[NETFILTER]: Fix ipv6 TCP/UDP matching wrt. extension headers

diff --git a/net/ipv6/ipv6_syms.c b/net/ipv6/ipv6_syms.c
index 990e86781195ab1a77f1f876f363346b6859ca11..b4a11696c89c5e010c3982aa5ed9ec354989c477 100644 (file)
--- a/net/ipv6/ipv6_syms.c
+++ b/net/ipv6/ipv6_syms.c
@@ -46,3 +46,4 @@ EXPORT_SYMBOL(ip6_append_data);
 EXPORT_SYMBOL(ip6_flush_pending_frames);
 EXPORT_SYMBOL(ip6_push_pending_frames);
 EXPORT_SYMBOL(ipv6_push_nfrag_opts);
+EXPORT_SYMBOL(ipv6_skip_exthdr);

diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 0adb7785c76102811d617ba7f47e6af52466e1ab..8be39472020bffb7d26d1dd322d1afed1757fbfa 100644 (file)
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1570,8 +1570,10 @@ tcp_match(const struct sk_buff *skb,
          u_int16_t datalen,
          int *hotdrop)
 {
-       const struct tcphdr *tcp = hdr;
+       const struct tcphdr *tcp;
        const struct ip6t_tcp *tcpinfo = matchinfo;
+       int tcpoff;
+       u8 nexthdr = skb->nh.ipv6h->nexthdr;
 
        /* To quote Alan:
 
@@ -1592,6 +1594,24 @@ tcp_match(const struct sk_buff *skb,
                return 0;
        }
 
+       tcpoff = (u8*)(skb->nh.ipv6h + 1) - skb->data;
+       tcpoff = ipv6_skip_exthdr(skb, tcpoff, &nexthdr, skb->len - tcpoff);
+       if (tcpoff < 0 || tcpoff > skb->len) {
+               duprintf("tcp_match: cannot skip exthdr. Dropping.\n");
+               *hotdrop = 1;
+               return 0;
+       } else if (nexthdr == IPPROTO_FRAGMENT)
+               return 0;
+       else if (nexthdr != IPPROTO_TCP ||
+                skb->len - tcpoff < sizeof(struct tcphdr)) {
+               /* cannot be occured */
+               duprintf("tcp_match: cannot get TCP header. Dropping.\n");
+               *hotdrop = 1;
+               return 0;
+       }
+
+       tcp = (struct tcphdr *)(skb->data + tcpoff);
+
        /* FIXME: Try tcp doff >> packet len against various stacks --RR */
 
 #define FWINVTCP(bool,invflg) ((bool) ^ !!(tcpinfo->invflags & invflg))
@@ -1642,8 +1662,10 @@ udp_match(const struct sk_buff *skb,
          u_int16_t datalen,
          int *hotdrop)
 {
-       const struct udphdr *udp = hdr;
+       const struct udphdr *udp;
        const struct ip6t_udp *udpinfo = matchinfo;
+       int udpoff;
+       u8 nexthdr = skb->nh.ipv6h->nexthdr;
 
        if (offset == 0 && datalen < sizeof(struct udphdr)) {
                /* We've been asked to examine this packet, and we
@@ -1653,6 +1675,23 @@ udp_match(const struct sk_buff *skb,
                return 0;
        }
 
+       udpoff = (u8*)(skb->nh.ipv6h + 1) - skb->data;
+       udpoff = ipv6_skip_exthdr(skb, udpoff, &nexthdr, skb->len - udpoff);
+       if (udpoff < 0 || udpoff > skb->len) {
+               duprintf("udp_match: cannot skip exthdr. Dropping.\n");
+               *hotdrop = 1;
+               return 0;
+       } else if (nexthdr == IPPROTO_FRAGMENT)
+               return 0;
+       else if (nexthdr != IPPROTO_UDP ||
+                skb->len - udpoff < sizeof(struct udphdr)) {
+               duprintf("udp_match: cannot get UDP header. Dropping.\n");
+               *hotdrop = 1;
+               return 0;
+       }
+
+       udp = (struct udphdr *)(skb->data + udpoff);
+
        /* Must not be a fragment. */
        return !offset
                && port_match(udpinfo->spts[0], udpinfo->spts[1],