neigh: Protect neigh->ha[] with a seqlock

[net-next-2.6.git] / net / bridge / br_netfilter.c

diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 2c911c0759c27bb6e4867b3bce9af0af3946d288..77f7b5fda45a534dfb9c81c9d58324beff3a073e 100644 (file)
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -162,8 +162,8 @@ static inline struct nf_bridge_info *nf_bridge_unshare(struct sk_buff *skb)
                if (tmp) {
                        memcpy(tmp, nf_bridge, sizeof(struct nf_bridge_info));
                        atomic_set(&tmp->use, 1);
-                       nf_bridge_put(nf_bridge);
                }
+               nf_bridge_put(nf_bridge);
                nf_bridge = tmp;
        }
        return nf_bridge;
@@ -209,6 +209,72 @@ static inline void nf_bridge_update_protocol(struct sk_buff *skb)
                skb->protocol = htons(ETH_P_PPP_SES);
 }
 
+/* When handing a packet over to the IP layer
+ * check whether we have a skb that is in the
+ * expected format
+ */
+
+int br_parse_ip_options(struct sk_buff *skb)
+{
+       struct ip_options *opt;
+       struct iphdr *iph;
+       struct net_device *dev = skb->dev;
+       u32 len;
+
+       iph = ip_hdr(skb);
+       opt = &(IPCB(skb)->opt);
+
+       /* Basic sanity checks */
+       if (iph->ihl < 5 || iph->version != 4)
+               goto inhdr_error;
+
+       if (!pskb_may_pull(skb, iph->ihl*4))
+               goto inhdr_error;
+
+       iph = ip_hdr(skb);
+       if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl)))
+               goto inhdr_error;
+
+       len = ntohs(iph->tot_len);
+       if (skb->len < len) {
+               IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_INTRUNCATEDPKTS);
+               goto drop;
+       } else if (len < (iph->ihl*4))
+               goto inhdr_error;
+
+       if (pskb_trim_rcsum(skb, len)) {
+               IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_INDISCARDS);
+               goto drop;
+       }
+
+       /* Zero out the CB buffer if no options present */
+       if (iph->ihl == 5) {
+               memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
+               return 0;
+       }
+
+       opt->optlen = iph->ihl*4 - sizeof(struct iphdr);
+       if (ip_options_compile(dev_net(dev), opt, skb))
+               goto inhdr_error;
+
+       /* Check correct handling of SRR option */
+       if (unlikely(opt->srr)) {
+               struct in_device *in_dev = __in_dev_get_rcu(dev);
+               if (in_dev && !IN_DEV_SOURCE_ROUTE(in_dev))
+                       goto drop;
+
+               if (ip_options_rcv_srr(skb))
+                       goto drop;
+       }
+
+       return 0;
+
+inhdr_error:
+       IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_INHDRERRORS);
+drop:
+       return -1;
+}
+
 /* Fill in the header for fragmented IP packets handled by
  * the IPv4 connection tracking code.
  */
@@ -549,7 +615,6 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
 {
        struct net_bridge_port *p;
        struct net_bridge *br;
-       struct iphdr *iph;
        __u32 len = nf_bridge_encap_header_len(skb);
 
        if (unlikely(!pskb_may_pull(skb, len)))
@@ -578,28 +643,9 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
 
        nf_bridge_pull_encap_header_rcsum(skb);
 
-       if (!pskb_may_pull(skb, sizeof(struct iphdr)))
-               goto inhdr_error;
-
-       iph = ip_hdr(skb);
-       if (iph->ihl < 5 || iph->version != 4)
-               goto inhdr_error;
-
-       if (!pskb_may_pull(skb, 4 * iph->ihl))
-               goto inhdr_error;
-
-       iph = ip_hdr(skb);
-       if (ip_fast_csum((__u8 *) iph, iph->ihl) != 0)
-               goto inhdr_error;
-
-       len = ntohs(iph->tot_len);
-       if (skb->len < len || len < 4 * iph->ihl)
-               goto inhdr_error;
-
-       pskb_trim_rcsum(skb, len);
-
-       /* BUG: Should really parse the IP options here. */
-       memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
+       if (br_parse_ip_options(skb))
+               /* Drop invalid packet */
+               goto out;
 
        nf_bridge_put(skb->nf_bridge);
        if (!nf_bridge_alloc(skb))
@@ -614,8 +660,6 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
 
        return NF_STOLEN;
 
-inhdr_error:
-//      IP_INC_STATS_BH(IpInHdrErrors);
 out:
        return NF_DROP;
 }
@@ -759,12 +803,19 @@ static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff *skb,
 #if defined(CONFIG_NF_CONNTRACK_IPV4) || defined(CONFIG_NF_CONNTRACK_IPV4_MODULE)
 static int br_nf_dev_queue_xmit(struct sk_buff *skb)
 {
+       int ret;
+
        if (skb->nfct != NULL && skb->protocol == htons(ETH_P_IP) &&
            skb->len + nf_bridge_mtu_reduction(skb) > skb->dev->mtu &&
-           !skb_is_gso(skb))
-               return ip_fragment(skb, br_dev_queue_push_xmit);
-       else
-               return br_dev_queue_push_xmit(skb);
+           !skb_is_gso(skb)) {
+               if (br_parse_ip_options(skb))
+                       /* Drop invalid packet */
+                       return NF_DROP;
+               ret = ip_fragment(skb, br_dev_queue_push_xmit);
+       } else
+               ret = br_dev_queue_push_xmit(skb);
+
+       return ret;
 }
 #else
 static int br_nf_dev_queue_xmit(struct sk_buff *skb)