From mboxrd@z Thu Jan 1 00:00:00 1970 From: pablo@netfilter.org Subject: [PATCH 1/2] netfilter: IPv6: initialize TOS field in REJECT target module Date: Mon, 6 Jun 2011 02:41:10 +0200 Message-ID: <1307320871-31770-1-git-send-email-pablo@netfilter.org> Cc: netfilter-devel@vger.kernel.org, Fernando Luis Vazquez Cao , Pablo Neira Ayuso To: stable@kernel.org Return-path: Received: from mail.us.es ([193.147.175.20]:37841 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753169Ab1FFAlk (ORCPT ); Sun, 5 Jun 2011 20:41:40 -0400 Sender: netfilter-devel-owner@vger.kernel.org List-ID: From: Fernando Luis Vazquez Cao The IPv6 header is not zeroed out in alloc_skb so we must initialize it properly unless we want to see IPv6 packets with random TOS fields floating around. The current implementation resets the flow label but this could be changed if deemed necessary. We stumbled upon this issue when trying to apply a mangle rule to the RST packet generated by the REJECT target module. The following Linux kernels are affected: <= 2.6.38.8 Cc: stable@kernel.org Signed-off-by: Fernando Luis Vazquez Cao Signed-off-by: Pablo Neira Ayuso (cherry picked from commit 4319cc0cf5bb894b7368008cdf6dd20eb8868018) --- net/ipv6/netfilter/ip6t_REJECT.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c index 28e7448..a5a4c5d 100644 --- a/net/ipv6/netfilter/ip6t_REJECT.c +++ b/net/ipv6/netfilter/ip6t_REJECT.c @@ -45,6 +45,8 @@ static void send_reset(struct net *net, struct sk_buff *oldskb) int tcphoff, needs_ack; const struct ipv6hdr *oip6h = ipv6_hdr(oldskb); struct ipv6hdr *ip6h; +#define DEFAULT_TOS_VALUE 0x0U + const __u8 tclass = DEFAULT_TOS_VALUE; struct dst_entry *dst = NULL; u8 proto; struct flowi6 fl6; @@ -124,7 +126,7 @@ static void send_reset(struct net *net, struct sk_buff *oldskb) skb_put(nskb, sizeof(struct ipv6hdr)); skb_reset_network_header(nskb); ip6h = ipv6_hdr(nskb); - ip6h->version = 6; + *(__be32 *)ip6h = htonl(0x60000000 | (tclass << 20)); ip6h->hop_limit = ip6_dst_hoplimit(dst); ip6h->nexthdr = IPPROTO_TCP; ipv6_addr_copy(&ip6h->saddr, &oip6h->daddr); -- 1.7.2.5