: ip6t_{hbh,dst}: Rejects not-strict mode on rule insersion]

Hi Willy,

This patch from Yasuyuki fixes a problem in the hbh/dst matches which is currently hidden by broken userspace, but will be exposed once we've fixed userspace. Unfortunately neither of us has a working 2.4 environment, so all I can do is forward the patch. The upstream commit ID is 8ca31ce52.

Please apply as you see fit. Thanks!

-------- Original Message --------
Subject: [PATCH 2.4]: ip6t_{hbh,dst}: Rejects not-strict mode on rule insersion
Date: Mon, 08 Sep 2008 15:32:34 +0900 (JST)
From: Yasuyuki KOZAKAI <[email protected]>
To: [email protected]
CC: [email protected]
References: <[email protected]>

This is for 2.4 kernel (build test with 2.4.37-rc1, I have no environment to run 2.4, sorry).

[NETFILTER]: ip6t_{hbh,dst}: Rejects not-strict mode on rule insertion

The current code ignores rules for internal options in HBH/DST options header in packet processing if 'Not strict' mode is specified (which is not implemented). Clearly it is not expected by user.

Kernel should reject HBH/DST rule insertion with 'Not strict' mode in the first place.

---
 net/ipv6/netfilter/ip6t_dst.c |    6 ++++--
 net/ipv6/netfilter/ip6t_hbh.c |    6 ++++--
 2 files changed, 8 insertions(+), 4 deletions(-)

index 65213e9..35ba724 100644
@@ -172,8 +172,6 @@ match(const struct sk_buff *skb,
        hdrlen -= 2;
        if ( !(optinfo->flags & IP6T_OPTS_OPTS) ){
 	       return ret;
-	} else if (optinfo->flags & IP6T_OPTS_NSTRICT) {
-		DEBUGP("Not strict - not implemented");
 	} else {
 		DEBUGP("Strict ");
 		DEBUGP("#%d ",optinfo->optsnr);

@@ -253,6 +251,10 @@ checkentry(const char *tablename,
                       optsinfo->invflags);
               return 0;
        }
+	if (optsinfo->flags & IP6T_OPTS_NSTRICT) {
+		DEBUGP("ip6t_opts: Not strict - not implemented");
+		return 0;
+	}
 
        return 1;
 }

index b37e4ce..720cb8d 100644
@@ -172,8 +172,6 @@ match(const struct sk_buff *skb,
        hdrlen -= 2;
        if ( !(optinfo->flags & IP6T_OPTS_OPTS) ){
 	       return ret;
-	} else if (optinfo->flags & IP6T_OPTS_NSTRICT) {
-		DEBUGP("Not strict - not implemented");
 	} else {
 		DEBUGP("Strict ");
 		DEBUGP("#%d ",optinfo->optsnr);

@@ -253,6 +251,10 @@ checkentry(const char *tablename,
                       optsinfo->invflags);
               return 0;
        }
+	if (optsinfo->flags & IP6T_OPTS_NSTRICT) {
+		DEBUGP("ip6t_opts: Not strict - not implemented");
+		return 0;
+	}
 
        return 1;
 }

1.5.3.6

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Hi Patrick,

OK. I still have working 2.4 + IPv6, so if there is any reproducer, I can test the fix. Otherwise, I'll apply it, as it seems pretty straight-forward for anyone who doesn't want to precisely understand what it fixes :-)

Thanks,
Willy

I guess it can't be tested right now because of the userspace problem, but it really is pretty straight forward :)