[PATCH net 2/8] netfilter: nft_exthdr: check for IPv6 packet before further processing

STALE1939d SUPERSEDED

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: 2021-06-22 22:00:43
Also in: netfilter-devel
Subsystem: netfilter, networking [general], the rest · Maintainers: Pablo Neira Ayuso, Florian Westphal, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds

Revision v1 of 221 in this series.

Revisions (221)

2012-11-22 v1
2013-02-26 v1
2013-04-12 v1
2013-04-19 v1
2013-06-17 v1
2013-09-17 v1
2013-10-23 v1
2013-11-21 v1
2013-12-07 v1
2014-01-07 v1
2014-02-19 v1
2014-04-14 v1
2014-05-09 v1
2014-06-18 v1
2014-08-11 v1
2014-10-27 v1
2014-11-20 v1
2015-03-22 v1
2015-04-27 v1
2015-05-22 v1
2015-07-08 v1
2015-08-10 v1
2015-10-19 v1
2015-11-04 v1
2015-12-14 v1
2015-12-22 v1
2016-01-20 v1
2016-02-16 v1
2016-06-01 v1
2016-06-17 v1
2016-08-10 v1
2016-08-10 v1
2016-09-13 v1
2016-10-21 v1
2016-11-10 v1
2016-11-30 v1
2017-01-26 v1
2017-02-23 v1
2017-02-27 v1
2017-03-29 v1
2017-04-14 v1
2017-07-06 v1
2017-07-18 v1
2017-08-24 v1
2017-09-20 v1
2017-11-01 v1
2017-12-13 v1
2018-01-05 v1
2018-02-01 v1
2018-02-20 v1
2018-03-12 v1
2018-06-13 v1
2018-06-27 v1
2018-07-09 v1
2018-07-24 v1
2018-09-11 v1
2018-10-02 v1
2018-11-06 v1
2018-11-28 v1
2018-12-13 v1
2018-12-29 v1
2019-01-14 v1
2019-02-05 v1
2019-02-11 v1
2019-03-11 v1
2019-03-21 v1
2019-05-13 v1
2019-06-17 v1
2019-07-19 v1
2019-07-31 v1
2019-08-14 v1
2019-08-19 v1
2019-08-30 v1
2019-09-04 v1
2019-09-25 v1
2019-11-06 v1
2019-12-09 v1
2019-12-26 v1
2020-01-08 v1
2020-01-25 v1
2020-01-31 v1
2020-02-18 v1
2020-02-26 v1
2020-03-06 v1
2020-04-07 v1
2020-04-29 v1
2020-05-14 v1
2020-05-25 v1
2020-05-27 v1
2020-06-14 v1
2020-06-25 v1
2020-07-04 v1
2020-08-04 v1
2020-08-15 v1
2020-08-24 v1
2020-08-31 v1
2020-10-13 v1
2020-10-22 v1
2020-10-31 v1
2020-11-21 v1
2020-12-09 v1
2020-12-18 v1
2021-01-03 v1
2021-02-05 v1
2021-03-19 v1
2021-04-12 v1
2021-05-07 v1
2021-05-14 v1
2021-06-02 v1
2021-06-10 v1
2021-06-22 v1 current
2021-07-07 v1
2021-07-23 v1
2021-08-06 v1
2021-08-06 v2 [diff vs current]
2021-09-03 v1
2021-09-29 v1
2021-11-18 v1
2021-12-09 v1
2021-12-17 v1
2022-01-06 v1
2022-01-20 v1
2022-01-27 v1
2022-02-04 v1
2022-02-10 v1
2022-02-22 v2 [diff vs current]
2022-03-01 v1
2022-03-12 v1
2022-03-17 v1
2022-03-28 v1
2022-04-05 v1
2022-04-12 v1
2022-04-28 v1
2022-05-18 v1
2022-05-26 v1
2022-05-27 v1
2022-05-31 v1
2022-06-06 v1
2022-06-21 v1
2022-06-29 v1
2022-07-02 v1
2022-07-11 v1
2022-08-09 v1
2022-08-24 v1
2022-10-19 v1
2022-11-09 v1
2022-11-18 v1
2022-11-22 v1
2022-11-30 v1
2023-01-02 v1
2023-01-13 v1
2023-01-23 v1
2023-01-24 v1
2023-01-31 v1
2023-03-07 v1
2023-03-09 v1
2023-04-20 v1
2023-04-21 v1
2023-05-03 v1
2023-06-06 v1
2023-06-08 v1
2023-06-27 v1
2023-07-05 v1
2023-08-10 v1
2023-08-30 v1
2023-09-13 v1
2023-10-25 v1
2023-12-06 v1
2023-12-20 v1
2023-12-22 v1
2024-01-03 v1
2024-01-17 v1
2024-01-18 v2 [diff vs current]
2024-01-24 v1
2024-01-31 v1
2024-02-08 v2 [diff vs current]
2024-02-14 v1
2024-02-22 v1
2024-02-29 v1
2024-03-07 v1
2024-03-21 v2 [diff vs current]
2024-03-28 v1
2024-04-04 v1
2024-04-11 v1
2024-04-18 v1
2024-05-22 v1
2024-05-28 v3 [diff vs current]
2024-06-11 v1
2024-06-19 v1
2024-06-26 v1
2024-07-11 v1
2024-07-31 v1
2024-08-14 v1
2024-08-22 v1
2024-08-28 v1
2024-09-24 v1
2024-09-26 v2 [diff vs current]
2024-10-02 v1
2024-10-09 v1
2024-10-31 v1
2024-11-28 v1
2024-11-28 v2 [diff vs current]
2024-12-05 v1
2024-12-11 v1
2025-04-03 v1
2025-04-10 v1
2025-06-05 v1
2025-07-17 v1
2025-08-07 v1
2026-03-25 v2 [diff vs current]
2026-04-01 v1
2026-04-28 v2 [diff vs current]
2026-05-01 v1
2026-05-07 v1
2026-06-10 v1
2026-06-19 v1
2026-06-20 v2 [diff vs current]
2026-06-23 v1
2026-08-21 v1
2026-08-27 v2 [diff vs current]
2026-09-13 v2 [diff vs current]

ipv6_find_hdr() does not validate that this is an IPv6 packet. Add a
sanity check for calling ipv6_find_hdr() to make sure an IPv6 packet
is passed for parsing.

Fixes: 96518518cc41 ("netfilter: add nftables")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nft_exthdr.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
index f64f0017e9a5..670dd146fb2b 100644
--- a/net/netfilter/nft_exthdr.c
+++ b/net/netfilter/nft_exthdr.c

@@ -42,6 +42,9 @@ static void nft_exthdr_ipv6_eval(const struct nft_expr *expr,
 	unsigned int offset = 0;
 	int err;
 
+	if (pkt->skb->protocol != htons(ETH_P_IPV6))
+		goto err;
+
 	err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);
 	if (priv->flags & NFT_EXTHDR_F_PRESENT) {
 		nft_reg_store8(dest, err >= 0);

-- 
2.30.2

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help