TEE: make skb writable before attempting checksum update

This also adds the compat function xtnu_skb_make_writable().

diff --git a/extensions/compat_xtables.c b/extensions/compat_xtables.c
index a2e3d81d1dea9b09adf30f0abfd9a6c906a0889b..cea80e7cb2be69532df5fb1e816a1c63df821bf7 100644 (file)
--- a/extensions/compat_xtables.c
+++ b/extensions/compat_xtables.c
@@ -309,6 +309,18 @@ int xtnu_ip_route_me_harder(struct sk_buff *skb, unsigned int addr_type)
        return ret;
 }
 EXPORT_SYMBOL_GPL(xtnu_ip_route_me_harder);
+
+int xtnu_skb_make_writable(struct sk_buff *skb, unsigned int len)
+{
+       struct sk_buff *nskb = skb;
+       int ret;
+
+       ret = skb_make_writable(&skb, len);
+       if (nskb != skb)
+               return unable(__func__);
+       return ret;
+}
+EXPORT_SYMBOL_GPL(xtnu_skb_make_writable);
 #endif
 
 #if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 24)

diff --git a/extensions/compat_xtables.h b/extensions/compat_xtables.h
index 75741df731c664ce2d35e007a5f43dd6b00c7af5..42357bb8d1f2bb0f34a9432a93c435cf17d284fe 100644 (file)
--- a/extensions/compat_xtables.h
+++ b/extensions/compat_xtables.h
@@ -59,6 +59,7 @@
 #if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 23)
 #      define xt_target             xtnu_target
 #      define ip_route_me_harder    xtnu_ip_route_me_harder
+#      define skb_make_writable     xtnu_skb_make_writable
 #      define xt_register_target    xtnu_register_target
 #      define xt_unregister_target  xtnu_unregister_target
 #      define xt_register_targets   xtnu_register_targets

diff --git a/extensions/compat_xtnu.h b/extensions/compat_xtnu.h
index c1be6141d426b736ecc4295011055f77b61eec5d..5fe8e2f044b08b6b89f1dd793448727b10869207 100644 (file)
--- a/extensions/compat_xtnu.h
+++ b/extensions/compat_xtnu.h
@@ -69,6 +69,7 @@ static inline struct xtnu_target *xtcompat_nutarget(const struct xt_target *t)
 
 extern int xtnu_ip_local_out(struct sk_buff *);
 extern int xtnu_ip_route_me_harder(struct sk_buff *, unsigned int);
+extern int xtnu_skb_make_writable(struct sk_buff *, unsigned int);
 extern int xtnu_register_match(struct xtnu_match *);
 extern int xtnu_ip_route_output_key(void *, struct rtable **, struct flowi *);
 extern void xtnu_unregister_match(struct xtnu_match *);

diff --git a/extensions/xt_TEE.c b/extensions/xt_TEE.c
index fa4305b04c80e23baeacaf8591465a0b0067defc..45784284af7a8e0d80d1698119388a14826fc388 100644 (file)
--- a/extensions/xt_TEE.c
+++ b/extensions/xt_TEE.c
@@ -158,6 +158,9 @@ tee_tg(struct sk_buff *skb, const struct net_device *in,
        }
 #endif
 
+       if (!skb_make_writable(skb, sizeof(struct iphdr)))
+               return NF_DROP;
+
        /*
         * If we are in INPUT, the checksum must be recalculated since
         * the length could have changed as a result of defragmentation.