diff options
| author | Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp> | 2008-09-24 15:53:39 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2008-09-24 15:53:39 -0700 |
| commit | 8ca31ce52a5cfd03b960fd81a49197ae85d25347 (patch) | |
| tree | 741d9f22a3da1b8ff023153d52c3c22422a04a9d | |
| parent | 5fbcd260c2c52f78cd699f65e9c7af2e60b5380c (diff) | |
| download | linux-8ca31ce52a5cfd03b960fd81a49197ae85d25347.tar.gz linux-8ca31ce52a5cfd03b960fd81a49197ae85d25347.tar.bz2 linux-8ca31ce52a5cfd03b960fd81a49197ae85d25347.zip | |
netfilter: ip6t_{hbh,dst}: Rejects not-strict mode on rule insertion
The current code ignores rules for internal options in HBH/DST options
header in packet processing if 'Not strict' mode is specified (which is not
implemented). Clearly it is not expected by user.
Kernel should reject HBH/DST rule insertion with 'Not strict' mode
in the first place.
Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/ipv6/netfilter/ip6t_hbh.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c index 62e39ace0588..26654b26d7fa 100644 --- a/net/ipv6/netfilter/ip6t_hbh.c +++ b/net/ipv6/netfilter/ip6t_hbh.c @@ -97,8 +97,6 @@ hbh_mt6(const struct sk_buff *skb, const struct net_device *in, hdrlen -= 2; if (!(optinfo->flags & IP6T_OPTS_OPTS)) { return ret; - } else if (optinfo->flags & IP6T_OPTS_NSTRICT) { - pr_debug("Not strict - not implemented"); } else { pr_debug("Strict "); pr_debug("#%d ", optinfo->optsnr); @@ -177,6 +175,12 @@ hbh_mt6_check(const char *tablename, const void *entry, pr_debug("ip6t_opts: unknown flags %X\n", optsinfo->invflags); return false; } + + if (optsinfo->flags & IP6T_OPTS_NSTRICT) { + pr_debug("ip6t_opts: Not strict - not implemented"); + return false; + } + return true; } |