Pablo Neira Ayuso 568af6de05
netfilter: nf_tables: set pktinfo->thoff at AH header if found ...
Phil Sutter reports that IPv6 AH header matching is broken. From
userspace, nft generates bytecode that expects to find the AH header at
NFT_PAYLOAD_TRANSPORT_HEADER both for IPv4 and IPv6. However,
pktinfo->thoff is set to the inner header after the AH header in IPv6,
while in IPv4 pktinfo->thoff points to the AH header indeed. This
behaviour is inconsistent. This patch fixes this problem by updating
ipv6_find_hdr() to get the IP6_FH_F_AUTH flag so this function stops at
the AH header, so both IPv4 and IPv6 pktinfo->thoff point to the AH
header.
This is also inconsistent when trying to match encapsulated headers:
1) A packet that looks like IPv4 + AH + TCP dport 22 will *not* match.
2) A packet that looks like IPv6 + AH + TCP dport 22 will match.
Reported-by: Phil Sutter <phil@nwl.cc >
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org >
2017-03-08 18:35:27 +01:00
2017-01-12 04:01:17 -05:00
2017-03-02 08:42:38 +01:00
2015-09-21 16:03:04 -07:00
2017-03-08 18:35:27 +01:00
2017-02-03 16:58:20 -05:00
2016-07-11 02:01:14 +02:00
2016-02-11 03:54:14 -05:00
2017-02-20 10:26:09 -05:00
2017-02-10 13:18:33 -05:00
2016-06-15 20:41:22 -07:00
2017-01-25 12:37:04 -05:00
2017-01-18 13:04:28 -05:00
2015-09-17 13:20:05 +02:00
2016-09-08 11:10:12 +01:00
2016-09-04 13:29:29 -07:00
2016-08-02 02:57:29 +03:00
2017-02-07 13:07:46 -05:00
2015-06-28 16:55:44 -07:00
2016-02-09 04:45:49 -05:00
2015-07-27 01:05:24 -07:00
2016-11-18 10:59:15 -05:00
2017-03-02 08:42:32 +01:00
2016-06-27 15:06:17 -04:00
2017-02-27 18:43:47 -08:00
2016-07-08 12:20:57 +02:00
2017-01-20 12:12:13 -05:00
2017-02-04 19:44:22 -05:00
2016-04-19 20:09:25 -04:00
2016-04-25 16:44:27 -04:00
2016-06-25 12:19:35 -04:00
2016-04-25 16:44:27 -04:00
2016-06-09 23:41:03 -07:00
2016-11-24 16:01:14 -05:00
2015-09-17 17:18:37 -07:00
2017-02-10 13:51:04 -05:00
2016-02-16 20:21:48 -05:00
2016-11-09 13:41:54 -05:00
2017-02-07 13:07:46 -05:00
2017-02-11 21:25:18 -05:00
2015-09-23 15:33:15 -07:00
2016-11-04 14:45:23 -04:00
2017-01-11 11:02:47 -05:00
2016-12-12 19:25:04 -08:00
2016-11-09 23:45:28 +01:00
2016-05-20 18:03:16 -04:00
2016-09-30 13:29:21 +02:00
2016-09-30 13:29:21 +02:00
2016-12-05 15:21:59 -05:00
2016-11-13 12:14:59 -05:00
2016-06-17 20:23:32 -07:00
2016-08-18 01:17:32 -04:00
2017-02-08 14:38:18 -05:00
2016-07-25 17:55:43 -07:00
2016-03-14 12:19:46 -04:00
2016-04-27 22:48:25 -04:00
2017-01-25 16:00:33 +01:00
2016-01-04 20:40:41 +01:00
2017-01-27 10:25:34 -05:00
2017-02-03 15:16:45 -05:00
2015-12-15 23:25:20 -05:00
2017-01-18 13:04:28 -05:00
2016-04-04 22:11:20 -04:00
2017-01-25 14:12:21 -05:00
2017-01-18 13:04:28 -05:00
2016-08-13 15:08:00 -07:00
2017-01-20 11:27:22 -05:00
2017-01-18 13:04:29 -05:00
2017-01-25 14:04:38 -05:00
2016-12-29 11:38:31 -05:00
2015-12-16 00:14:12 -05:00
2016-03-13 23:55:13 -04:00
2017-02-04 19:58:14 -05:00
2016-11-04 14:45:23 -04:00
2016-11-02 15:18:36 -04:00
2017-02-10 11:32:13 -05:00
2017-02-03 15:21:21 -05:00
2017-02-02 14:31:57 +01:00
2017-01-24 12:10:51 -05:00
2017-01-31 13:16:59 -05:00
2017-01-13 09:38:42 +01:00
2016-08-17 19:36:23 -04:00
2016-10-13 12:05:26 -04:00
2017-02-11 02:31:11 -05:00
2017-02-27 18:43:46 -08:00
2016-07-08 13:23:12 +02:00
2015-10-23 06:26:42 -07:00
2016-10-03 02:00:22 -04:00
2016-10-04 02:11:51 -04:00
2017-02-07 13:07:46 -05:00
2017-02-11 21:25:18 -05:00
2016-11-22 13:27:16 -05:00
2016-07-05 09:06:29 -07:00
2016-06-27 15:06:18 -04:00
2017-02-04 19:58:14 -05:00
2015-12-08 22:02:33 -05:00
2016-07-08 12:20:57 +02:00
2016-03-23 22:09:58 -04:00
2017-02-17 12:08:05 -05:00
2016-11-07 20:15:55 -05:00
2016-08-15 10:55:53 -07:00
2016-04-07 16:53:30 -04:00
2017-01-24 13:44:28 -05:00
2016-10-23 19:35:24 -04:00
2016-10-23 19:35:24 -04:00
2016-12-25 17:21:22 +01:00
2016-12-29 11:38:31 -05:00
2016-11-04 14:45:23 -04:00
2017-01-17 14:38:43 -05:00
2017-02-10 11:38:08 -05:00
2017-03-02 08:42:31 +01:00
2016-12-02 12:49:59 -05:00
2016-11-09 20:40:06 -05:00
2016-11-09 20:40:06 -05:00
2017-01-09 16:07:41 -05:00
2016-04-28 11:49:45 -04:00
2016-01-19 14:44:23 -05:00
2017-03-02 13:19:33 -08:00
2016-08-28 23:32:41 -04:00
2017-02-10 11:46:39 -05:00
2017-01-25 14:04:38 -05:00
2015-07-09 15:12:20 -07:00
2016-05-03 16:08:14 -04:00
2015-10-26 22:24:22 -07:00
2016-06-17 20:23:32 -07:00
2017-01-18 13:04:28 -05:00
2016-12-16 10:24:44 -08:00
2016-11-15 12:16:13 -05:00
2017-02-15 11:04:11 +01:00
568af6de05