aboutsummaryrefslogtreecommitdiff
path: root/net/netfilter
diff options
context:
space:
mode:
authorPhil Oester <kernel@linuxace.com>2013-06-12 10:58:20 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2013-06-12 11:06:19 +0200
commitb396966c4688522863572927cb30aa874b3ec504 (patch)
tree2ab7edf42c311da4d04b33788c76cca272e730fa /net/netfilter
parent70d19f805f8c047fc0a28dec9306b3773971c8d9 (diff)
netfilter: xt_TCPMSS: Fix missing fragmentation handling
Similar to commit bc6bcb59 ("netfilter: xt_TCPOPTSTRIP: fix possible mangling beyond packet boundary"), add safe fragment handling to xt_TCPMSS. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter')
-rw-r--r--net/netfilter/xt_TCPMSS.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index 6640a224f9f..7011c71646f 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -57,6 +57,10 @@ tcpmss_mangle_packet(struct sk_buff *skb,
u16 newmss;
u8 *opt;
+ /* This is a fragment, no TCP header is available */
+ if (par->fragoff != 0)
+ return XT_CONTINUE;
+
if (!skb_make_writable(skb, skb->len))
return -1;