mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-06 02:50:43 +00:00
netfilter: ipt_ecn: fix inversion for IP header ECN match
Userspace allows to specify inversion for IP header ECN matches, the kernel silently accepts it, but doesn't invert the match result. Signed-off-by: Patrick McHardy <kaber@trash.net>
This commit is contained in:
parent
58d5a0257d
commit
db898aa2ef
1 changed files with 2 additions and 1 deletions
|
@ -25,7 +25,8 @@ MODULE_LICENSE("GPL");
|
|||
static inline bool match_ip(const struct sk_buff *skb,
|
||||
const struct ipt_ecn_info *einfo)
|
||||
{
|
||||
return (ip_hdr(skb)->tos & IPT_ECN_IP_MASK) == einfo->ip_ect;
|
||||
return ((ip_hdr(skb)->tos & IPT_ECN_IP_MASK) == einfo->ip_ect) ^
|
||||
!!(einfo->invert & IPT_ECN_OP_MATCH_IP);
|
||||
}
|
||||
|
||||
static inline bool match_tcp(const struct sk_buff *skb,
|
||||
|
|
Loading…
Reference in a new issue