Patch "netfilter: nf_tables: set pktinfo->thoff at AH header if found" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

    netfilter: nf_tables: set pktinfo->thoff at AH header if found

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
netfilter-nf_tables-set-pktinfo-thoff-at-ah-header-if-found.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Pablo Neira Ayuso <[email protected]>
Date: Sat, 4 Mar 2017 19:53:47 +0100
Subject: netfilter: nf_tables: set pktinfo->thoff at AH header if found

From: Pablo Neira Ayuso <[email protected]>

[ Upstream commit 568af6de058cb2b0c5b98d98ffcf37cdc6bc38a7 ]

Phil Sutter reports that IPv6 AH header matching is broken. From userspace, nft generates bytecode that expects to find the AH header at NFT_PAYLOAD_TRANSPORT_HEADER both for IPv4 and IPv6. However, pktinfo->thoff is set to the inner header after the AH header in IPv6, while in IPv4 pktinfo->thoff points to the AH header indeed. This behaviour is inconsistent. This patch fixes this problem by updating ipv6_find_hdr() to get the IP6_FH_F_AUTH flag so this function stops at the AH header, so both IPv4 and IPv6 pktinfo->thoff point to the AH header.

This is also inconsistent when trying to match encapsulated headers:

1) A packet that looks like IPv4 + AH + TCP dport 22 will *not* match.
2) A packet that looks like IPv6 + AH + TCP dport 22 will match.

---
 include/net/netfilter/nf_tables_ipv6.h |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

@@ -9,12 +9,13 @@ nft_set_pktinfo_ipv6(struct nft_pktinfo
 		     struct sk_buff *skb,
 		     const struct nf_hook_state *state)
 {
+	unsigned int flags = IP6_FH_F_AUTH;
 	int protohdr, thoff = 0;
 	unsigned short frag_off;
 
 	nft_set_pktinfo(pkt, skb, state);
 
-	protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, NULL);
+	protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, &flags);
 	if (protohdr < 0) {
 		nft_set_pktinfo_proto_unspec(pkt, skb);
 		return;

@@ -32,6 +33,7 @@ __nft_set_pktinfo_ipv6_validate(struct n
 				const struct nf_hook_state *state)
 {
 #if IS_ENABLED(CONFIG_IPV6)
+	unsigned int flags = IP6_FH_F_AUTH;
 	struct ipv6hdr *ip6h, _ip6h;
 	unsigned int thoff = 0;
 	unsigned short frag_off;

@@ -50,7 +52,7 @@ __nft_set_pktinfo_ipv6_validate(struct n
 	if (pkt_len + sizeof(*ip6h) > skb->len)
 		return -1;
 
-	protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, NULL);
+	protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, &flags);
 	if (protohdr < 0)
 		return -1;
 

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/netfilter-invoke-synchronize_rcu-after-set-the-_hook_-to-null.patch queue-4.9/netfilter-nfnl_cthelper-fix-incorrect-helper-expect_class_max.patch queue-4.9/netfilter-nf_tables-set-pktinfo-thoff-at-ah-header-if-found.patch