diff options
| author | Sriram Yagnaraman <sriram.yagnaraman@est.tech> | 2023-01-24 02:47:18 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2023-01-24 09:52:31 +0100 |
| commit | a9993591fa94246b16b444eea55d84c54608282a (patch) | |
| tree | f099ac977d8dce63b56788dbd1abc2c40fe4f53e /lib | |
| parent | 208a21107ef0ae86c92078caf84ce80053e73f7a (diff) | |
| download | linux-stable-a9993591fa94246b16b444eea55d84c54608282a.tar.gz linux-stable-a9993591fa94246b16b444eea55d84c54608282a.tar.bz2 linux-stable-a9993591fa94246b16b444eea55d84c54608282a.zip | |
netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE
RFC 9260, Sec 8.5.1 states that for ABORT/SHUTDOWN_COMPLETE, the chunk
MUST be accepted if the vtag of the packet matches its own tag and the
T bit is not set OR if it is set to its peer's vtag and the T bit is set
in chunk flags. Otherwise the packet MUST be silently dropped.
Update vtag verification for ABORT/SHUTDOWN_COMPLETE based on the above
description.
Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.")
Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman@est.tech>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'lib')
0 files changed, 0 insertions, 0 deletions