mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 21:57:43 +00:00
netfilter: nft_exthdr: check for IPv6 packet before further processing
[ Upstream commitcdd73cc545
] ipv6_find_hdr() does not validate that this is an IPv6 packet. Add a sanity check for calling ipv6_find_hdr() to make sure an IPv6 packet is passed for parsing. Fixes:96518518cc
("netfilter: add nftables") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
e4db789e93
commit
4759c55ff1
1 changed files with 3 additions and 0 deletions
|
@ -42,6 +42,9 @@ static void nft_exthdr_ipv6_eval(const struct nft_expr *expr,
|
|||
unsigned int offset = 0;
|
||||
int err;
|
||||
|
||||
if (pkt->skb->protocol != htons(ETH_P_IPV6))
|
||||
goto err;
|
||||
|
||||
err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);
|
||||
if (priv->flags & NFT_EXTHDR_F_PRESENT) {
|
||||
nft_reg_store8(dest, err >= 0);
|
||||
|
|
Loading…
Reference in a new issue