netfilter: nf_tables: don't drop IPv6 packets that cannot parse transport

Browse source

This is overly conservative and not flexible at all, so better let them
go through and let the filtering policy decide what to do with them. We
use skb_header_pointer() all over the place so we would just fail to
match when trying to access fields from malformed traffic.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Pablo Neira Ayuso 2016-09-09 12:42:53 +02:00

parent 10151d7b03

commit 71212c9b04

3 changed files with 4 additions and 10 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

6

include/net/netfilter/nf_tables_ipv6.h

View file