Mirrors_Framework/nuttx
1
0
Fork 0
mirror of https://github.com/apache/nuttx.git synced 2026-08-17 17:43:22 +08:00
Code Issues Actions 8 Packages Projects Releases Wiki Activity

net/ipfilter: Reassemble IPv6 fragments before filtering

Browse Source 
IPv6 input currently lets fragmented packets continue into the IP filter path before reassembly. Forwarded IP filter rules can inspect L4 fields, but non-first IPv6 fragments do not carry the transport header.

Consume IPv6 fragments through the existing reassembly/drop helper before NAT66 or IP filter processing. This keeps plain IPv6 forwarding unchanged when neither L4-dependent feature is enabled, while avoiding filtering incomplete fragments.

Signed-off-by: shichunma <shichunma@bestechnic.com>
This commit is contained in:
shichunma
2026-08-01 17:40:07 -03:00
committed by Alan C. Assis
parent 0ed3a38638
commit 9aa6eb5671
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/devif/ipv6_input.c
+6 -4
View File
@@ -151,7 +151,7 @@ static bool check_destipaddr(FAR struct net_driver_s *dev,
return false;
}
#if defined(CONFIG_NET_IPFRAG) || defined(CONFIG_NET_NAT66)
#if defined(CONFIG_NET_IPFRAG) || defined(CONFIG_NET_NAT66) || defined(CONFIG_NET_IPFILTER)
/****************************************************************************
* Name: ipv6_fragin_or_drop
*
@@ -225,7 +225,7 @@ static int ipv6_in(FAR struct net_driver_s *dev)
#ifdef CONFIG_NET_IPFORWARD
int ret;
#endif
#if defined(CONFIG_NET_IPFRAG) || defined(CONFIG_NET_NAT66)
#if defined(CONFIG_NET_IPFRAG) || defined(CONFIG_NET_NAT66) || defined(CONFIG_NET_IPFILTER)
bool isfrag = false;
#endif
@@ -317,7 +317,7 @@ static int ipv6_in(FAR struct net_driver_s *dev)
if (nxthdr == NEXT_FRAGMENT_EH)
{
extlen = EXTHDR_FRAG_LEN;
#if defined(CONFIG_NET_IPFRAG) || defined(CONFIG_NET_NAT66)
#if defined(CONFIG_NET_IPFRAG) || defined(CONFIG_NET_NAT66) || defined(CONFIG_NET_IPFILTER)
isfrag = true;
#endif
}
@@ -331,12 +331,14 @@ static int ipv6_in(FAR struct net_driver_s *dev)
nxthdr = exthdr->nxthdr;
}
#ifdef CONFIG_NET_NAT66
#if defined(CONFIG_NET_NAT66) || defined(CONFIG_NET_IPFILTER)
if (isfrag)
{
return ipv6_fragin_or_drop(dev);
}
#endif
#ifdef CONFIG_NET_NAT66
/* Try NAT inbound, rule matching will be performed in NAT module. */
ipv6_nat_inbound(dev, ipv6);