summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJozsef Kadlecsik <kadlec@blackhole.kfki.hu>2013-09-16 18:00:08 (GMT)
committerJozsef Kadlecsik <kadlec@blackhole.kfki.hu>2013-09-16 18:33:44 (GMT)
commit55524c219aa803887d1c247853842a9566598cba (patch)
tree5c9a194f8b6f30310e944a3864e333edba013648
parentd830f0fa1dd7ca447c38aec82cd44230e0b7ca75 (diff)
downloadlinux-55524c219aa803887d1c247853842a9566598cba.tar.xz
netfilter: ipset: Skip really non-first fragments for IPv6 when getting port/protocol
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
-rw-r--r--net/netfilter/ipset/ip_set_getport.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/net/netfilter/ipset/ip_set_getport.c b/net/netfilter/ipset/ip_set_getport.c
index 6fdf88a..dac156f 100644
--- a/net/netfilter/ipset/ip_set_getport.c
+++ b/net/netfilter/ipset/ip_set_getport.c
@@ -116,12 +116,12 @@ ip_set_get_ip6_port(const struct sk_buff *skb, bool src,
{
int protoff;
u8 nexthdr;
- __be16 frag_off;
+ __be16 frag_off = 0;
nexthdr = ipv6_hdr(skb)->nexthdr;
protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,
&frag_off);
- if (protoff < 0)
+ if (protoff < 0 || (frag_off & htons(~0x7)) != 0)
return false;
return get_port(skb, nexthdr, protoff, src, port, proto);