summaryrefslogtreecommitdiffstats
path: root/net/netfilter/xt_TCPOPTSTRIP.c
Commit message (Collapse)AuthorAgeFilesLines
* net: Change pseudohdr argument of inet_proto_csum_replace* to be a boolTom Herbert2015-08-171-1/+1
| | | | | | | | | inet_proto_csum_replace4,2,16 take a pseudohdr argument which indicates the checksum field carries a pseudo header. This argument should be a boolean instead of an int. Signed-off-by: Tom Herbert <tom@herbertland.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* netfilter: xt_TCPOPTSTRIP: fix possible off by one accessPablo Neira Ayuso2013-08-011-4/+6
| | | | | | | | | | | Fix a possible off by one access since optlen() touches opt[offset+1] unsafely when i == tcp_hdrlen(skb) - 1. This patch replaces tcp_hdrlen() by the local variable tcp_hdrlen that stores the TCP header length, to save some cycles. Reported-by: Julian Anastasov <ja@ssi.bg> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: xt_TCPOPTSTRIP: don't use tcp_hdr()Pablo Neira Ayuso2013-06-111-2/+4
| | | | | | | | | | In (bc6bcb5 netfilter: xt_TCPOPTSTRIP: fix possible mangling beyond packet boundary), the use of tcp_hdr was introduced. However, we cannot assume that skb->transport_header is set for non-local packets. Cc: Florian Westphal <fw@strlen.de> Reported-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netfilter: xt_TCPOPTSTRIP: fix possible mangling beyond packet boundaryPablo Neira Ayuso2013-05-161-3/+14
| | | | | | | | | | | This target assumes that tcph->doff is well-formed, that may be well not the case. Add extra sanity checkings to avoid possible crash due to read/write out of the real packet boundary. After this patch, the default action on malformed TCP packets is to drop them. Moreover, fragments are skipped. Reported-by: Rafal Kupka <rkupka@telemetry.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* net:netfilter: use IS_ENABLEDIgor Maravić2011-12-161-2/+2
| | | | | | | | Use IS_ENABLED(CONFIG_FOO) instead of defined(CONFIG_FOO) || defined (CONFIG_FOO_MODULE) Signed-off-by: Igor Maravić <igorm@etf.rs> Signed-off-by: David S. Miller <davem@davemloft.net>
* ipv6: Add fragment reporting to ipv6_skip_exthdr().Jesse Gross2011-12-031-1/+2
| | | | | | | | | | While parsing through IPv6 extension headers, fragment headers are skipped making them invisible to the caller. This reports the fragment offset of the last header in order to make it possible to determine whether the packet is fragmented and, if so whether it is a first or last fragment. Signed-off-by: Jesse Gross <jesse@nicira.com>
* netfilter: xtables: substitute temporary defines by final nameJan Engelhardt2010-05-111-2/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: update my email addressJan Engelhardt2010-03-171-2/+1
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* netfilter: xtables: move extension arguments into compound structure (4/6)Jan Engelhardt2008-10-081-8/+4
| | | | | | | This patch does this for target extensions' target functions. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: x_tables: use NFPROTO_* in extensionsJan Engelhardt2008-10-081-2/+2
| | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: xt_TCPOPTSTRIP: signed tcphoff for ipv6_skip_exthdr() retvalRoel Kluin2008-04-291-1/+1
| | | | | | | | | if tcphoff remains unsigned, a negative ipv6_skip_exthdr() return value will go unnoticed, Signed-off-by: Roel Kluin <12o3l@tiscali.nl> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: Update modules' descriptionsJan Engelhardt2008-01-281-1/+1
| | | | | | | | | | Updates the MODULE_DESCRIPTION() tags for all Netfilter modules, actually describing what the module does and not just "netfilter XYZ target". Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: x_tables: add TCPOPTSTRIP targetSven Schnelle2008-01-281-0/+147
Signed-off-by: Sven Schnelle <svens@bitebene.org> Signed-off-by: Jan Engelhardt <jengelh@gmx.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit v1.2.3 (git 2.39.1) at 2024-05-26 09:50:03 +0000