Commit e7a1caa6 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: reduce nft_pktinfo by 8 bytes 



structure is reduced from 32 to 24 bytes.  While at it, also check
that iphdrlen is sane, this is guaranteed for NFPROTO_IPV4 but not
for ingress or bridge, so add checks for this.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent ac1f8c04

include/net/netfilter/nf_tables.h

+2 −2
Original line number Diff line number Diff line
@@ -32,8 +32,8 @@ struct nft_pktinfo { 
	u8				flags;

	u8				tprot;

	u16				fragoff;

	unsigned int			thoff;

	unsigned int			inneroff;

	u16				thoff;

	u16				inneroff;

};



static inline struct sock *nft_sk(const struct nft_pktinfo *pkt)

include/net/netfilter/nf_tables_ipv4.h

+4 −0
Original line number Diff line number Diff line
@@ -35,6 +35,8 @@ static inline int __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt) 
		return -1;

	else if (len < thoff)

		return -1;

	else if (thoff < sizeof(*iph))

		return -1;



	pkt->flags = NFT_PKTINFO_L4PROTO;

	pkt->tprot = iph->protocol;
@@ -69,6 +71,8 @@ static inline int nft_set_pktinfo_ipv4_ingress(struct nft_pktinfo *pkt) 
		return -1;

	} else if (len < thoff) {

		goto inhdr_error;

	} else if (thoff < sizeof(*iph)) {

		return -1;

	}



	pkt->flags = NFT_PKTINFO_L4PROTO;

include/net/netfilter/nf_tables_ipv6.h

+3 −3
Original line number Diff line number Diff line
@@ -13,7 +13,7 @@ static inline void nft_set_pktinfo_ipv6(struct nft_pktinfo *pkt) 
	unsigned short frag_off;



	protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, &flags);

	if (protohdr < 0) {

	if (protohdr < 0 || thoff > U16_MAX) {

		nft_set_pktinfo_unspec(pkt);

		return;

	}
@@ -47,7 +47,7 @@ static inline int __nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt) 
		return -1;



	protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, &flags);

	if (protohdr < 0)

	if (protohdr < 0 || thoff > U16_MAX)

		return -1;



	pkt->flags = NFT_PKTINFO_L4PROTO;
@@ -93,7 +93,7 @@ static inline int nft_set_pktinfo_ipv6_ingress(struct nft_pktinfo *pkt) 
	}



	protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, &flags);

	if (protohdr < 0)

	if (protohdr < 0 || thoff > U16_MAX)

		goto inhdr_error;



	pkt->flags = NFT_PKTINFO_L4PROTO;