Commit 7044ab28 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nft_payload: do not truncate csum_offset and csum_type 



Instead report ERANGE if csum_offset is too long, and EOPNOTSUPP if type
is not support.

Fixes: 7ec3f7b4 ("netfilter: nft_payload: add packet mangling support")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 94254f99

net/netfilter/nft_payload.c

+13 −6
Original line number Diff line number Diff line
@@ -740,17 +740,23 @@ static int nft_payload_set_init(const struct nft_ctx *ctx, 
				const struct nlattr * const tb[])

{

	struct nft_payload_set *priv = nft_expr_priv(expr);

	u32 csum_offset, csum_type = NFT_PAYLOAD_CSUM_NONE;

	int err;



	priv->base        = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_BASE]));

	priv->offset      = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_OFFSET]));

	priv->len         = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_LEN]));



	if (tb[NFTA_PAYLOAD_CSUM_TYPE])

		priv->csum_type =

			ntohl(nla_get_be32(tb[NFTA_PAYLOAD_CSUM_TYPE]));

	if (tb[NFTA_PAYLOAD_CSUM_OFFSET])

		priv->csum_offset =

			ntohl(nla_get_be32(tb[NFTA_PAYLOAD_CSUM_OFFSET]));

		csum_type = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_CSUM_TYPE]));

	if (tb[NFTA_PAYLOAD_CSUM_OFFSET]) {

		err = nft_parse_u32_check(tb[NFTA_PAYLOAD_CSUM_OFFSET], U8_MAX,

					  &csum_offset);

		if (err < 0)

			return err;



		priv->csum_offset = csum_offset;

	}

	if (tb[NFTA_PAYLOAD_CSUM_FLAGS]) {

		u32 flags;
@@ -761,7 +767,7 @@ static int nft_payload_set_init(const struct nft_ctx *ctx, 
		priv->csum_flags = flags;

	}



	switch (priv->csum_type) {

	switch (csum_type) {

	case NFT_PAYLOAD_CSUM_NONE:

	case NFT_PAYLOAD_CSUM_INET:

		break;
@@ -775,6 +781,7 @@ static int nft_payload_set_init(const struct nft_ctx *ctx, 
	default:

		return -EOPNOTSUPP;

	}

	priv->csum_type = csum_type;



	return nft_parse_register_load(tb[NFTA_PAYLOAD_SREG], &priv->sreg,

				       priv->len);