netfilter: x_tables: validate targets of jumps

Browse source

commit 3647234101 upstream.

When we see a jump also check that the offset gets us to beginning of
a rule (an ipt_entry).

The extra overhead is negible, even with absurd cases.

300k custom rules, 300k jumps to 'next' user chain:
[ plus one jump from INPUT to first userchain ]:

Before:
real    0m24.874s
user    0m7.532s
sys     0m16.076s

After:
real    0m27.464s
user    0m7.436s
sys     0m18.840s

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

...

This commit is contained in:

Florian Westphal 2016-04-01 14:17:22 +02:00 • committed by Greg Kroah-Hartman

parent d6f7cd1b21

commit 611d408a53

3 changed files with 48 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

16

net/ipv4/netfilter/arp_tables.c

View file

16

net/ipv4/netfilter/ip_tables.c

View file

16

net/ipv6/netfilter/ip6_tables.c

View file