From: Simon Horman <simon.horman@corigine.com>
To: Florian Westphal <fw@strlen.de>
Cc: netdev@vger.kernel.org, jhs@mojatatu.com,
xiyou.wangcong@gmail.com, jiri@resnulli.us
Subject: Re: [PATCH net 2/3] net/sched: act_ipt: add sanity checks on skb before calling target
Date: Thu, 8 Jun 2023 12:44:49 +0200 [thread overview]
Message-ID: <ZIGxIWNUsCDg0J0U@corigine.com> (raw)
In-Reply-To: <20230607145954.19324-3-fw@strlen.de>
On Wed, Jun 07, 2023 at 04:59:53PM +0200, Florian Westphal wrote:
> Netfilter targets make assumptions on the skb state, for example
> iphdr is supposed to be in the linear area.
>
> This is normally done by IP stack, but in act_ipt case no
> such checks are made.
>
> Some targets can even assume that skb_dst will be valid.
> Make a minimum effort to check for this:
>
> - Don't call the targets eval function for non-ipv4 skbs.
> - Don't call the targets eval function for POSTROUTING
> emulation when the skb has no dst set.
>
> Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
next prev parent reply other threads:[~2023-06-08 10:44 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-07 14:59 [PATCH net 0/3] net/sched: act_ipt bug fixes Florian Westphal
2023-06-07 14:59 ` [PATCH net 1/3] net/sched: act_ipt: add sanity checks on table name and hook locations Florian Westphal
2023-06-08 10:44 ` Simon Horman
2023-06-08 13:57 ` Florian Westphal
2023-06-08 16:44 ` Jamal Hadi Salim
2023-06-07 14:59 ` [PATCH net 2/3] net/sched: act_ipt: add sanity checks on skb before calling target Florian Westphal
2023-06-08 10:44 ` Simon Horman [this message]
2023-06-07 14:59 ` [PATCH net 3/3] net/sched: act_ipt: zero skb->cb " Florian Westphal
2023-06-08 10:45 ` Simon Horman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZIGxIWNUsCDg0J0U@corigine.com \
--to=simon.horman@corigine.com \
--cc=fw@strlen.de \
--cc=jhs@mojatatu.com \
--cc=jiri@resnulli.us \
--cc=netdev@vger.kernel.org \
--cc=xiyou.wangcong@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.