14 files changed, 40 insertions, 16 deletions

diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 7743e0d109ea..375417e633c9 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1458,6 +1458,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
         const struct ipv6hdr *ip6h;
         u8 icmp6_type;
         u8 nexthdr;
+        __be16 frag_off;
         unsigned len;
         int offset;
         int err;
@@ -1483,7 +1484,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
                 return -EINVAL;
 
         nexthdr = ip6h->nexthdr;
-        offset = ipv6_skip_exthdr(skb, sizeof(*ip6h), &nexthdr);
+        offset = ipv6_skip_exthdr(skb, sizeof(*ip6h), &nexthdr, &frag_off);
 
         if (offset < 0 || nexthdr != IPPROTO_ICMPV6)
                 return 0;
diff --git a/net/bridge/netfilter/ebt_ip6.c b/net/bridge/netfilter/ebt_ip6.c
index 2ed0056a39a8..99c85668f551 100644
--- a/net/bridge/netfilter/ebt_ip6.c
+++ b/net/bridge/netfilter/ebt_ip6.c
@@ -55,9 +55,10 @@ ebt_ip6_mt(const struct sk_buff *skb, struct xt_action_param *par)
                 return false;
         if (info->bitmask & EBT_IP6_PROTO) {
                 uint8_t nexthdr = ih6->nexthdr;
+                __be16 frag_off;
                 int offset_ph;
 
-                offset_ph = ipv6_skip_exthdr(skb, sizeof(_ip6h), &nexthdr);
+                offset_ph = ipv6_skip_exthdr(skb, sizeof(_ip6h), &nexthdr, &frag_off);
                 if (offset_ph == -1)
                         return false;
                 if (FWINV(info->protocol != nexthdr, EBT_IP6_PROTO))
diff --git a/net/bridge/netfilter/ebt_log.c b/net/bridge/netfilter/ebt_log.c
index 6e5a8bb9b940..88d7d1d1cb1b 100644
--- a/net/bridge/netfilter/ebt_log.c
+++ b/net/bridge/netfilter/ebt_log.c
@@ -113,6 +113,7 @@ ebt_log_packet(u_int8_t pf, unsigned int hooknum,
                 const struct ipv6hdr *ih;
                 struct ipv6hdr _iph;
                 uint8_t nexthdr;
+                __be16 frag_off;
                 int offset_ph;
 
                 ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
@@ -123,7 +124,7 @@ ebt_log_packet(u_int8_t pf, unsigned int hooknum,
                 printk(" IPv6 SRC=%pI6 IPv6 DST=%pI6, IPv6 priority=0x%01X, Next Header=%d",
                        &ih->saddr, &ih->daddr, ih->priority, ih->nexthdr);
                 nexthdr = ih->nexthdr;
-                offset_ph = ipv6_skip_exthdr(skb, sizeof(_iph), &nexthdr);
+                offset_ph = ipv6_skip_exthdr(skb, sizeof(_iph), &nexthdr, &frag_off);
                 if (offset_ph == -1)
                         goto out;
                 print_ports(skb, nexthdr, offset_ph);
diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
index 37f548b7f6dc..72957f4a7c6c 100644
--- a/net/ipv6/exthdrs_core.c
+++ b/net/ipv6/exthdrs_core.c
@@ -57,6 +57,9 @@ int ipv6_ext_hdr(u8 nexthdr)
  *          it returns NULL.
  *        - First fragment header is skipped, not-first ones
  *          are considered as unparsable.
+ *        - Reports the offset field of the final fragment header so it is
+ *          possible to tell whether this is a first fragment, later fragment,
+ *          or not fragmented.
  *        - ESP is unparsable for now and considered like
  *          normal payload protocol.
  *        - Note also special handling of AUTH header. Thanks to IPsec wizards.
@@ -64,10 +67,13 @@ int ipv6_ext_hdr(u8 nexthdr)
  * --ANK (980726)
  */
 
-int ipv6_skip_exthdr(const struct sk_buff *skb, int start, u8 *nexthdrp)
+int ipv6_skip_exthdr(const struct sk_buff *skb, int start, u8 *nexthdrp,
+                     __be16 *frag_offp)
 {
         u8 nexthdr = *nexthdrp;
 
+        *frag_offp = 0;
+
         while (ipv6_ext_hdr(nexthdr)) {
                 struct ipv6_opt_hdr _hdr, *hp;
                 int hdrlen;
@@ -87,7 +93,8 @@ int ipv6_skip_exthdr(const struct sk_buff *skb, int start, u8 *nexthdrp)
                         if (fp == NULL)
                                 return -1;
 
-                        if (ntohs(*fp) & ~0x7)
+                        *frag_offp = *fp;
+                        if (ntohs(*frag_offp) & ~0x7)
                                 break;
                         hdrlen = 8;
                 } else if (nexthdr == NEXTHDR_AUTH)
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 9e2bdccf9143..01d46bff63c3 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -135,11 +135,12 @@ static int is_ineligible(struct sk_buff *skb)
         int ptr = (u8 *)(ipv6_hdr(skb) + 1) - skb->data;
         int len = skb->len - ptr;
         __u8 nexthdr = ipv6_hdr(skb)->nexthdr;
+        __be16 frag_off;
 
         if (len < 0)
                 return 1;
 
-        ptr = ipv6_skip_exthdr(skb, ptr, &nexthdr);
+        ptr = ipv6_skip_exthdr(skb, ptr, &nexthdr, &frag_off);
         if (ptr < 0)
                 return 0;
         if (nexthdr == IPPROTO_ICMPV6) {
@@ -596,6 +597,7 @@ static void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info)
         int inner_offset;
         int hash;
         u8 nexthdr;
+        __be16 frag_off;
 
         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
                 return;
@@ -603,7 +605,8 @@ static void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info)
         nexthdr = ((struct ipv6hdr *)skb->data)->nexthdr;
         if (ipv6_ext_hdr(nexthdr)) {
                 /* now skip over extension headers */
-                inner_offset = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr);
+                inner_offset = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr),
+                                                &nexthdr, &frag_off);
                 if (inner_offset<0)
                         return;
         } else {
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index a46c64eb0a66..1ca5d45a12e8 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -280,6 +280,7 @@ int ip6_mc_input(struct sk_buff *skb)
                         u8 *ptr = skb_network_header(skb) + opt->ra;
                         struct icmp6hdr *icmp6;
                         u8 nexthdr = hdr->nexthdr;
+                        __be16 frag_off;
                         int offset;
 
                         /* Check if the value of Router Alert
@@ -293,7 +294,7 @@ int ip6_mc_input(struct sk_buff *skb)
                                         goto out;
                                 }
                                 offset = ipv6_skip_exthdr(skb, sizeof(*hdr),
-                                                          &nexthdr);
+                                                          &nexthdr, &frag_off);
                                 if (offset < 0)
                                         goto out;
 
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index a24e15557843..3221bc675654 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -329,10 +329,11 @@ static int ip6_forward_proxy_check(struct sk_buff *skb)
 {
         struct ipv6hdr *hdr = ipv6_hdr(skb);
         u8 nexthdr = hdr->nexthdr;
+        __be16 frag_off;
         int offset;
 
         if (ipv6_ext_hdr(nexthdr)) {
-                offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr);
+                offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr, &frag_off);
                 if (offset < 0)
                         return 0;
         } else
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index b5a2aa58a03a..aad2fa41cf46 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -49,6 +49,7 @@ static void send_reset(struct net *net, struct sk_buff *oldskb)
         const __u8 tclass = DEFAULT_TOS_VALUE;
         struct dst_entry *dst = NULL;
         u8 proto;
+        __be16 frag_off;
         struct flowi6 fl6;
 
         if ((!(ipv6_addr_type(&oip6h->saddr) & IPV6_ADDR_UNICAST)) ||
@@ -58,7 +59,7 @@ static void send_reset(struct net *net, struct sk_buff *oldskb)
         }
 
         proto = oip6h->nexthdr;
-        tcphoff = ipv6_skip_exthdr(oldskb, ((u8*)(oip6h+1) - oldskb->data), &proto);
+        tcphoff = ipv6_skip_exthdr(oldskb, ((u8*)(oip6h+1) - oldskb->data), &proto, &frag_off);
 
         if ((tcphoff < 0) || (tcphoff > oldskb->len)) {
                 pr_debug("Cannot get TCP header.\n");
diff --git a/net/netfilter/ipset/ip_set_getport.c b/net/netfilter/ipset/ip_set_getport.c
index 052579fe389a..b71a6e7ab0a5 100644
--- a/net/netfilter/ipset/ip_set_getport.c
+++ b/net/netfilter/ipset/ip_set_getport.c
@@ -116,9 +116,11 @@ ip_set_get_ip6_port(const struct sk_buff *skb, bool src,
 {
         int protoff;
         u8 nexthdr;
+        __be16 frag_off;
 
         nexthdr = ipv6_hdr(skb)->nexthdr;
-        protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr);
+        protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,
+                                   &frag_off);
         if (protoff < 0)
                 return false;
 
diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c
index 4bca15a0c385..ba92824086f3 100644
--- a/net/netfilter/xt_AUDIT.c
+++ b/net/netfilter/xt_AUDIT.c
@@ -98,6 +98,7 @@ static void audit_ip6(struct audit_buffer *ab, struct sk_buff *skb)
         struct ipv6hdr _ip6h;
         const struct ipv6hdr *ih;
         u8 nexthdr;
+        __be16 frag_off;
         int offset;
 
         ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h), &_ip6h);
@@ -108,7 +109,7 @@ static void audit_ip6(struct audit_buffer *ab, struct sk_buff *skb)
 
         nexthdr = ih->nexthdr;
         offset = ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h),
-                                  &nexthdr);
+                                  &nexthdr, &frag_off);
 
         audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu",
                          &ih->saddr, &ih->daddr, nexthdr);
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index 3ecade3966d5..ba722621ed25 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -204,11 +204,12 @@ tcpmss_tg6(struct sk_buff *skb, const struct xt_action_param *par)
 {
         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
         u8 nexthdr;
+        __be16 frag_off;
         int tcphoff;
         int ret;
 
         nexthdr = ipv6h->nexthdr;
-        tcphoff = ipv6_skip_exthdr(skb, sizeof(*ipv6h), &nexthdr);
+        tcphoff = ipv6_skip_exthdr(skb, sizeof(*ipv6h), &nexthdr, &frag_off);
         if (tcphoff < 0)
                 return NF_DROP;
         ret = tcpmss_mangle_packet(skb, par->targinfo,
diff --git a/net/netfilter/xt_TCPOPTSTRIP.c b/net/netfilter/xt_TCPOPTSTRIP.c
index 9dc9ecfdd546..3a295cc734bd 100644
--- a/net/netfilter/xt_TCPOPTSTRIP.c
+++ b/net/netfilter/xt_TCPOPTSTRIP.c
@@ -87,9 +87,10 @@ tcpoptstrip_tg6(struct sk_buff *skb, const struct xt_action_param *par)
         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
         int tcphoff;
         u_int8_t nexthdr;
+        __be16 frag_off;
 
         nexthdr = ipv6h->nexthdr;
-        tcphoff = ipv6_skip_exthdr(skb, sizeof(*ipv6h), &nexthdr);
+        tcphoff = ipv6_skip_exthdr(skb, sizeof(*ipv6h), &nexthdr, &frag_off);
         if (tcphoff < 0)
                 return NF_DROP;
 
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index dfd52bad1523..068698f64791 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -445,6 +445,7 @@ hashlimit_init_dst(const struct xt_hashlimit_htable *hinfo,
 {
         __be16 _ports[2], *ports;
         u8 nexthdr;
+        __be16 frag_off;
         int poff;
 
         memset(dst, 0, sizeof(*dst));
@@ -480,7 +481,7 @@ hashlimit_init_dst(const struct xt_hashlimit_htable *hinfo,
                       (XT_HASHLIMIT_HASH_DPT | XT_HASHLIMIT_HASH_SPT)))
                         return 0;
                 nexthdr = ipv6_hdr(skb)->nexthdr;
-                protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr);
+                protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr, &frag_off);
                 if ((int)protoff < 0)
                         return -1;
                 break;
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index fe39f7e913df..c302e30dc50c 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -214,6 +214,7 @@ extract_icmp6_fields(const struct sk_buff *skb,
         struct icmp6hdr *icmph, _icmph;
         __be16 *ports, _ports[2];
         u8 inside_nexthdr;
+        __be16 inside_fragoff;
         int inside_hdrlen;
 
         icmph = skb_header_pointer(skb, outside_hdrlen,
@@ -229,7 +230,8 @@ extract_icmp6_fields(const struct sk_buff *skb,
                 return 1;
         inside_nexthdr = inside_iph->nexthdr;
 
-        inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) + sizeof(_inside_iph), &inside_nexthdr);
+        inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) + sizeof(_inside_iph),
+                                         &inside_nexthdr, &inside_fragoff);
         if (inside_hdrlen < 0)
                 return 1; /* hjm: Packet has no/incomplete transport layer headers. */