diff options
| author |   Jens Axboe <axboe@kernel.dk> | 2012-05-01 14:29:55 +0200 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2012-05-01 14:29:55 +0200 |
| commit | 0b7877d4eea3f93e3dd941999522bbd8c538cb53 (patch) | |
| tree | ade6d4e411b9b9b569c802e3b2179826162c934c /net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | |
| parent | vmsplice: relax alignement requirements for SPLICE_F_GIFT (diff) | |
| parent | Linux 3.4-rc5 (diff) | |
| download | linux-dev-0b7877d4eea3f93e3dd941999522bbd8c538cb53.tar.xz linux-dev-0b7877d4eea3f93e3dd941999522bbd8c538cb53.zip | |
Merge tag 'v3.4-rc5' into for-3.5/core
The core branch is behind driver commits that we want to build
on for 3.5, hence I'm pulling in a later -rc.
Linux 3.4-rc5
Conflicts:
Documentation/feature-removal-schedule.txt
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c')
| -rw-r--r-- | net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c index de9da21113a1..cf73cc70ed2d 100644 --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c @@ -74,16 +74,24 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff, iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph); if (iph == NULL) - return -NF_DROP; + return -NF_ACCEPT; /* Conntrack defragments packets, we might still see fragments * inside ICMP packets though. */ if (iph->frag_off & htons(IP_OFFSET)) - return -NF_DROP; + return -NF_ACCEPT; *dataoff = nhoff + (iph->ihl << 2); *protonum = iph->protocol; + /* Check bogus IP headers */ + if (*dataoff > skb->len) { + pr_debug("nf_conntrack_ipv4: bogus IPv4 packet: " + "nhoff %u, ihl %u, skblen %u\n", + nhoff, iph->ihl << 2, skb->len); + return -NF_ACCEPT; + } + return NF_ACCEPT; } |