diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2017-03-04 19:53:47 +0100 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2017-03-08 18:35:27 +0100 |
commit | 568af6de058cb2b0c5b98d98ffcf37cdc6bc38a7 (patch) | |
tree | 000dfbb55d053468114e829260c06b0f2e5f8298 /.mailmap | |
parent | 8e05ba7f848475bdc3aa546cf88418f7e51a6671 (diff) |
netfilter: nf_tables: set pktinfo->thoff at AH header if found
Phil Sutter reports that IPv6 AH header matching is broken. From
userspace, nft generates bytecode that expects to find the AH header at
NFT_PAYLOAD_TRANSPORT_HEADER both for IPv4 and IPv6. However,
pktinfo->thoff is set to the inner header after the AH header in IPv6,
while in IPv4 pktinfo->thoff points to the AH header indeed. This
behaviour is inconsistent. This patch fixes this problem by updating
ipv6_find_hdr() to get the IP6_FH_F_AUTH flag so this function stops at
the AH header, so both IPv4 and IPv6 pktinfo->thoff point to the AH
header.
This is also inconsistent when trying to match encapsulated headers:
1) A packet that looks like IPv4 + AH + TCP dport 22 will *not* match.
2) A packet that looks like IPv6 + AH + TCP dport 22 will match.
Reported-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to '.mailmap')
0 files changed, 0 insertions, 0 deletions