From mboxrd@z Thu Jan 1 00:00:00 1970 From: Olaf Kirch Subject: [PATCH] netfilter6 ip6_packet_match doesn't properly skip exthdrs Date: Thu, 30 Sep 2004 14:14:08 +0200 Sender: netfilter-devel-bounces@lists.netfilter.org Message-ID: <20040930121408.GG19083@suse.de> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: netfilter-devel@lists.netfilter.org Return-path: To: netdev@oss.sgi.com Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: netfilter-devel-bounces@lists.netfilter.org List-Id: netdev.vger.kernel.org This patch fixes a bug in the ip6_tables code that tries to skip extension headers. Packets with extension headers were usually not matched because the code was looking at the wrong offset inside the skb. Signed-off-by: Olaf Kirch Index: linux-2.6.8.nf/net/ipv6/netfilter/ip6_tables.c =================================================================== --- linux-2.6.8.nf.orig/net/ipv6/netfilter/ip6_tables.c 2004-09-30 14:07:51.000000000 +0200 +++ linux-2.6.8.nf/net/ipv6/netfilter/ip6_tables.c 2004-09-30 14:07:57.000000000 +0200 @@ -219,7 +219,7 @@ u_int16_t ptr; /* Header offset in skb */ u_int16_t hdrlen; /* Header */ - ptr = IPV6_HDR_LEN; + ptr = ((char *) ipv6 - (char *) skb->data) + IPV6_HDR_LEN; while (ip6t_ext_hdr(currenthdr)) { /* Is there enough space for the next ext header? */ -- Olaf Kirch | Things that make Monday morning interesting, #1: okir@suse.de | "I want to use NFS over AX25, can you help me?" ---------------+