git.stricted.de - GitHub/MotorolaMobilityLLC/kernel-slsi.git/commit

author	Florian Westphal <fw@strlen.de>
	Fri, 1 Apr 2016 12:17:22 +0000 (14:17 +0200)
committer	Pablo Neira Ayuso <pablo@netfilter.org>
	Wed, 13 Apr 2016 22:30:35 +0000 (00:30 +0200)
commit	36472341017529e2b12573093cc0f68719300997
tree	96f6dd9fbfcddc5e3a934d4dd812d640574897d0	tree \| snapshot (tar.gz zip)
parent	f24e230d257af1ad7476c6e81a8dc3127a74204e	commit \| diff

netfilter: x_tables: validate targets of jumps

When we see a jump also check that the offset gets us to beginning of
a rule (an ipt_entry).

The extra overhead is negible, even with absurd cases.

300k custom rules, 300k jumps to 'next' user chain:
[ plus one jump from INPUT to first userchain ]:

Before:
real    0m24.874s
user    0m7.532s
sys     0m16.076s

After:
real    0m27.464s
user    0m7.436s
sys     0m18.840s

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

net/ipv4/netfilter/arp_tables.c		diff \| blob \| blame \| history
net/ipv4/netfilter/ip_tables.c		diff \| blob \| blame \| history
net/ipv6/netfilter/ip6_tables.c		diff \| blob \| blame \| history