[NETFILTER] ip_queue: Fix wrong skb->len == nlmsg_len assumption

The size of the skb carrying the netlink message is not
equivalent to the length of the actual netlink message
due to padding. ip_queue matches the length of the payload
against the original packet size to determine if packet
mangling is desired, due to the above wrong assumption
arbitary packets may not be mangled depening on their
original size.

Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 36339eb39e172b3c0fa7dab9f816ced70003d51b..08f80e2ea2aa0fe1a1bd214de7384726dee4f209 100644 (file)
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -524,7 +524,7 @@ ipq_rcv_skb(struct sk_buff *skb)
        write_unlock_bh(&queue_lock);
        
        status = ipq_receive_peer(NLMSG_DATA(nlh), type,
-                                 skblen - NLMSG_LENGTH(0));
+                                 nlmsglen - NLMSG_LENGTH(0));
        if (status < 0)
                RCV_SKB_FAIL(status);
                

diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 5027bbe6415e7e89da9d27fcbc797c1f7432b2ee..af0635084df8217dcc226a82c1a4ea3183e4df58 100644 (file)
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -522,7 +522,7 @@ ipq_rcv_skb(struct sk_buff *skb)
        write_unlock_bh(&queue_lock);
        
        status = ipq_receive_peer(NLMSG_DATA(nlh), type,
-                                 skblen - NLMSG_LENGTH(0));
+                                 nlmsglen - NLMSG_LENGTH(0));
        if (status < 0)
                RCV_SKB_FAIL(status);