lkml.org 
[lkml]   [2007]   [Mar]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 09/20] nf_conntrack: fix incorrect classification of IPv6 fragments as ESTABLISHED
    -stable review patch.  If anyone has any objections, please let us know.

    ------------------
    From: Patrick McHardy <kaber@trash.net>

    [NETFILTER]: nf_conntrack: fix incorrect classification of IPv6 fragments as ESTABLISHED

    The individual fragments of a packet reassembled by conntrack have the
    conntrack reference from the reassembled packet attached, but nfctinfo
    is not copied. This leaves it initialized to 0, which unfortunately is
    the value of IP_CT_ESTABLISHED.

    The result is that all IPv6 fragments are tracked as ESTABLISHED,
    allowing them to bypass a usual ruleset which accepts ESTABLISHED
    packets early.

    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | 1 +
    1 file changed, 1 insertion(+)

    --- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
    +++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
    @@ -257,6 +257,7 @@ static unsigned int ipv6_conntrack_in(un
    }
    nf_conntrack_get(reasm->nfct);
    (*pskb)->nfct = reasm->nfct;
    + (*pskb)->nfctinfo = reasm->nfctinfo;
    return NF_ACCEPT;
    }

    --
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-03-10 07:29    [W:0.023 / U:0.624 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site