netfilter: nf_tables: reduce nft_pktinfo by 8 bytes

structure is reduced from 32 to 24 bytes.  While at it, also check
that iphdrlen is sane, this is guaranteed for NFPROTO_IPV4 but not
for ingress or bridge, so add checks for this.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index cdb7db9b0e25204fbcafef518a9c36d24da1edff..f6db510689a804e79ad0d5ac5ef227b5324b9104 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -32,8 +32,8 @@ struct nft_pktinfo {
        u8                              flags;
        u8                              tprot;
        u16                             fragoff;
-       unsigned int                    thoff;
-       unsigned int                    inneroff;
+       u16                             thoff;
+       u16                             inneroff;
 };
 
 static inline struct sock *nft_sk(const struct nft_pktinfo *pkt)

diff --git a/include/net/netfilter/nf_tables_ipv4.h b/include/net/netfilter/nf_tables_ipv4.h
index c4a6147b0ef8ce4dcdb1ce0f0b61e3636c5142e4..112708f7a6b4fc2f5257af2661e359addc9086af 100644 (file)
--- a/include/net/netfilter/nf_tables_ipv4.h
+++ b/include/net/netfilter/nf_tables_ipv4.h
@@ -35,6 +35,8 @@ static inline int __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt)
                return -1;
        else if (len < thoff)
                return -1;
+       else if (thoff < sizeof(*iph))
+               return -1;
 
        pkt->flags = NFT_PKTINFO_L4PROTO;
        pkt->tprot = iph->protocol;
@@ -69,6 +71,8 @@ static inline int nft_set_pktinfo_ipv4_ingress(struct nft_pktinfo *pkt)
                return -1;
        } else if (len < thoff) {
                goto inhdr_error;
+       } else if (thoff < sizeof(*iph)) {
+               return -1;
        }
 
        pkt->flags = NFT_PKTINFO_L4PROTO;

diff --git a/include/net/netfilter/nf_tables_ipv6.h b/include/net/netfilter/nf_tables_ipv6.h
index ec7eaeaf4f04c2fa5efd06a089c2c2954e257d4e..467d59b9e5334c17ca673e7cdb19b80a71b48fdb 100644 (file)
--- a/include/net/netfilter/nf_tables_ipv6.h
+++ b/include/net/netfilter/nf_tables_ipv6.h
@@ -13,7 +13,7 @@ static inline void nft_set_pktinfo_ipv6(struct nft_pktinfo *pkt)
        unsigned short frag_off;
 
        protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, &flags);
-       if (protohdr < 0) {
+       if (protohdr < 0 || thoff > U16_MAX) {
                nft_set_pktinfo_unspec(pkt);
                return;
        }
@@ -47,7 +47,7 @@ static inline int __nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt)
                return -1;
 
        protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, &flags);
-       if (protohdr < 0)
+       if (protohdr < 0 || thoff > U16_MAX)
                return -1;
 
        pkt->flags = NFT_PKTINFO_L4PROTO;
@@ -93,7 +93,7 @@ static inline int nft_set_pktinfo_ipv6_ingress(struct nft_pktinfo *pkt)
        }
 
        protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, &flags);
-       if (protohdr < 0)
+       if (protohdr < 0 || thoff > U16_MAX)
                goto inhdr_error;
 
        pkt->flags = NFT_PKTINFO_L4PROTO;