diff options
| author |   Pablo Neira Ayuso <pablo@netfilter.org> | 2017-03-04 19:53:47 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2017-03-08 18:35:27 +0100 |
| commit | 568af6de058cb2b0c5b98d98ffcf37cdc6bc38a7 (patch) | |
| tree | 000dfbb55d053468114e829260c06b0f2e5f8298 /net/netfilter/nft_set_bitmap.c | |
| parent | netfilter: nf_nat_sctp: fix ICMP packet to be dropped accidently (diff) | |
| download | linux-dev-568af6de058cb2b0c5b98d98ffcf37cdc6bc38a7.tar.xz linux-dev-568af6de058cb2b0c5b98d98ffcf37cdc6bc38a7.zip | |
netfilter: nf_tables: set pktinfo->thoff at AH header if found
Phil Sutter reports that IPv6 AH header matching is broken. From
userspace, nft generates bytecode that expects to find the AH header at
NFT_PAYLOAD_TRANSPORT_HEADER both for IPv4 and IPv6. However,
pktinfo->thoff is set to the inner header after the AH header in IPv6,
while in IPv4 pktinfo->thoff points to the AH header indeed. This
behaviour is inconsistent. This patch fixes this problem by updating
ipv6_find_hdr() to get the IP6_FH_F_AUTH flag so this function stops at
the AH header, so both IPv4 and IPv6 pktinfo->thoff point to the AH
header.
This is also inconsistent when trying to match encapsulated headers:
1) A packet that looks like IPv4 + AH + TCP dport 22 will *not* match.
2) A packet that looks like IPv6 + AH + TCP dport 22 will match.
Reported-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/nft_set_bitmap.c')
0 files changed, 0 insertions, 0 deletions