netdev - Re: [PATCH net] ipv6: re-enable fragment header matching in ipv6_find

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 03 Mar 2016 16:35:50 -0500 (EST)
From:	David Miller <davem@...emloft.net>
To:	fw@...len.de
Cc:	netdev@...r.kernel.org
Subject: Re: [PATCH net] ipv6: re-enable fragment header matching in
 ipv6_find_hdr

From: Florian Westphal <fw@...len.de>
Date: Tue,  1 Mar 2016 16:15:16 +0100

> When ipv6_find_hdr is used to find a fragment header
> (caller specifies target NEXTHDR_FRAGMENT) we erronously return
> -ENOENT for all fragments with nonzero offset.
> 
> Before commit 9195bb8e381d, when target was specified, we did not
> enter the exthdr walk loop as nexthdr == target so this used to work.
> 
> Now we do (so we can skip empty route headers). When we then stumble upon
> a frag with nonzero frag_off we must return -ENOENT ("header not found")
> only if the caller did not specifically request NEXTHDR_FRAGMENT.
> 
> This allows nfables exthdr expression to match ipv6 fragments, e.g. via
> 
> nft add rule ip6 filter input frag frag-off gt 0
> 
> Fixes: 9195bb8e381d ("ipv6: improve ipv6_find_hdr() to skip empty routing headers")
> Signed-off-by: Florian Westphal <fw@...len.de>

Applied and queued up for -stable, thanks Florian.