This is an automated email from the ASF dual-hosted git repository. acassis pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit 9aa6eb56715bcd41311b3386f4b5124f5657b92a Author: shichunma <[email protected]> AuthorDate: Sat Aug 1 22:09:51 2026 +0800 net/ipfilter: Reassemble IPv6 fragments before filtering IPv6 input currently lets fragmented packets continue into the IP filter path before reassembly. Forwarded IP filter rules can inspect L4 fields, but non-first IPv6 fragments do not carry the transport header. Consume IPv6 fragments through the existing reassembly/drop helper before NAT66 or IP filter processing. This keeps plain IPv6 forwarding unchanged when neither L4-dependent feature is enabled, while avoiding filtering incomplete fragments. Signed-off-by: shichunma <[email protected]> --- net/devif/ipv6_input.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/net/devif/ipv6_input.c b/net/devif/ipv6_input.c index 7236d320a10..3400fdebd79 100644 --- a/net/devif/ipv6_input.c +++ b/net/devif/ipv6_input.c @@ -151,7 +151,7 @@ static bool check_destipaddr(FAR struct net_driver_s *dev, return false; } -#if defined(CONFIG_NET_IPFRAG) || defined(CONFIG_NET_NAT66) +#if defined(CONFIG_NET_IPFRAG) || defined(CONFIG_NET_NAT66) || defined(CONFIG_NET_IPFILTER) /**************************************************************************** * Name: ipv6_fragin_or_drop * @@ -225,7 +225,7 @@ static int ipv6_in(FAR struct net_driver_s *dev) #ifdef CONFIG_NET_IPFORWARD int ret; #endif -#if defined(CONFIG_NET_IPFRAG) || defined(CONFIG_NET_NAT66) +#if defined(CONFIG_NET_IPFRAG) || defined(CONFIG_NET_NAT66) || defined(CONFIG_NET_IPFILTER) bool isfrag = false; #endif @@ -317,7 +317,7 @@ static int ipv6_in(FAR struct net_driver_s *dev) if (nxthdr == NEXT_FRAGMENT_EH) { extlen = EXTHDR_FRAG_LEN; -#if defined(CONFIG_NET_IPFRAG) || defined(CONFIG_NET_NAT66) +#if defined(CONFIG_NET_IPFRAG) || defined(CONFIG_NET_NAT66) || defined(CONFIG_NET_IPFILTER) isfrag = true; #endif } @@ -331,12 +331,14 @@ static int ipv6_in(FAR struct net_driver_s *dev) nxthdr = exthdr->nxthdr; } -#ifdef CONFIG_NET_NAT66 +#if defined(CONFIG_NET_NAT66) || defined(CONFIG_NET_IPFILTER) if (isfrag) { return ipv6_fragin_or_drop(dev); } +#endif +#ifdef CONFIG_NET_NAT66 /* Try NAT inbound, rule matching will be performed in NAT module. */ ipv6_nat_inbound(dev, ipv6);
