twx-linux/include/net/netfilter
Pablo Neira Ayuso 84f17718a0 netfilter: nf_tables_ipv6: consider network offset in netdev/egress validation
[ Upstream commit 70c261d500951cf3ea0fcf32651aab9a65a91471 ]

From netdev/egress, skb->len can include the ethernet header, therefore,
subtract network offset from skb->len when validating IPv6 packet length.

Fixes: 42df6e1d221d ("netfilter: Introduce egress hook")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-04 13:28:26 +02:00
..
ipv4
ipv6
br_netfilter.h
nf_bpf_link.h bpf: minimal support for programs hooked into netfilter framework 2023-04-21 11:34:14 -07:00
nf_conntrack_acct.h netfilter: conntrack: Remove unused function declarations 2023-08-08 13:02:00 +02:00
nf_conntrack_act_ct.h net/sched: act_ct: Always fill offloading tuple iifidx 2023-11-20 11:59:37 +01:00
nf_conntrack_bpf.h net: netfilter: move bpf_ct_set_nat_info kfunc in nf_nat_bpf.c 2022-10-03 09:17:32 -07:00
nf_conntrack_bridge.h
nf_conntrack_core.h netfilter: conntrack: fix wrong ct->timeout value 2023-04-19 12:08:38 +02:00
nf_conntrack_count.h
nf_conntrack_ecache.h
nf_conntrack_expect.h netfilter: allow exp not to be removed in nf_ct_find_expectation 2023-07-20 10:06:36 +02:00
nf_conntrack_extend.h
nf_conntrack_helper.h netfilter: helper: Remove unused function declarations 2023-08-08 13:01:59 +02:00
nf_conntrack_l4proto.h
nf_conntrack_labels.h netfilter: conntrack: Remove unused function declarations 2023-08-08 13:02:00 +02:00
nf_conntrack_seqadj.h
nf_conntrack_synproxy.h
nf_conntrack_timeout.h
nf_conntrack_timestamp.h
nf_conntrack_tuple.h netfilter: conntrack: don't fold port numbers into addresses before hashing 2023-07-05 14:42:16 +02:00
nf_conntrack_zones.h
nf_conntrack.h netfilter: conntrack: Remove unused function declarations 2023-08-08 13:02:00 +02:00
nf_dup_netdev.h
nf_flow_table.h netfilter: flowtable: validate pppoe header 2024-04-27 17:11:31 +02:00
nf_hooks_lwtunnel.h
nf_log.h
nf_nat_helper.h netfilter: nat: move repetitive nat port reserve loop to a helper 2022-09-07 16:46:04 +02:00
nf_nat_masquerade.h
nf_nat_redirect.h netfilter: nft_redir: use struct nf_nat_range2 throughout and deduplicate eval call-backs 2023-03-22 21:48:59 +01:00
nf_nat.h net: move the nat function to nf_nat_ovs for ovs and tc 2022-12-12 10:14:03 +00:00
nf_queue.h treewide: use get_random_u32() when possible 2022-10-11 17:42:58 -06:00
nf_reject.h
nf_socket.h
nf_synproxy.h
nf_tables_core.h netfilter: nf_tables: avoid retpoline overhead for some ct expression calls 2023-01-18 13:05:25 +01:00
nf_tables_ipv4.h netfilter: nf_tables: restore IP sanity checks for netdev/egress 2024-09-04 13:28:26 +02:00
nf_tables_ipv6.h netfilter: nf_tables_ipv6: consider network offset in netdev/egress validation 2024-09-04 13:28:26 +02:00
nf_tables_offload.h
nf_tables.h netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers 2024-07-05 09:33:49 +02:00
nf_tproxy.h netfilter: tproxy: fix deadlock due to missing BH disable 2023-03-06 12:09:48 +01:00
nft_fib.h netfilter: nf_tables: Extend nft_expr_ops::dump callback parameters 2022-11-15 10:46:34 +01:00
nft_meta.h netfilter: nf_tables: Extend nft_expr_ops::dump callback parameters 2022-11-15 10:46:34 +01:00
nft_reject.h netfilter: nf_tables: Extend nft_expr_ops::dump callback parameters 2022-11-15 10:46:34 +01:00
xt_rateest.h