forge/linux-pinenote
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

netfilter: x_tables: add compat version of xt_check_entry_offsets

Browse source 
32bit rulesets have different layout and alignment requirements, so once
more integrity checks get added to xt_check_entry_offsets it will reject
well-formed 32bit rulesets.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Florian Westphal 2016-04-01 14:17:26 +02:00 • committed by Pablo Neira Ayuso
parent a08e4e190b
commit fc1221b3a1
5 changed files with 31 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

3
net/ipv4/netfilter/arp_tables.c
View file

@ -1254,7 +1254,8 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e,
if (!arp_checkentry(&e->arp))
return -EINVAL;
ret = xt_check_entry_offsets(e, e->target_offset, e->next_offset);
ret = xt_compat_check_entry_offsets(e, e->target_offset,
e->next_offset);
if (ret)
return ret;

3
net/ipv4/netfilter/ip_tables.c
View file

@ -1513,7 +1513,8 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
if (!ip_checkentry(&e->ip))
return -EINVAL;
ret = xt_check_entry_offsets(e, e->target_offset, e->next_offset);
ret = xt_compat_check_entry_offsets(e,
e->target_offset, e->next_offset);
if (ret)
return ret;