[PATCH] [EBTABLES] copy skb when shared

Hi Dave,

The patch below, for the ebtables target modules, adds checks to see if the
skbuff is shared, before doing any alterations to the data.

Please apply,
Bart

--- linux-2.6.0-test1/net/bridge/netfilter/ebt_snat.c.old	2003-07-19 21:49:23.000000000 +0200
+++ linux-2.6.0-test1/net/bridge/netfilter/ebt_snat.c	2003-07-19 22:39:17.000000000 +0200
@@ -11,6 +11,7 @@
 #include <linux/netfilter_bridge/ebtables.h>
 #include <linux/netfilter_bridge/ebt_nat.h>
 #include <linux/module.h>
+#include <net/sock.h>
 
 static int ebt_target_snat(struct sk_buff **pskb, unsigned int hooknr,
    const struct net_device *in, const struct net_device *out,
@@ -18,6 +19,17 @@ static int ebt_target_snat(struct sk_buf
 {
 	struct ebt_nat_info *info = (struct ebt_nat_info *) data;

+	if (skb_shared(*pskb) || skb_cloned(*pskb)) {
+		struct sk_buff *nskb;
+
+		nskb = skb_copy(*pskb, GFP_ATOMIC);
+		if (!nskb)
+			return NF_DROP;
+		if ((*pskb)->sk)
+			skb_set_owner_w(nskb, (*pskb)->sk);
+		kfree_skb(*pskb);
+		*pskb = nskb;
+	}
 	memcpy(((**pskb).mac.ethernet)->h_source, info->mac,
 	   ETH_ALEN * sizeof(unsigned char));
 	return info->target;
--- linux-2.6.0-test1/net/bridge/netfilter/ebt_dnat.c.old	2003-07-19 21:38:52.000000000 +0200
+++ linux-2.6.0-test1/net/bridge/netfilter/ebt_dnat.c	2003-07-19 21:49:10.000000000 +0200
@@ -19,6 +19,17 @@ static int ebt_target_dnat(struct sk_buf
 {
 	struct ebt_nat_info *info = (struct ebt_nat_info *)data;
 
+	if (skb_shared(*pskb) || skb_cloned(*pskb)) {
+		struct sk_buff *nskb;
+
+		nskb = skb_copy(*pskb, GFP_ATOMIC);
+		if (!nskb)
+			return NF_DROP;
+		if ((*pskb)->sk)
+			skb_set_owner_w(nskb, (*pskb)->sk);
+		kfree_skb(*pskb);
+		*pskb = nskb;
+	}
 	memcpy(((**pskb).mac.ethernet)->h_dest, info->mac,
 	   ETH_ALEN * sizeof(unsigned char));
 	return info->target;
--- linux-2.6.0-test1/net/bridge/netfilter/ebt_redirect.c.old	2003-07-19 21:50:09.000000000 +0200
+++ linux-2.6.0-test1/net/bridge/netfilter/ebt_redirect.c	2003-07-19 21:50:19.000000000 +0200
@@ -20,6 +20,17 @@ static int ebt_target_redirect(struct sk
 {
 	struct ebt_redirect_info *info = (struct ebt_redirect_info *)data;
 
+	if (skb_shared(*pskb) || skb_cloned(*pskb)) {
+		struct sk_buff *nskb;
+
+		nskb = skb_copy(*pskb, GFP_ATOMIC);
+		if (!nskb)
+			return NF_DROP;
+		if ((*pskb)->sk)
+			skb_set_owner_w(nskb, (*pskb)->sk);
+		kfree_skb(*pskb);
+		*pskb = nskb;
+	}
 	if (hooknr != NF_BR_BROUTING)
 		memcpy((**pskb).mac.ethernet->h_dest,
 		   in->br_port->br->dev->dev_addr, ETH_ALEN);



-------------------------------------------------------
This SF.net email is sponsored by: VM Ware
With VMware you can run multiple operating systems on a single machine.
WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the
same time. Free trial click here: http://www.vmware.com/wl/offer/345/0