Patrick McHardy 86f1ec3231 netfilter: nf_tables: fix userdata length overflow ...

The NFT_USERDATA_MAXLEN is defined to 256, however we only have a u8
to store its size. Introduce a struct nft_userdata which contains a
length field and indicate its presence using a single bit in the rule.

The length field of struct nft_userdata is also a u8, however we don't
store zero sized data, so the actual length is udata->len + 1.

Signed-off-by: Patrick McHardy <[email protected]>
Signed-off-by: Pablo Neira Ayuso <[email protected]>

2015-03-04 18:46:06 +01:00

..

ipv4

netfilter: combine IPv4 and IPv6 nf_nat_redirect code in one module

2014-11-27 13:08:42 +01:00

ipv6

netfilter: combine IPv4 and IPv6 nf_nat_redirect code in one module

2014-11-27 13:08:42 +01:00

br_netfilter.h

netfilter: explicit module dependency between br_netfilter and physdev

2014-10-02 18:30:57 +02:00

nf_conntrack_acct.h

…

nf_conntrack_core.h

netfilter: Convert print_tuple functions to return void

2014-11-05 14:10:33 -05:00

nf_conntrack_ecache.h

netfilter: conntrack: remove timer from ecache extension

2014-06-25 19:15:38 +02:00

nf_conntrack_expect.h

…

nf_conntrack_extend.h

netfilter: nf_conntrack: reserve two bytes for nf_ct_ext->len

2014-04-03 23:52:31 +02:00

nf_conntrack_helper.h

…

nf_conntrack_l3proto.h

netfilter: Convert print_tuple functions to return void

2014-11-05 14:10:33 -05:00

nf_conntrack_l4proto.h

netfilter: Convert print_tuple functions to return void

2014-11-05 14:10:33 -05:00

nf_conntrack_labels.h

netfilter: nft_ct: labels get support

2014-02-19 11:41:25 +01:00

nf_conntrack_seqadj.h

…

nf_conntrack_synproxy.h

…

nf_conntrack_timeout.h

…

nf_conntrack_timestamp.h

…

nf_conntrack_tuple.h

…

nf_conntrack_zones.h

…

nf_conntrack.h

netfilter: conntrack: Remove nf_ct_conntrack_flush_report

2015-01-08 12:16:58 +01:00

nf_log.h

netfilter: bridge: add generic packet logger

2014-06-27 13:20:47 +02:00

nf_nat_core.h

…

nf_nat_helper.h

…

nf_nat_l3proto.h

netfilter: nat: move specific NAT IPv6 to core

2014-09-09 16:30:00 +02:00

nf_nat_l4proto.h

…

nf_nat_redirect.h

netfilter: combine IPv4 and IPv6 nf_nat_redirect code in one module

2014-11-27 13:08:42 +01:00

nf_nat.h

netfilter: fix compilation of masquerading without IP_NF_TARGET_MASQUERADE

2014-09-11 17:02:45 +02:00

nf_queue.h

…

nf_tables_bridge.h

netfilter: nf_tables_bridge: export nft_reject_ip*hdr_validate functions

2014-11-27 12:58:05 +01:00

nf_tables_core.h

netfilter: nf_tables: fix nft_cmp_fast failure on big endian for size < 4

2014-04-14 10:38:02 +02:00

nf_tables_ipv4.h

…

nf_tables_ipv6.h

…

nf_tables.h

netfilter: nf_tables: fix userdata length overflow

2015-03-04 18:46:06 +01:00

nfnetlink_log.h

…

nfnetlink_queue.h

…

nft_masq.h

netfilter: nf_tables: restrict nat/masq expressions to nat chain type

2014-10-13 20:42:00 +02:00

nft_meta.h

netfilter: nf_tables: Make meta expression core functions public

2014-04-23 13:55:30 +02:00

nft_redir.h

netfilter: nf_tables: add new expression nft_redir

2014-10-27 22:49:39 +01:00

nft_reject.h

netfilter: nft_reject: introduce icmp code abstraction for inet and bridge

2014-10-02 18:29:57 +02:00

xt_rateest.h

…