3.2.99-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Phil Oester kernel@linuxace.com
commit b396966c4688522863572927cb30aa874b3ec504 upstream.
Similar to commit bc6bcb59 ("netfilter: xt_TCPOPTSTRIP: fix possible mangling beyond packet boundary"), add safe fragment handling to xt_TCPMSS.
Signed-off-by: Phil Oester kernel@linuxace.com Signed-off-by: Pablo Neira Ayuso pablo@netfilter.org [bwh: Backported to 3.2: Change parameters for tcpmss_mangle_packet() as done upstream in commit 70d19f805f8c "netfilter: xt_TCPMSS: Fix IPv6 default MSS too"] Signed-off-by: Ben Hutchings ben@decadent.org.uk --- --- a/net/netfilter/xt_TCPMSS.c +++ b/net/netfilter/xt_TCPMSS.c @@ -44,17 +44,22 @@ optlen(const u_int8_t *opt, unsigned int
static int tcpmss_mangle_packet(struct sk_buff *skb, - const struct xt_tcpmss_info *info, + const struct xt_action_param *par, unsigned int in_mtu, unsigned int tcphoff, unsigned int minlen) { + const struct xt_tcpmss_info *info = par->targinfo; struct tcphdr *tcph; unsigned int tcplen, i; __be16 oldval; u16 newmss; u8 *opt;
+ /* This is a fragment, no TCP header is available */ + if (par->fragoff != 0) + return XT_CONTINUE; + if (!skb_make_writable(skb, skb->len)) return -1;
@@ -183,7 +188,7 @@ tcpmss_tg4(struct sk_buff *skb, const st __be16 newlen; int ret;
- ret = tcpmss_mangle_packet(skb, par->targinfo, + ret = tcpmss_mangle_packet(skb, par, tcpmss_reverse_mtu(skb, PF_INET), iph->ihl * 4, sizeof(*iph) + sizeof(struct tcphdr)); @@ -211,7 +216,7 @@ tcpmss_tg6(struct sk_buff *skb, const st tcphoff = ipv6_skip_exthdr(skb, sizeof(*ipv6h), &nexthdr); if (tcphoff < 0) return NF_DROP; - ret = tcpmss_mangle_packet(skb, par->targinfo, + ret = tcpmss_mangle_packet(skb, par, tcpmss_reverse_mtu(skb, PF_INET6), tcphoff, sizeof(*ipv6h) + sizeof(struct tcphdr));