averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-08-09 06:14:34 +02:00
Code Issues Packages Projects Releases Wiki Activity

netfilter: nf_reject: skip iphdr options when looking for icmp header

Browse Source 
[ Upstream commit af8d6ae09c ]

Not a big deal but this hould have used the real ip header length and not the
base header size.  As-is, if there are options then
nf_skb_is_icmp_unreach() result will be random.

Fixes: db99b2f2b3 ("netfilter: nf_reject: don't reply to icmp error messages")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Florian Westphal
2026-07-24 15:54:50 +02:00
committed by Greg Kroah-Hartman
parent 50b70f56f3
commit 5c65362eee
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/ipv4/netfilter/nf_reject_ipv4.c
+1 -1
View File
@@ -80,7 +80,7 @@ static bool nf_skb_is_icmp_unreach(const struct sk_buff *skb)
if (iph->protocol != IPPROTO_ICMP)
return false;
thoff = skb_network_offset(skb) + sizeof(*iph);
thoff = skb_network_offset(skb) + ip_hdrlen(skb);
tp = skb_header_pointer(skb,
thoff + offsetof(struct icmphdr, type),