Pablo Neira Ayuso <[email protected]> wrote: > Phil Sutter reports that IPv6 AH header matching is broken. From > userspace, nft generates bytecode that expects to find the AH header at > NFT_PAYLOAD_TRANSPORT_HEADER both for IPv4 and IPv6. However, > pktinfo->thoff is set to the inner header after the AH header in IPv6, > while in IPv4 pktinfo->thoff points to the AH header indeed. This > behaviour is inconsistent. This patch fixes this problem by updating > ipv6_find_hdr() to get the IP6_FH_F_AUTH flag so this function stops at > the AH header, so both IPv4 and IPv6 pktinfo->thoff point to the AH > header.
This looks wrong. We need to search until we find a l4 header, after this patch "tcp dort 22" won't match anymore if an AH header exists. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
