patch-2.4.26 linux-2.4.26/net/ipv6/netfilter/ip6_tables.c
Next file: linux-2.4.26/net/ipv6/sysctl_net_ipv6.c
Previous file: linux-2.4.26/net/ipv6/ndisc.c
Back to the patch index
Back to the overall index
- Lines: 73
- Date:
2004-04-14 06:05:41.000000000 -0700
- Orig file:
linux-2.4.25/net/ipv6/netfilter/ip6_tables.c
- Orig date:
2004-02-18 05:36:32.000000000 -0800
diff -urN linux-2.4.25/net/ipv6/netfilter/ip6_tables.c linux-2.4.26/net/ipv6/netfilter/ip6_tables.c
@@ -1568,8 +1568,10 @@
u_int16_t datalen,
int *hotdrop)
{
- const struct tcphdr *tcp = hdr;
+ const struct tcphdr *tcp;
const struct ip6t_tcp *tcpinfo = matchinfo;
+ int tcpoff;
+ u8 nexthdr = skb->nh.ipv6h->nexthdr;
/* To quote Alan:
@@ -1590,6 +1592,24 @@
return 0;
}
+ tcpoff = (u8*)(skb->nh.ipv6h + 1) - skb->data;
+ tcpoff = ipv6_skip_exthdr(skb, tcpoff, &nexthdr, skb->len - tcpoff);
+ if (tcpoff < 0 || tcpoff > skb->len) {
+ duprintf("tcp_match: cannot skip exthdr. Dropping.\n");
+ *hotdrop = 1;
+ return 0;
+ } else if (nexthdr == IPPROTO_FRAGMENT)
+ return 0;
+ else if (nexthdr != IPPROTO_TCP ||
+ skb->len - tcpoff < sizeof(struct tcphdr)) {
+ /* cannot be occured */
+ duprintf("tcp_match: cannot get TCP header. Dropping.\n");
+ *hotdrop = 1;
+ return 0;
+ }
+
+ tcp = (struct tcphdr *)(skb->data + tcpoff);
+
/* FIXME: Try tcp doff >> packet len against various stacks --RR */
#define FWINVTCP(bool,invflg) ((bool) ^ !!(tcpinfo->invflags & invflg))
@@ -1640,8 +1660,10 @@
u_int16_t datalen,
int *hotdrop)
{
- const struct udphdr *udp = hdr;
+ const struct udphdr *udp;
const struct ip6t_udp *udpinfo = matchinfo;
+ int udpoff;
+ u8 nexthdr = skb->nh.ipv6h->nexthdr;
if (offset == 0 && datalen < sizeof(struct udphdr)) {
/* We've been asked to examine this packet, and we
@@ -1651,6 +1673,23 @@
return 0;
}
+ udpoff = (u8*)(skb->nh.ipv6h + 1) - skb->data;
+ udpoff = ipv6_skip_exthdr(skb, udpoff, &nexthdr, skb->len - udpoff);
+ if (udpoff < 0 || udpoff > skb->len) {
+ duprintf("udp_match: cannot skip exthdr. Dropping.\n");
+ *hotdrop = 1;
+ return 0;
+ } else if (nexthdr == IPPROTO_FRAGMENT)
+ return 0;
+ else if (nexthdr != IPPROTO_UDP ||
+ skb->len - udpoff < sizeof(struct udphdr)) {
+ duprintf("udp_match: cannot get UDP header. Dropping.\n");
+ *hotdrop = 1;
+ return 0;
+ }
+
+ udp = (struct udphdr *)(skb->data + udpoff);
+
/* Must not be a fragment. */
return !offset
&& port_match(udpinfo->spts[0], udpinfo->spts[1],
FUNET's LINUX-ADM group, linux-adm@nic.funet.fi
TCL-scripts by Sam Shen (who was at: slshen@lbl.gov)