netfilter: nf_conntrack_ipv6: fix tracking of ICMPv6 error messages containing fragments

Browse source

ICMPv6 error messages are tracked by extracting the conntrack tuple of
the inner packet and looking up the corresponding conntrack entry. Tuple
extraction uses the ->get_l4proto() callback, which in case of fragments
returns NEXTHDR_FRAGMENT instead of the upper protocol, even for the
first fragment when the entire next header is present, resulting in a
failure to find the correct connection tracking entry.

This patch changes ipv6_get_l4proto() to use ipv6_skip_exthdr() instead
of nf_ct_ipv6_skip_exthdr() in order to skip fragment headers when the
fragment offset is zero.

Signed-off-by: Patrick McHardy <kaber@trash.net>

...

This commit is contained in:

Patrick McHardy 2012-08-26 19:13:59 +02:00 • committed by Pablo Neira Ayuso

parent 4cdd34084d

commit 2b60af0178

1 changed files with 6 additions and 57 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

63

net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c

View file