mirror/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git synced 2026-02-04 17:33:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

BUG/MINOR: net_helper: fix IPv6 header length processing

Browse Source 
The IPv6 header contains a payload length that excludes the 40 bytes of
IPv6 packet header, which differs from IPv4's total length which includes
it. As a result, the parser was wrong and would only see the IP part and
not the TCP one unless sufficient options were present tocover it.

This issue came in 3.4-dev2 with recent commit e88e03a6e4 ("MINOR:
net_helper: add ip.fp() to build a simplified fingerprint of a SYN"),
so no backport is needed.
This commit is contained in:
Willy Tarreau
2026-01-13 08:42:36 +01:00
parent fcd4d4a7aa
commit 37057feb80
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/net_helper.c
View File

@@ -706,7 +706,7 @@ static int sample_conv_ip_fp(const struct arg *arg_p, struct sample *smp, void *
if (smp->data.u.str.data < 40)
return 0;
pktlen = read_n16(smp->data.u.str.area + 4);
pktlen = 40 + read_n16(smp->data.u.str.area + 4);
// extension/next proto => ext present if !tcp && !udp
ipext = smp->data.u.str.area[6];
ipext = ipext != 6 && ipext != 17;