summaryrefslogtreecommitdiff
path: root/net/sched
diff options
context:
space:
mode:
authorFlorian Westphal <fw@strlen.de>2023-11-08 15:18:53 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2023-11-20 13:59:37 +0300
commit2cd19d014dbfa4c7c67337a79a3615dece1bcc23 (patch)
tree935704c151ba4ceb9f1e18cfd3db6fb39cfccfd9 /net/sched
parentcf6b960fbeff068faa4ff46358f51ef524d0a3d9 (diff)
downloadlinux-2cd19d014dbfa4c7c67337a79a3615dece1bcc23.tar.xz
netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses
[ Upstream commit 80abbe8a8263106fe45a4f293b92b5c74cc9cc8a ] The ipv6 redirect target was derived from the ipv4 one, i.e. its identical to a 'dnat' with the first (primary) address assigned to the network interface. The code has been moved around to make it usable from nf_tables too, but its still the same as it was back when this was added in 2012. IPv6, however, has different types of addresses, if the 'wrong' address comes first the redirection does not work. In Daniels case, the addresses are: inet6 ::ffff:192 ... inet6 2a01: ... ... so the function attempts to redirect to the mapped address. Add more checks before the address is deemed correct: 1. If the packets' daddr is scoped, search for a scoped address too 2. skip tentative addresses 3. skip mapped addresses Use the first address that appears to match our needs. Reported-by: Daniel Huhardeaux <tech@tootai.net> Closes: https://lore.kernel.org/netfilter/71be06b8-6aa0-4cf9-9e0b-e2839b01b22f@tootai.net/ Fixes: 115e23ac78f8 ("netfilter: ip6tables: add REDIRECT target") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net/sched')
0 files changed, 0 insertions, 0 deletions