personal_interest_mirrors/nebula
1
0
Fork 0
mirror of https://github.com/slackhq/nebula.git synced 2025-11-22 08:24:25 +01:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Fix off by one error in IPv6 packet parser (#1419)
Some checks failed
gofmt / Run gofmt (push) Successful in 39s
Details
smoke-extra / Run extra smoke tests (push) Failing after 21s
Details
smoke / Run multi node smoke test (push) Failing after 1m21s
Details
Build and test / Build all and test on ubuntu-linux (push) Failing after 18m35s
Details
Build and test / Build and test on linux with boringcrypto (push) Failing after 2m36s
Details
Build and test / Build and test on linux with pkcs11 (push) Failing after 2m28s
Details
Build and test / Build and test on macos-latest (push) Has been cancelled
Details
Build and test / Build and test on windows-latest (push) Has been cancelled
Details

Browse Source
This commit is contained in:
brad-defined
2025-06-11 15:15:15 -04:00
committed by GitHub
parent 061e733007
commit 442a52879b
2 changed files with 47 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
outside.go
View File

@@ -312,12 +312,11 @@ func parseV6(data []byte, incoming bool, fp *firewall.Packet) error {
offset := ipv6.HeaderLen // Start at the end of the ipv6 header
next := 0
for {
if dataLen < offset {
if protoAt >= dataLen {
break
}
proto := layers.IPProtocol(data[protoAt])
//fmt.Println(proto, protoAt)
switch proto {
case layers.IPProtocolICMPv6, layers.IPProtocolESP, layers.IPProtocolNoNextHeader:
fp.Protocol = uint8(proto)
@@ -365,7 +364,7 @@ func parseV6(data []byte, incoming bool, fp *firewall.Packet) error {
case layers.IPProtocolAH:
// Auth headers, used by IPSec, have a different meaning for header length
if dataLen < offset+1 {
if dataLen <= offset+1 {
break
}
@@ -373,7 +372,7 @@ func parseV6(data []byte, incoming bool, fp *firewall.Packet) error {
default:
// Normal ipv6 header length processing
if dataLen < offset+1 {
if dataLen <= offset+1 {
break
}