netfilter: remove defensive check on malformed packets from raw sockets

Browse source

Users cannot forge malformed IPv4/IPv6 headers via raw sockets that they
can inject into the stack. Specifically, not for IPv4 since 55888dfb6b
("AF_RAW: Augment raw_send_hdrinc to expand skb to fit iphdr->ihl
(v2)"). IPv6 raw sockets also ensure that packets have a well-formed
IPv6 header available in the skbuff.

At quick glance, br_netfilter also validates layer 3 headers and it
drops malformed both IPv4 and IPv6 packets.

Therefore, let's remove this defensive check all over the place.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Pablo Neira Ayuso 2017-12-30 22:41:46 +01:00

parent f6931f5f5b

commit a7f87b47e6

13 changed files with 3 additions and 128 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

6

net/ipv4/netfilter/iptable_filter.c

View file

5

net/ipv4/netfilter/iptable_mangle.c

View file

6

net/ipv4/netfilter/iptable_raw.c

View file

6

net/ipv4/netfilter/iptable_security.c

View file

5

net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c

View file

10

net/ipv4/netfilter/nf_nat_l3proto_ipv4.c

View file

17

net/ipv4/netfilter/nf_tables_ipv4.c

View file

5

net/ipv4/netfilter/nft_chain_route_ipv4.c

View file

8

net/ipv6/netfilter/ip6table_mangle.c

View file

5

net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c

View file

8

net/ipv6/netfilter/nf_nat_l3proto_ipv6.c

View file

16

net/ipv6/netfilter/nf_tables_ipv6.c

View file

34

net/netfilter/nf_tables_inet.c

View file