On Mon, 2011-06-06 at 10:36 -0700, Greg KH wrote: > On Mon, Jun 06, 2011 at 02:41:10AM +0200, pablo@xxxxxxxxxxxxx wrote: > > From: Fernando Luis Vazquez Cao <fernando@xxxxxxxxxxxxx> > > > > The IPv6 header is not zeroed out in alloc_skb so we must initialize > > it properly unless we want to see IPv6 packets with random TOS fields > > floating around. The current implementation resets the flow label > > but this could be changed if deemed necessary. > > > > We stumbled upon this issue when trying to apply a mangle rule to > > the RST packet generated by the REJECT target module. > > > > The following Linux kernels are affected: <= 2.6.38.8 > > > > Cc: stable@xxxxxxxxxx > > Signed-off-by: Fernando Luis Vazquez Cao <fernando@xxxxxxxxxxxxx> > > Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> > > (cherry picked from commit 4319cc0cf5bb894b7368008cdf6dd20eb8868018) > > So, what kernel(s) are you wanting this to be applied to? Both patches fix bugs that have present from day one, so, ideally, I would like to have them applied to all the stable and longterm kernels: linux-2.6.38.8 linux-2.6.37.6 linux-2.6.36.4 linux-2.6.35.13 linux-2.6.34.9 linux-2.6.33.14 linux-2.6.32.41 linux-2.6.27.59 > Should I just take the upstream > 4319cc0cf5bb894b7368008cdf6dd20eb8868018, or does your backport do > something different here? [PATCH 1/2] netfilter: IPv6: initialize TOS field in REJECT target module For linux-2.6.38.8 you can take the upstream 4319cc0cf5bb894b7368008cdf6dd20eb8868018. For linux-2.6.37.6, linux-2.6.36.4, linux-2.6.35.13, linux-2.6.34.9, linux-2.6.33.14, linux-2.6.32.41, and linux-2.6.27.59 you will need to use the attached backport. [PATCH 2/2] netfilter: IPv6: fix DSCP mangle code The upstream patch 1ed2f73d90fb49bcf5704aee7e9084adb882bfc5 applies cleanly to all the kernels above. - Fernando
From: Fernando Luis Vazquez Cao <fernando@xxxxxxxxxxxxx> The IPv6 header is not zeroed out in alloc_skb so we must initialize it properly unless we want to see IPv6 packets with random TOS fields floating around. The current implementation resets the flow label but this could be changed if deemed necessary. We stumbled upon this issue when trying to apply a mangle rule to the RST packet generated by the REJECT target module. The following Linux kernels are affected: <= 2.6.38.8 Cc: stable@xxxxxxxxxx Signed-off-by: Fernando Luis Vazquez Cao <fernando@xxxxxxxxxxxxx> Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> (cherry picked from commit 4319cc0cf5bb894b7368008cdf6dd20eb8868018) --- diff -urNp linux-2.6.32.41-orig/net/ipv6/netfilter/ip6t_REJECT.c linux-2.6.32.41/net/ipv6/netfilter/ip6t_REJECT.c --- linux-2.6.32.41-orig/net/ipv6/netfilter/ip6t_REJECT.c 2011-06-07 10:40:05.000000000 +0900 +++ linux-2.6.32.41/net/ipv6/netfilter/ip6t_REJECT.c 2011-06-07 10:30:00.000000000 +0900 @@ -43,6 +43,8 @@ static void send_reset(struct net *net, int tcphoff, needs_ack; const struct ipv6hdr *oip6h = ipv6_hdr(oldskb); struct ipv6hdr *ip6h; +#define DEFAULT_TOS_VALUE 0x0U + const __u8 tclass = DEFAULT_TOS_VALUE; struct dst_entry *dst = NULL; u8 proto; struct flowi fl; @@ -121,7 +123,7 @@ static void send_reset(struct net *net, skb_put(nskb, sizeof(struct ipv6hdr)); skb_reset_network_header(nskb); ip6h = ipv6_hdr(nskb); - ip6h->version = 6; + *(__be32 *)ip6h = htonl(0x60000000 | (tclass << 20)); ip6h->hop_limit = dst_metric(dst, RTAX_HOPLIMIT); ip6h->nexthdr = IPPROTO_TCP; ipv6_addr_copy(&ip6h->saddr, &oip6h->daddr);
