[PATCH nf] netfilter: ip6_tables: zero-initialize fragment offset

[PATCH nf] netfilter: ip6_tables: zero-initialize fragment offset

[Jeremy Sowden]

ip6tables only sets the `IP6T_F_PROTO` flag on a rule if a protocol is
specified (`-p tcp`, for example).  However, if the flag is not set,
`ip6_packet_match` doesn't call `ipv6_find_hdr` for the skb, in which
case the fragment offset is left uninitialized and a garbage value is
passed to each matcher.

Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
---
 net/ipv6/netfilter/ip6_tables.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index de2cf3943b91..a579ea14a69b 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -273,6 +273,7 @@ ip6t_do_table(struct sk_buff *skb,
 	 * things we don't know, ie. tcp syn flag or ports).  If the
 	 * rule is also a fragment-specific rule, non-fragments won't
 	 * match it. */
+	acpar.fragoff = 0;
 	acpar.hotdrop = false;
 	acpar.state   = state;
 
-- 
2.33.0

Re: [PATCH nf] netfilter: ip6_tables: zero-initialize fragment offset

[Florian Westphal]

Jeremy Sowden <jeremy@azazel.net> wrote:
> ip6tables only sets the `IP6T_F_PROTO` flag on a rule if a protocol is
> specified (`-p tcp`, for example).  However, if the flag is not set,
> `ip6_packet_match` doesn't call `ipv6_find_hdr` for the skb, in which
> case the fragment offset is left uninitialized and a garbage value is
> passed to each matcher.

Fixes: f7108a20dee44 ("netfilter: xtables: move extension arguments into compound structure (1/6)"
Reviewed-by: Florian Westphal <fw@strlen.de>

Re: [PATCH nf] netfilter: ip6_tables: zero-initialize fragment offset

[Jeremy Sowden]

[-- Attachment #1: Type: text/plain, Size: 597 bytes --]

On 2021-09-13, at 01:39:00 +0200, Florian Westphal wrote:
> Jeremy Sowden <jeremy@azazel.net> wrote:
> > ip6tables only sets the `IP6T_F_PROTO` flag on a rule if a protocol
> > is specified (`-p tcp`, for example).  However, if the flag is not
> > set, `ip6_packet_match` doesn't call `ipv6_find_hdr` for the skb, in
> > which case the fragment offset is left uninitialized and a garbage
> > value is passed to each matcher.
>
> Fixes: f7108a20dee44 ("netfilter: xtables: move extension arguments into compound structure (1/6)"
> Reviewed-by: Florian Westphal <fw@strlen.de>

Thanks, Florian.

J.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH nf] netfilter: ip6_tables: zero-initialize fragment offset

[Pablo Neira Ayuso]

On Sun, Sep 12, 2021 at 10:24:33PM +0100, Jeremy Sowden wrote:
> ip6tables only sets the `IP6T_F_PROTO` flag on a rule if a protocol is
> specified (`-p tcp`, for example).  However, if the flag is not set,
> `ip6_packet_match` doesn't call `ipv6_find_hdr` for the skb, in which
> case the fragment offset is left uninitialized and a garbage value is
> passed to each matcher.

Applied, thanks.