]> git.karo-electronics.de Git - karo-tx-linux.git/commit
[NETFILTER]: nf_conntrack: fix incorrect classification of IPv6 fragments as ESTABLISHED
authorPatrick McHardy <kaber@trash.net>
Sat, 24 Mar 2007 20:30:06 +0000 (21:30 +0100)
committerAdrian Bunk <bunk@stusta.de>
Sat, 24 Mar 2007 20:30:06 +0000 (21:30 +0100)
commit72d9f2d497cbd34b77cd47ce3c79d846a63fc9fc
tree0c240c61becd66367bedbec516a05f269ba9ea53
parentb7dc23da852c9507c138f46911e504e0943a5661
[NETFILTER]: nf_conntrack: fix incorrect classification of IPv6 fragments as ESTABLISHED

The individual fragments of a packet reassembled by conntrack have the
conntrack reference from the reassembled packet attached, but nfctinfo
is not copied. This leaves it initialized to 0, which unfortunately is
the value of IP_CT_ESTABLISHED.

The result is that all IPv6 fragments are tracked as ESTABLISHED,
allowing them to bypass a usual ruleset which accepts ESTABLISHED
packets early.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c