| From | Luis Henriques <> | Subject | [PATCH 49/98] netfilter: xt_TCPMSS: Fix missing fragmentation handling | Date | Thu, 11 Jul 2013 15:24:19 +0100 |
| |
3.5.7.17 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Oester <kernel@linuxace.com>
commit b396966c4688522863572927cb30aa874b3ec504 upstream.
Similar to commit bc6bcb59 ("netfilter: xt_TCPOPTSTRIP: fix possible mangling beyond packet boundary"), add safe fragment handling to xt_TCPMSS.
Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Luis Henriques <luis.henriques@canonical.com> --- net/netfilter/xt_TCPMSS.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c index 4960b66..a77d786 100644 --- a/net/netfilter/xt_TCPMSS.c +++ b/net/netfilter/xt_TCPMSS.c @@ -55,6 +55,10 @@ tcpmss_mangle_packet(struct sk_buff *skb, u16 newmss; u8 *opt; + /* This is a fragment, no TCP header is available */ + if (par->fragoff != 0) + return XT_CONTINUE; + if (!skb_make_writable(skb, skb->len)) return -1; -- 1.8.1.2
|