On Thu, Feb 12, 2009 at 09:12:05PM +0100, Jan Engelhardt (jengelh@xxxxxxxxxx) wrote: > >> >+config IP_NF_MATCH_OSF > >> >+ tristate '"osf" match support' > >> >+ depends on NETFILTER_ADVANCED && CONNECTOR > >> >+ help > >> >+ Passive OS fingerprint matching module. > >> >+ You should download and install rule loading software from > >> >+ http://www.ioremap.net/projects/osf > >> >+ > >> >+ To compile it as a module, choose M here. If unsure, say N. > >> >+ > >> > >> Please do use NETFILTER_XT_ and its section. > > > >What's this? It does not exist in the net/ipv4/netfilter/Kconfig > > net/netfilter/Kconfig: (e.g.) > > config NETFILTER_XT_MATCH_COMMENT > tristate '"comment" match support' > depends on NETFILTER_ADVANCED > ---help--- But I placed OSF into net/ipv4/netfilter/ipt_osf.c, should it be moved into different location? > >> >+ for (optnum = 0; optnum < f->opt_num; ++optnum) { > >> >+ if (f->opt[optnum].kind == (*optp)) { > >> >+ __u32 len = f->opt[optnum].length; > >> >+ __u8 *optend = optp + len; > >> >+ int loop_cont = 0; > >> >+ > >> >+ fmatch = FMATCH_OK; > >> >+ > >> >+ switch (*optp) { > >> >+ case OSFOPT_MSS: > >> >+ mss = ntohs(*(u16 *)(optp + 2)); > >> > >> This needs get_unaligned(), in case someone sends a malicious packet. > > > >Hmmm, why is this needed? We dereference linear kernel pointer at > >proper offset (modulo of the option size). > > What if optp is odd? It cant, header is fixed and every option length is also fixed (and its size is checked). -- Evgeniy Polyakov -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
