diff options
| author | Florian Westphal <fw@strlen.de> | 2026-09-05 07:01:50 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2026-10-19 13:50:36 +0200 |
| commit | c2226f0c7fe90b67732e5ae36dc5c3cc01ddf888 (patch) | |
| tree | 7a0eef8abce0649c797bca6337cf6cec15bb5aaa /tools/perf/scripts/python/bin | |
| parent | 48d522b65fb0ce2bd54f8f5838d77b48afcf1f3e (diff) | |
netfilter: nft_payload: restrict checksum offsets to known values
We need to prevent userspace from corrupting e.g. tcp->doff, because
many locations in conntrack and conntrack helpers rely on
nf_conntrack_in() having validated the packet headers.
nft_payload allows to alter headers later which invalidates this
assumption.
The 'Fixes' commit restricts writes to safe fields, but there is
another side channel: the checksum location.
Restrict this too. Reported via sashiko/gemini.
Fixes: 112e447d17f7 ("netfilter: validate L4 headers after userspace packet writes")
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'tools/perf/scripts/python/bin')
0 files changed, 0 insertions, 0 deletions