diff options
author | Florian Westphal <fw@strlen.de> | 2017-04-04 20:46:46 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2017-04-08 22:30:36 +0200 |
commit | 65666972f8d33b8594843568fb4c6f819d4a3e78 (patch) | |
tree | 20882bd8e31a12ff0518596deb4ff41aac733596 /src/netlink_delinearize.c | |
parent | 54370e1630e95755a6cfada95389bda34e8ffd83 (diff) |
exthdr: avoid crash with older kernels
if kernel is older it won't understand the EXTHDR_OP attribute, i.e.
the rule gets accepted as a check for ipv6 exthdr.
On dump nft is then presented with a invalid ipv6 exthdr.
So we need to get rid of the assert and output an "invalid" message on
list. Longterm we need a proper vm description or kernel-side check
to reject such messages in first place.
After patch, test suite yields erros of type
ip6/tcpopt.t: WARNING: 'src/nft add rule --debug=netlink ip6 test-ip6 \
input tcp option sack right 1': 'tcp option sack right 1' mismatches
'ip6 nexthdr 6 unknown-exthdr unknown 0x1 [invalid type]'
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/netlink_delinearize.c')
0 files changed, 0 insertions, 0 deletions