netfilter: flowtable: reload ip{v6}h in nf_flow_tuple_ip{v6} (41e9ec5a) · Commits · 戴 / test

Since pskb_may_pull may change skb->data, so we need to reload ip{v6}h at the right place. Fixes: ("netfilter: nf_flow_table: move ipv6 offload hook code to nf_flow_table") Fixes: ("netfilter: nf_flow_table: move ipv4 offload hook code to nf_flow_table") Signed-off-by:

Haishuang Yan <yanhaishuang@cmss.chinamobile.com> Signed-off-by:

Pablo Neira Ayuso <pablo@netfilter.org>

net/netfilter/nf_flow_table_ip.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -191,6 +191,7 @@ static int nf_flow_tuple_ip(struct sk_buff skb, const struct net_device dev,
		if (!pskb_may_pull(skb, thoff + sizeof(*ports)))
		return -1;

		iph = ip_hdr(skb);
		ports = (struct flow_ports *)(skb_network_header(skb) + thoff);

		tuple->src_v4.s_addr = iph->saddr;
		@@ -463,6 +464,7 @@ static int nf_flow_tuple_ipv6(struct sk_buff skb, const struct net_device dev,
		if (!pskb_may_pull(skb, thoff + sizeof(*ports)))
		return -1;

		ip6h = ipv6_hdr(skb);
		ports = (struct flow_ports *)(skb_network_header(skb) + thoff);

		tuple->src_v6 = ip6h->saddr;

Admin message