kaffa/XDP-Firewall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Check for IPv6 header validity itself and remove unneeded check.

Browse Source
This commit is contained in:
gamemann
2021-11-12 21:07:12 +00:00
parent 6f7911059f
commit 83e801f36c
1 changed files with 1 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/xdpfw_kern.c
View File

@@ -353,13 +353,8 @@ int xdp_prog_main(struct xdp_md *ctx)
} }
// Do specific IPv6. // Do specific IPv6.
if (eth->h_proto == htons(ETH_P_IPV6)) if (iph6)
{ {
if (iph6 + 1 > (struct ipv6hdr *)data_end)
{
break;
}
// Source address. // Source address.
if (filter->srcip6[0] != 0 && (iph6->saddr.in6_u.u6_addr32[0] != filter->srcip6[0] || iph6->saddr.in6_u.u6_addr32[1] != filter->srcip6[1] || iph6->saddr.in6_u.u6_addr32[2] != filter->srcip6[2] || iph6->saddr.in6_u.u6_addr32[3] != filter->srcip6[3])) if (filter->srcip6[0] != 0 && (iph6->saddr.in6_u.u6_addr32[0] != filter->srcip6[0] || iph6->saddr.in6_u.u6_addr32[1] != filter->srcip6[1] || iph6->saddr.in6_u.u6_addr32[2] != filter->srcip6[2] || iph6->saddr.in6_u.u6_addr32[3] != filter->srcip6[3]))
{ {