| commit | 36472341017529e2b12573093cc0f68719300997 | |
| author | Florian Westphal <fw@strlen.de> | |
| Fri, 1 Apr 2016 12:17:22 +0000 (1 14:17 +0200) | ||
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | |
| Wed, 13 Apr 2016 22:30:35 +0000 (14 00:30 +0200) | ||
| tree | 96f6dd9fbfcddc5e3a934d4dd812d640574897d0 | treesnapshot (tar.gz zip) |
| parent | f24e230d257af1ad7476c6e81a8dc3127a74204e | commitdiff |
netfilter: x_tables: validate targets of jumps
When we see a jump also check that the offset gets us to beginning of
a rule (an ipt_entry).
The extra overhead is negible, even with absurd cases.
300k custom rules, 300k jumps to 'next' user chain:
[ plus one jump from INPUT to first userchain ]:
Before:
real 0m24.874s
user 0m7.532s
sys 0m16.076s
After:
real 0m27.464s
user 0m7.436s
sys 0m18.840s
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
When we see a jump also check that the offset gets us to beginning of
a rule (an ipt_entry).
The extra overhead is negible, even with absurd cases.
300k custom rules, 300k jumps to 'next' user chain:
[ plus one jump from INPUT to first userchain ]:
Before:
real 0m24.874s
user 0m7.532s
sys 0m16.076s
After:
real 0m27.464s
user 0m7.436s
sys 0m18.840s
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| net/ipv4/netfilter/arp_tables.c | diffblobblamehistory | |
| net/ipv4/netfilter/ip_tables.c | diffblobblamehistory | |
| net/ipv6/netfilter/ip6_tables.c | diffblobblamehistory |