From: Florian Westphal <[email protected]>
Date: Tue, 1 Mar 2016 16:15:16 +0100
> When ipv6_find_hdr is used to find a fragment header
> (caller specifies target NEXTHDR_FRAGMENT) we erronously return
> -ENOENT for all fragments with nonzero offset.
>
> Before commit 9195bb8e381d, when target was specified, we did not
> enter the exthdr walk loop as nexthdr == target so this used to work.
>
> Now we do (so we can skip empty route headers). When we then stumble upon
> a frag with nonzero frag_off we must return -ENOENT ("header not found")
> only if the caller did not specifically request NEXTHDR_FRAGMENT.
>
> This allows nfables exthdr expression to match ipv6 fragments, e.g. via
>
> nft add rule ip6 filter input frag frag-off gt 0
>
> Fixes: 9195bb8e381d ("ipv6: improve ipv6_find_hdr() to skip empty routing
> headers")
> Signed-off-by: Florian Westphal <[email protected]>
Applied and queued up for -stable, thanks Florian.
