summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPatrick McHardy <kaber@trash.net>2011-06-16 17:24:55 +0200
committerPatrick McHardy <kaber@trash.net>2011-06-16 17:24:55 +0200
commitdb898aa2ef6529fa80891e754d353063611c77de (patch)
tree7ac085f1acb6d79516ac0043357fdac26505161f
parent58d5a0257d2fd89fbe4451f704193cc95b0a9c97 (diff)
downloadlinux-db898aa2ef6529fa80891e754d353063611c77de.tar.gz
linux-db898aa2ef6529fa80891e754d353063611c77de.tar.bz2
linux-db898aa2ef6529fa80891e754d353063611c77de.zip
netfilter: ipt_ecn: fix inversion for IP header ECN match
Userspace allows to specify inversion for IP header ECN matches, the kernel silently accepts it, but doesn't invert the match result. Signed-off-by: Patrick McHardy <kaber@trash.net>
-rw-r--r--net/ipv4/netfilter/ipt_ecn.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/net/ipv4/netfilter/ipt_ecn.c b/net/ipv4/netfilter/ipt_ecn.c
index aaa85be1b2d8..2b57e52c746c 100644
--- a/net/ipv4/netfilter/ipt_ecn.c
+++ b/net/ipv4/netfilter/ipt_ecn.c
@@ -25,7 +25,8 @@ MODULE_LICENSE("GPL");
static inline bool match_ip(const struct sk_buff *skb,
const struct ipt_ecn_info *einfo)
{
- return (ip_hdr(skb)->tos & IPT_ECN_IP_MASK) == einfo->ip_ect;
+ return ((ip_hdr(skb)->tos & IPT_ECN_IP_MASK) == einfo->ip_ect) ^
+ !!(einfo->invert & IPT_ECN_OP_MATCH_IP);
}
static inline bool match_tcp(const struct sk_buff *skb,