Commit 962e5a40 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nft_exthdr: break evaluation if setting TCP option fails 



Break rule evaluation on malformed TCP options.

Fixes: 99d1712b ("netfilter: exthdr: tcp option set support")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 0de53b0f

net/netfilter/nft_exthdr.c

+7 −4
Original line number Diff line number Diff line
@@ -236,7 +236,7 @@ static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr, 


	tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);

	if (!tcph)

		return;

		goto err;



	opt = (u8 *)tcph;

	for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
@@ -251,16 +251,16 @@ static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr, 
			continue;



		if (i + optl > tcphdr_len || priv->len + priv->offset > optl)

			return;

			goto err;



		if (skb_ensure_writable(pkt->skb,

					nft_thoff(pkt) + i + priv->len))

			return;

			goto err;



		tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff,

					      &tcphdr_len);

		if (!tcph)

			return;

			goto err;



		offset = i + priv->offset;
@@ -303,6 +303,9 @@ static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr, 


		return;

	}

	return;

err:

	regs->verdict.code = NFT_BREAK;

}



static void nft_exthdr_sctp_eval(const struct nft_expr *expr,