[NETFILTER]: nf_conntrack_ipv6: fix incorrect classification of IPv6 fragments as...
authorPatrick McHardy <kaber@trash.net>
Wed, 7 Mar 2007 04:24:18 +0000 (20:24 -0800)
committerDavid S. Miller <davem@sunset.davemloft.net>
Thu, 8 Mar 2007 00:08:01 +0000 (16:08 -0800)
commitdd63006b8fb5abf2336e145632610c6175a28fea
treef409f238d52ffe981061d6a26176841e1fc50fb3
parent455921451a176d90c5cfef898f061bb6fc83faaf
[NETFILTER]: nf_conntrack_ipv6: fix incorrect classification of IPv6 fragments as ESTABLISHED

The individual fragments of a packet reassembled by conntrack have the
conntrack reference from the reassembled packet attached, but nfctinfo
is not copied. This leaves it initialized to 0, which unfortunately is
the value of IP_CT_ESTABLISHED.

The result is that all IPv6 fragments are tracked as ESTABLISHED,
allowing them to bypass a usual ruleset which accepts ESTABLISHED
packets early.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c