From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Date: Fri, 31 May 2013 21:14:36 +0000 (+0200)
Subject: Skip really non-first fragments for IPv6 when getting port/protocol
X-Git-Tag: v6.20~41
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=81b95c05e77cba00cf98a027b01f6261d998dcfa;p=ipset

Skip really non-first fragments for IPv6 when getting port/protocol
---

diff --git a/kernel/net/netfilter/ipset/ip_set_getport.c b/kernel/net/netfilter/ipset/ip_set_getport.c
index 279a03c..a0d96eb 100644
--- a/kernel/net/netfilter/ipset/ip_set_getport.c
+++ b/kernel/net/netfilter/ipset/ip_set_getport.c
@@ -135,9 +135,7 @@ ip_set_get_ip6_port(const struct sk_buff *skb, bool src,
 {
 	int protoff;
 	u8 nexthdr;
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0)
-	__be16 frag_off;
-#endif
+	__be16 frag_off = 0;
 
 	nexthdr = ipv6_hdr(skb)->nexthdr;
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0)
@@ -146,7 +144,7 @@ ip_set_get_ip6_port(const struct sk_buff *skb, bool src,
 #else
 	protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr);
 #endif
-	if (protoff < 0)
+	if (protoff < 0 || (frag_off & htons(~0x7)) != 0)
 		return false;
 
 	return get_port(skb, nexthdr, protoff, src, port, proto);