netfilter: x_tables: add and use xt_check_entry_offsets

Browse source

[ Upstream commit 7d35812c32 ]

Currently arp/ip and ip6tables each implement a short helper to check that
the target offset is large enough to hold one xt_entry_target struct and
that t->u.target_size fits within the current rule.

Unfortunately these checks are not sufficient.

To avoid adding new tests to all of ip/ip6/arptables move the current
checks into a helper, then extend this helper in followup patches.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>

...

This commit is contained in:

Florian Westphal 2016-04-01 14:17:23 +02:00 • committed by Sasha Levin

parent 674c7e173d

commit 62e6fd2010

5 changed files with 41 additions and 32 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

4

include/linux/netfilter/x_tables.h

View file

11

net/ipv4/netfilter/arp_tables.c

View file

12

net/ipv4/netfilter/ip_tables.c

View file

12

net/ipv6/netfilter/ip6_tables.c

View file

34

net/netfilter/x_tables.c

View file