diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2017-03-04 18:53:47 (GMT) |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-10-08 08:26:11 (GMT) |
commit | 625cb13a89295b298d6e0f323cfa2882fb5c05b6 (patch) | |
tree | e61aae6f51461c47f589e7baa76a8c6fa442f2d2 /firmware/vicam | |
parent | 4131c889c27843199874d7f2ba3442190cce2b41 (diff) | |
download | linux-625cb13a89295b298d6e0f323cfa2882fb5c05b6.tar.xz |
netfilter: nf_tables: set pktinfo->thoff at AH header if found
[ Upstream commit 568af6de058cb2b0c5b98d98ffcf37cdc6bc38a7 ]
Phil Sutter reports that IPv6 AH header matching is broken. From
userspace, nft generates bytecode that expects to find the AH header at
NFT_PAYLOAD_TRANSPORT_HEADER both for IPv4 and IPv6. However,
pktinfo->thoff is set to the inner header after the AH header in IPv6,
while in IPv4 pktinfo->thoff points to the AH header indeed. This
behaviour is inconsistent. This patch fixes this problem by updating
ipv6_find_hdr() to get the IP6_FH_F_AUTH flag so this function stops at
the AH header, so both IPv4 and IPv6 pktinfo->thoff point to the AH
header.
This is also inconsistent when trying to match encapsulated headers:
1) A packet that looks like IPv4 + AH + TCP dport 22 will *not* match.
2) A packet that looks like IPv6 + AH + TCP dport 22 will match.
Reported-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'firmware/vicam')
0 files changed, 0 insertions, 0 deletions