• Jesper Dangaard Brouer's avatar
    ipvs: Fix faulty IPv6 extension header handling in IPVS · 63dca2c0
    Jesper Dangaard Brouer authored
    IPv6 packets can contain extension headers, thus its wrong to assume
    that the transport/upper-layer header, starts right after (struct
    ipv6hdr) the IPv6 header.  IPVS uses this false assumption, and will
    write SNAT & DNAT modifications at a fixed pos which will corrupt the
    message.
    
    To fix this, proper header position must be found before modifying
    packets.  Introducing ip_vs_fill_iph_skb(), which uses ipv6_find_hdr()
    to skip the exthdrs. It finds (1) the transport header offset, (2) the
    protocol, and (3) detects if the packet is a fragment.
    
    Note, that fragments in IPv6 is represented via an exthdr.  Thus, this
    is detected while skipping through the exthdrs.
    
    This patch depends on commit 84018f55
    
    :
     "netfilter: ip6_tables: add flags parameter to ipv6_find_hdr()"
    This also adds a dependency to ip6_tables.
    
    Originally based on patch from: Hans Schillstrom
    
    kABI notes:
    Changing struct ip_vs_iphdr is a potential minor kABI breaker,
    because external modules can be compiled with another version of
    this struct.  This should not matter, as they would most-likely
    be using a compiled-in version of ip_vs_fill_iphdr().  When
    recompiled, they will notice ip_vs_fill_iphdr() no longer exists,
    and they have to used ip_vs_fill_iph_skb() instead.
    Signed-off-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
    Acked-by: default avatarJulian Anastasov <ja@ssi.bg>
    Signed-off-by: default avatarSimon Horman <horms@verge.net.au>
    63dca2c0