568af6de05
Phil Sutter reports that IPv6 AH header matching is broken. From userspace, nft generates bytecode that expects to find the AH header at NFT_PAYLOAD_TRANSPORT_HEADER both for IPv4 and IPv6. However, pktinfo->thoff is set to the inner header after the AH header in IPv6, while in IPv4 pktinfo->thoff points to the AH header indeed. This behaviour is inconsistent. This patch fixes this problem by updating ipv6_find_hdr() to get the IP6_FH_F_AUTH flag so this function stops at the AH header, so both IPv4 and IPv6 pktinfo->thoff point to the AH header. This is also inconsistent when trying to match encapsulated headers: 1) A packet that looks like IPv4 + AH + TCP dport 22 will *not* match. 2) A packet that looks like IPv6 + AH + TCP dport 22 will match. Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
83 lines
1.7 KiB
C
83 lines
1.7 KiB
C
#ifndef _NF_TABLES_IPV6_H_
|
|
#define _NF_TABLES_IPV6_H_
|
|
|
|
#include <linux/netfilter_ipv6/ip6_tables.h>
|
|
#include <net/ipv6.h>
|
|
|
|
static inline void
|
|
nft_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
|
|
struct sk_buff *skb,
|
|
const struct nf_hook_state *state)
|
|
{
|
|
unsigned int flags = IP6_FH_F_AUTH;
|
|
int protohdr, thoff = 0;
|
|
unsigned short frag_off;
|
|
|
|
nft_set_pktinfo(pkt, skb, state);
|
|
|
|
protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, &flags);
|
|
if (protohdr < 0) {
|
|
nft_set_pktinfo_proto_unspec(pkt, skb);
|
|
return;
|
|
}
|
|
|
|
pkt->tprot_set = true;
|
|
pkt->tprot = protohdr;
|
|
pkt->xt.thoff = thoff;
|
|
pkt->xt.fragoff = frag_off;
|
|
}
|
|
|
|
static inline int
|
|
__nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt,
|
|
struct sk_buff *skb,
|
|
const struct nf_hook_state *state)
|
|
{
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
|
unsigned int flags = IP6_FH_F_AUTH;
|
|
struct ipv6hdr *ip6h, _ip6h;
|
|
unsigned int thoff = 0;
|
|
unsigned short frag_off;
|
|
int protohdr;
|
|
u32 pkt_len;
|
|
|
|
ip6h = skb_header_pointer(skb, skb_network_offset(skb), sizeof(*ip6h),
|
|
&_ip6h);
|
|
if (!ip6h)
|
|
return -1;
|
|
|
|
if (ip6h->version != 6)
|
|
return -1;
|
|
|
|
pkt_len = ntohs(ip6h->payload_len);
|
|
if (pkt_len + sizeof(*ip6h) > skb->len)
|
|
return -1;
|
|
|
|
protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, &flags);
|
|
if (protohdr < 0)
|
|
return -1;
|
|
|
|
pkt->tprot_set = true;
|
|
pkt->tprot = protohdr;
|
|
pkt->xt.thoff = thoff;
|
|
pkt->xt.fragoff = frag_off;
|
|
|
|
return 0;
|
|
#else
|
|
return -1;
|
|
#endif
|
|
}
|
|
|
|
static inline void
|
|
nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt,
|
|
struct sk_buff *skb,
|
|
const struct nf_hook_state *state)
|
|
{
|
|
nft_set_pktinfo(pkt, skb, state);
|
|
if (__nft_set_pktinfo_ipv6_validate(pkt, skb, state) < 0)
|
|
nft_set_pktinfo_proto_unspec(pkt, skb);
|
|
}
|
|
|
|
extern struct nft_af_info nft_af_ipv6;
|
|
|
|
#endif
|