OSF: pom-ng - linux-2.6.

@@ -52,14 +52,15 @@
 
 #include "ipt_osf.h"
 
-#define OSF_DEBUG
+//#define OSF_DEBUG
+#undef OSF_DEBUG
 
 #ifdef OSF_DEBUG
 #define log(x...) 		printk(KERN_INFO "ipt_osf: " x)
 #define loga(x...) 		printk(x)
 #else
-#define log(x...) 		do {} while(0)
-#define loga(x...) 		do {} while(0)
+#define log(x...)
+#define loga(x...)
 #endif
 
 #define FMATCH_WRONG		0

@@ -76,7 +77,7 @@
 static struct list_head	finger_list;	
 static int match(const struct sk_buff *, const struct net_device *, const struct net_device *,
 		      const void *, int, 
-		      const void *, u_int16_t, 
+		      //const void *, u_int16_t, 
 		      int *);
 static int checkentry(const char *, const struct ipt_ip *, void *,
 		           unsigned int, unsigned int);

@@ -153,7 +154,7 @@
 static int
 match(const struct sk_buff *skb, const struct net_device *in, const struct net_device *out,
       const void *matchinfo, int offset,
-      const void *hdr, u_int16_t datalen,
+      //const void *hdr, u_int16_t datalen,
       int *hotdrop)
 {
 	struct ipt_osf_info *info = (struct ipt_osf_info *)matchinfo;

@@ -184,7 +185,6 @@
 		optsize = tcp->doff*4 - sizeof(struct tcphdr);
 	}
 
-	
 	/* Actually we can create hash/table of all genres and search
 	 * only in appropriate part, but here is initial variant,
 	 * so will use slow path.

@@ -414,7 +414,10 @@
 	}
 
 	read_unlock(&osf_lock);
-
+	
+	if (fcount)
+		fmatch = FMATCH_OK;
+	
 	return (fmatch == FMATCH_OK)?1:0;
 }
 

@@ -600,9 +603,10 @@
 {
 	struct list_head *ent;
 	struct osf_finger *f = NULL;
-	int i;
+	int i, __count, err;
 	
 	*eof = 1;
+	__count = count;
 	count = 0;
 
 	read_lock_bh(&osf_lock);

@@ -612,10 +616,13 @@
 
 		log("%s [%s]", f->genre, f->details);
 		
-		count += sprintf(buf+count, "%s - %s[%s] : %s", 
+		err = snprintf(buf+count, __count-count, "%s - %s[%s] : %s", 
 					f->genre, f->version,
 					f->subtype, f->details);
-		
+		if (err == 0 || __count <= count + err)
+			break;
+		else
+			count += err;
 		if (f->opt_num)
 		{
 			loga(" OPT: ");

@@ -629,7 +636,11 @@
 			}
 		}
 		loga("\n");
-		count += sprintf(buf+count, "\n");
+		err = snprintf(buf+count, __count-count, "\n");
+		if (err == 0 || __count <= count + err)
+			break;
+		else
+			count += err;
 	}
 	read_unlock_bh(&osf_lock);
 

@@ -844,8 +855,8 @@
 	
 	remove_proc_entry("sys/net/ipv4/osf", NULL);
 	ipt_unregister_match(&osf_match);
-	if (nts && nts->socket)
-		sock_release(nts->socket);
+	if (nts && nts->sk_socket)
+		sock_release(nts->sk_socket);
 
 	list_for_each_safe(ent, n, &finger_list)
 	{

148 lines not on this page · raw message

863 lines not on this page · raw message

@@ -158,20 +158,30 @@
       int *hotdrop)
 {
 	struct ipt_osf_info *info = (struct ipt_osf_info *)matchinfo;
-	struct iphdr *ip = skb->nh.iph;
-	struct tcphdr *tcp;
+	struct iphdr _iph, *ip;
+	struct tcphdr _tcph, *tcp;
 	int fmatch = FMATCH_WRONG, fcount = 0;
 	unsigned long totlen, optsize = 0, window;
 	unsigned char df, *optp = NULL, *_optp = NULL;
+	unsigned char opts[MAX_IPOPTLEN];
 	char check_WSS = 0;
 	struct list_head *ent;
 	struct osf_finger *f;
+	int off;
 
-	if (!ip || !info)
+	if (!info)
+		return 0;
+	
+	off = 0;
+	
+	ip = skb_header_pointer(skb, off, sizeof(_iph), &_iph);
+	if (!ip)
 		return 0;
 				
-	tcp = (struct tcphdr *)((u_int32_t *)ip + ip->ihl);
-
+	tcp = skb_header_pointer(skb, off + ip->ihl * 4, sizeof(_tcph), &_tcph);
+	if (!tcp)
+		return 0;
+	
 	if (!tcp->syn)
 		return 0;
 	

@@ -181,8 +191,16 @@
 	
 	if (tcp->doff*4 > sizeof(struct tcphdr))
 	{
-		_optp = optp = (char *)(tcp+1);
 		optsize = tcp->doff*4 - sizeof(struct tcphdr);
+
+		if (optsize > sizeof(opts))
+		{
+			log("%s: BUG: too big options size: optsize=%lu, max=%d.\n",
+					__func__, optsize, sizeof(opts));
+			optsize = sizeof(opts);
+		}
+		
+		_optp = optp = skb_header_pointer(skb, off + ip->ihl*4 + sizeof(_tcph), optsize, opts);
 	}
 
 	/* Actually we can create hash/table of all genres and search

@@ -375,7 +393,7 @@
 		if (optp)
 		{
 			optsize = tcp->doff * 4 - sizeof(struct tcphdr);
-			if (skb_copy_bits(skb, ip->ihl*4 + sizeof(struct tcphdr),
+			if (skb_copy_bits(skb, off + ip->ihl*4 + sizeof(struct tcphdr),
 					  opt, optsize) < 0)
 			{
 				if (info->flags & IPT_OSF_LOG)