[PATCH v3 nf-next 0/3] netfilter: add restrictions/validations for packet rewrite

[Florian Westphal <fw@strlen.de>]

Changes since v2:
 - In patch 1, disable write for NF_BRIDGE. Remove ARP handling.
 ARP is not supported and NF_BRIDGE doesn't appear to be useful as-is
 given userspace gets L3 headers only and needs to use NFQA_L2HDR nl
 attr to alter mac header.

1) Restrict nfnetlink_queue writes to the network header. Validate IP/IPv6
   headers and disable IPv6 extension header changes. Ensure total length
   matches skb length.

2) Restrict nft_payload writes to linklayer and network header data. Prevent
   linklayer writes from spilling into network headers. Validate network
   header updates to protect IP version and length fields.

3) add restrictions to the checksum offset, without this patch 2 isn't
   sufficient because an invalid checksum offset can e.g. overwrite iph
   header length field.

This doesn't remove the userns restriction, yet.
I would like to wait a bit before re-enabling this to make sure there
are no other gaps (e.g. for encapsulated traffic).

Florian Westphal (3):
  netfilter: nfnetlink_queue: restrict writes to network header
  netfilter: nftables: restrict linklayer and network header writes
  netfilter: nftables: restrict checkum update offset

 net/netfilter/nfnetlink_queue.c | 170 ++++++++++++++++++++
 net/netfilter/nft_payload.c     | 270 ++++++++++++++++++++++++++++++++
 2 files changed, 440 insertions(+)

-- 
2.53.0