[PATCH libnetfilter_queue v2] src: fix IPv6 header handling

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This corrects issues in IPv6 header handling that sometimes resulted
in an endless loop.

Signed-off-by: Etan Kissling <etan_kissling@xxxxxxxxx>
---
v2: Updated loop condition to be consistent with the implementation
    ipv6_skip_exthdr() in the Linux kernel.

 src/extra/ipv6.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/extra/ipv6.c b/src/extra/ipv6.c
index 42c5e25..0ec8fbf 100644
--- a/src/extra/ipv6.c
+++ b/src/extra/ipv6.c
@@ -67,7 +67,12 @@ int nfq_ip6_set_transport_header(struct pkt_buff *pktb, struct ip6_hdr *ip6h,
 	uint8_t nexthdr = ip6h->ip6_nxt;
 	uint8_t *cur = (uint8_t *)ip6h + sizeof(struct ip6_hdr);
 
-	while (nexthdr != target) {
+	while (nexthdr == IPPROTO_HOPOPTS ||
+			nexthdr == IPPROTO_ROUTING ||
+			nexthdr == IPPROTO_FRAGMENT ||
+			nexthdr == IPPROTO_AH ||
+			nexthdr == IPPROTO_NONE ||
+			nexthdr == IPPROTO_DSTOPTS) {
 		struct ip6_ext *ip6_ext;
 		uint32_t hdrlen;
 
@@ -107,11 +112,13 @@ int nfq_ip6_set_transport_header(struct pkt_buff *pktb, struct ip6_hdr *ip6h,
 		} else if (nexthdr == IPPROTO_AH)
 			hdrlen = (ip6_ext->ip6e_len + 2) << 2;
 		else
-			hdrlen = ip6_ext->ip6e_len;
+			hdrlen = (ip6_ext->ip6e_len + 1) << 3;
 
 		nexthdr = ip6_ext->ip6e_nxt;
 		cur += hdrlen;
 	}
+	if (nexthdr != target)
+		cur = NULL;
 	pktb->transport_header = cur;
 	return cur ? 1 : 0;
 }
-- 
2.21.1 (Apple Git-122.3)






[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux