mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 17:30:02 +00:00
netfilter: nft_exthdr: check for IPv6 packet before further processing
[ Upstream commitcdd73cc545
] ipv6_find_hdr() does not validate that this is an IPv6 packet. Add a sanity check for calling ipv6_find_hdr() to make sure an IPv6 packet is passed for parsing. Fixes:96518518cc
("netfilter: add nftables") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
7678947287
commit
59c39d153b
1 changed files with 3 additions and 0 deletions
|
@ -46,6 +46,9 @@ static void nft_exthdr_ipv6_eval(const struct nft_expr *expr,
|
|||
unsigned int offset = 0;
|
||||
int err;
|
||||
|
||||
if (pkt->skb->protocol != htons(ETH_P_IPV6))
|
||||
goto err;
|
||||
|
||||
err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);
|
||||
if (priv->flags & NFT_EXTHDR_F_PRESENT) {
|
||||
*dest = (err >= 0);
|
||||
|
|
Loading…
Reference in a new issue