[PATCH 2.4 7/10]: fixes for ip6t_ipv6header

Yasuyuki Kozakai yasuyuki.kozakai at toshiba.co.jp
Wed Dec 1 09:07:13 CET 2004


This patch fixes following bugs in ip6t_ipv6header.c

	- The cast of the pointer to the next IPv6 extension header is wrong.
	- The logical operation is wrong. These fixes intends
	- soft mode without invert flag "!"
		match if the packet contains all of the specified headers.

	- soft mode with invert flag "!"
		match if the packet DOESN'T contain all of the specified
		headers.

	- strict mode without invert flag "!"
		match if the packet contains JUST ONLY the specified headers.
		if the packet doesn't contain some specified headers or
		contains unspecified headers, the packet doesn't match with
		rule.

	- strict mode with invert flag "!"
		NOT MATCH if the packet contains JUST ONLY the specified
		headers. Otherwise, match. So, if the packet contains some
		specified headers and DOESN'T contain other specified headers,
		the packet MATCHES with rule.

Signed-off-by: Yasuyuki KOZAKAI <yasuyuki.kozakai at toshiba.co.jp>

Regards,
-----------------------------------------------------------------
Yasuyuki KOZAKAI @ USAGI Project <yasuyuki.kozakai at toshiba.co.jp>
-------------- next part --------------
--- linux-2.4.28-rc1/./net/ipv6/netfilter/ip6t_ipv6header.c	2003-11-29 03:26:21.000000000 +0900
+++ linux-2.4.28-rc1-extfix/./net/ipv6/netfilter/ip6t_ipv6header.c	2004-11-10 00:51:45.000000000 +0900
@@ -63,7 +63,7 @@ ipv6header_match(const struct sk_buff *s
 			break;
 		}
 
-		hdr=(struct ipv6_opt_hdr *)skb->data+ptr;
+		hdr=(struct ipv6_opt_hdr *)(skb->data+ptr);
 
 		/* Calculate the header length */
                 if (nexthdr == NEXTHDR_FRAGMENT) {
@@ -107,10 +107,14 @@ ipv6header_match(const struct sk_buff *s
 		temp |= MASK_PROTO;
 
 	if (info->modeflag)
-		return (!( (temp & info->matchflags)
-			^ info->matchflags) ^ info->invflags);
-	else
-		return (!( temp ^ info->matchflags) ^ info->invflags);
+		return !((temp ^ info->matchflags ^ info->invflags)
+			 & info->matchflags);
+	else {
+		if (info->invflags)
+			return temp != info->matchflags;
+		else
+			return temp == info->matchflags;
+	}
 }
 
 static int
@@ -120,11 +124,17 @@ ipv6header_checkentry(const char *tablen
 		      unsigned int matchsize,
 		      unsigned int hook_mask)
 {
+	const struct ip6t_ipv6header_info *info = matchinfo;
+
 	/* Check for obvious errors */
 	/* This match is valid in all hooks! */
-	if (matchsize != IP6T_ALIGN(sizeof(struct ip6t_ipv6header_info))) {
+	if (matchsize != IP6T_ALIGN(sizeof(struct ip6t_ipv6header_info)))
+		return 0;
+
+	/* invflags is 0 or 0xff in hard mode */
+	if ((!info->modeflag) && info->invflags != 0x00
+			      && info->invflags != 0xFF)
 		return 0;
-	}
 
 	return 1;
 }


More information about the netfilter-devel mailing list