diff mbox series

[27/30] netfilter: nf_tables: handle rt0 and rt2 properly

Message ID 20180312175920.9022-28-pablo@netfilter.org
State Changes Requested
Delegated to: Pablo Neira
Headers show
Series [01/30] netfilter: nf_tables: nf_tables_obj_lookup_byhandle() can be static | expand

Commit Message

Pablo Neira Ayuso March 12, 2018, 5:59 p.m. UTC 
From: Ahmed Abdelsalam <amsalam20@gmail.com>

This fixes Netfilter's bugzilla #1219.

Type 0 and 2 of the IPv6 Routing extension header are not handled
properlyby exthdr_init_raw() in src/exthdr.c

In order to fix the bug, we extended the "enum nft_exthdr_op" to
differentiate between rt, rt0, and rt2.

In this patch we extended the kernel implementation of nf_tables to
recognize the new options

Signed-off-by: Ahmed Abdelsalam <amsalam20@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 include/uapi/linux/netfilter/nf_tables.h | 3 +++
 net/netfilter/nft_exthdr.c               | 3 +++
 2 files changed, 6 insertions(+)
diff mbox series

Patch

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 66dceee0ae30..bb2135c8ad73 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -731,6 +731,9 @@  enum nft_exthdr_flags {
 enum nft_exthdr_op {
 	NFT_EXTHDR_OP_IPV6,
 	NFT_EXTHDR_OP_TCPOPT,
+	NFT_EXTHDR_OP_RT0,
+	NFT_EXTHDR_OP_RT2,
+	NFT_EXTHDR_OP_RT4,
 	__NFT_EXTHDR_OP_MAX
 };
 #define NFT_EXTHDR_OP_MAX	(__NFT_EXTHDR_OP_MAX - 1)
diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
index 47ec1046ad11..bbc1be2b3b73 100644
--- a/net/netfilter/nft_exthdr.c
+++ b/net/netfilter/nft_exthdr.c
@@ -399,6 +399,9 @@  nft_exthdr_select_ops(const struct nft_ctx *ctx,
 			return &nft_exthdr_tcp_ops;
 		break;
 	case NFT_EXTHDR_OP_IPV6:
+	case NFT_EXTHDR_OP_RT0:
+	case NFT_EXTHDR_OP_RT2:
+	case NFT_EXTHDR_OP_RT4:
 		if (tb[NFTA_EXTHDR_DREG])
 			return &nft_exthdr_ipv6_ops;
 		break;