summaryrefslogtreecommitdiffstats
path: root/net/ipv6/xfrm6_input.c
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2017-12-30 22:41:46 +0100
committerPablo Neira Ayuso <pablo@netfilter.org>2018-01-08 18:11:04 +0100
commita7f87b47e67e4341f6175cdb80e5c2eaadf30dcb (patch)
tree47f8be7118f28a8d3f4920968c96d3cb596d7ef2 /net/ipv6/xfrm6_input.c
parentf6931f5f5b713705c3cc91e4f9c222f2b181e2ef (diff)
downloadlinux-a7f87b47e67e4341f6175cdb80e5c2eaadf30dcb.tar.gz
linux-a7f87b47e67e4341f6175cdb80e5c2eaadf30dcb.tar.bz2
linux-a7f87b47e67e4341f6175cdb80e5c2eaadf30dcb.zip
netfilter: remove defensive check on malformed packets from raw sockets
Users cannot forge malformed IPv4/IPv6 headers via raw sockets that they can inject into the stack. Specifically, not for IPv4 since 55888dfb6ba7 ("AF_RAW: Augment raw_send_hdrinc to expand skb to fit iphdr->ihl (v2)"). IPv6 raw sockets also ensure that packets have a well-formed IPv6 header available in the skbuff. At quick glance, br_netfilter also validates layer 3 headers and it drops malformed both IPv4 and IPv6 packets. Therefore, let's remove this defensive check all over the place. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/ipv6/xfrm6_input.c')
0 files changed, 0 insertions, 0 deletions