ChangeSet 1.1544, 2004/12/21 17:44:40+01:00, [EMAIL PROTECTED]
[NETFILTER]: Backport fixes for ip6t_ipv6header
This patch fixes following bugs in ip6t_ipv6header.c
- The cast of the pointer to the next IPv6 extension header is wrong.
- The logical operation is wrong. These fixes intends
- soft mode without invert flag "!"
match if the packet contains all of the specified headers.
- soft mode with invert flag "!"
match if the packet DOESN'T contain all of the specified
headers.
- strict mode without invert flag "!"
match if the packet contains JUST ONLY the specified headers.
if the packet doesn't contain some specified headers or
contains unspecified headers, the packet doesn't match with
rule.
- strict mode with invert flag "!"
NOT MATCH if the packet contains JUST ONLY the specified
headers. Otherwise, match. So, if the packet contains some
specified headers and DOESN'T contain other specified headers,
the packet MATCHES with rule.
Signed-off-by: Yasuyuki KOZAKAI <[EMAIL PROTECTED]>
Signed-off-by: Patrick McHardy <[EMAIL PROTECTED]>
ip6t_ipv6header.c | 24 +++++++++++++++++-------
1 files changed, 17 insertions(+), 7 deletions(-)
diff -Nru a/net/ipv6/netfilter/ip6t_ipv6header.c
b/net/ipv6/netfilter/ip6t_ipv6header.c
--- a/net/ipv6/netfilter/ip6t_ipv6header.c 2005-01-15 07:04:42 -08:00
+++ b/net/ipv6/netfilter/ip6t_ipv6header.c 2005-01-15 07:04:42 -08:00
@@ -63,7 +63,7 @@
break;
}
- hdr=(struct ipv6_opt_hdr *)skb->data+ptr;
+ hdr=(struct ipv6_opt_hdr *)(skb->data+ptr);
/* Calculate the header length */
if (nexthdr == NEXTHDR_FRAGMENT) {
@@ -107,10 +107,14 @@
temp |= MASK_PROTO;
if (info->modeflag)
- return (!( (temp & info->matchflags)
- ^ info->matchflags) ^ info->invflags);
- else
- return (!( temp ^ info->matchflags) ^ info->invflags);
+ return !((temp ^ info->matchflags ^ info->invflags)
+ & info->matchflags);
+ else {
+ if (info->invflags)
+ return temp != info->matchflags;
+ else
+ return temp == info->matchflags;
+ }
}
static int
@@ -120,11 +124,17 @@
unsigned int matchsize,
unsigned int hook_mask)
{
+ const struct ip6t_ipv6header_info *info = matchinfo;
+
/* Check for obvious errors */
/* This match is valid in all hooks! */
- if (matchsize != IP6T_ALIGN(sizeof(struct ip6t_ipv6header_info))) {
+ if (matchsize != IP6T_ALIGN(sizeof(struct ip6t_ipv6header_info)))
+ return 0;
+
+ /* invflags is 0 or 0xff in hard mode */
+ if ((!info->modeflag) && info->invflags != 0x00
+ && info->invflags != 0xFF)
return 0;
- }
return 1;
}
-
To unsubscribe from this list: send the line "unsubscribe bk-commits-24" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
