From mboxrd@z Thu Jan 1 00:00:00 1970 From: Florian Westphal Subject: Re: [PATCH nf-next] netfilter: x_tables: add context to know if extension runs from nft_compat Date: Mon, 2 Mar 2015 14:19:40 +0100 Message-ID: <20150302131940.GA7418@breakpoint.cc> References: <1425301864-18442-1-git-send-email-pablo@netfilter.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: netfilter-devel@vger.kernel.org, kaber@trash.net To: Pablo Neira Ayuso Return-path: Received: from Chamillionaire.breakpoint.cc ([80.244.247.6]:53305 "EHLO Chamillionaire.breakpoint.cc" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750966AbbCBNTm (ORCPT ); Mon, 2 Mar 2015 08:19:42 -0500 Content-Disposition: inline In-Reply-To: <1425301864-18442-1-git-send-email-pablo@netfilter.org> Sender: netfilter-devel-owner@vger.kernel.org List-ID: Pablo Neira Ayuso wrote: > 2) TCPMSS. Relax the checking when used from nft_compat and make sure > that we skip !syn packets in case userspace provides a wrong > configuration. > diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c > index e762de5..3b9761f 100644 > --- a/net/netfilter/xt_TCPMSS.c > +++ b/net/netfilter/xt_TCPMSS.c > @@ -97,6 +97,9 @@ tcpmss_mangle_packet(struct sk_buff *skb, > if (!skb_make_writable(skb, skb->len)) > return -1; > > + if (unlikely(!tcph->syn)) > + return 0; > + > len = skb->len - tcphoff; Applying this to my copy of nf-next would insert this test before tcph is set up.