsize	= sizeof(struct ebt_compat_limit_info),

#endif

	.me		= THIS_MODULE,