Jeremy Sowden 16afda8e3e netfilter: ip6_tables: zero-initialize fragment offset ...

[ Upstream commit 310e2d43c3ad429c1fba4b175806cf1f55ed73a6 ]

ip6tables only sets the `IP6T_F_PROTO` flag on a rule if a protocol is
specified (`-p tcp`, for example).  However, if the flag is not set,
`ip6_packet_match` doesn't call `ipv6_find_hdr` for the skb, in which
case the fragment offset is left uninitialized and a garbage value is
passed to each matcher.

Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2021-10-17 10:08:34 +02:00

..

ip6_tables.c

netfilter: ip6_tables: zero-initialize fragment offset

2021-10-17 10:08:34 +02:00

ip6t_ah.c

…

ip6t_eui64.c

…

ip6t_frag.c

…

ip6t_hbh.c

…

ip6t_ipv6header.c

…

ip6t_MASQUERADE.c

…

ip6t_mh.c

…

ip6t_NPT.c

…

ip6t_REJECT.c

…

ip6t_rpfilter.c

netfilter: Fix rpfilter dropping vrf packets by mistake

2019-08-16 10:13:50 +02:00

ip6t_rt.c

…

ip6t_SYNPROXY.c

…

ip6table_filter.c

…

ip6table_mangle.c

…

ip6table_nat.c

…

ip6table_raw.c

…

ip6table_security.c

…

Kconfig

netfilter: nf_tables: NAT chain and extensions require NF_TABLES

2018-06-21 04:02:43 +09:00

Makefile

…

nf_conntrack_l3proto_ipv6.c

…

nf_conntrack_proto_icmpv6.c

…

nf_conntrack_reasm.c

netfilter: ipv6: nf_defrag: accept duplicate fragments again

2019-07-21 09:04:21 +02:00

nf_defrag_ipv6_hooks.c

ipv6: remove dependency of nf_defrag_ipv6 on ipv6 module

2019-04-27 09:35:40 +02:00

nf_dup_ipv6.c

…

nf_log_ipv6.c

…

nf_nat_l3proto_ipv6.c

netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt

2018-03-15 10:54:24 +01:00

nf_nat_masquerade_ipv6.c

netfilter: masquerade: don't flush all conntracks if only one address deleted on device

2019-11-20 18:00:52 +01:00

nf_nat_proto_icmpv6.c

…

nf_reject_ipv6.c

…

nf_socket_ipv6.c

netfilter: socket: icmp6: fix use-after-scope

2021-09-22 11:45:35 +02:00

nf_tables_ipv6.c

…

nft_chain_nat_ipv6.c

…

nft_chain_route_ipv6.c

…

nft_dup_ipv6.c

…

nft_fib_ipv6.c

netfilter: don't set F_IFACE on ipv6 fib lookups

2018-07-08 15:30:50 +02:00

nft_masq_ipv6.c

…

nft_redir_ipv6.c

…

nft_reject_ipv6.c

…