tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
netfilter: ipt_ecn: fix inversion for IP header ECN match
Userspace allows to specify inversion for IP header ECN matches, the
kernel silently accepts it, but doesn't invert the match result.
Signed-off-by: Patrick McHardy <kaber@trash.net>
+2
-1
+2
-1
net/ipv4/netfilter/ipt_ecn.c
+2
-1
net/ipv4/netfilter/ipt_ecn.c
···
25
25
static inline bool match_ip(const struct sk_buff *skb,
26
26
const struct ipt_ecn_info *einfo)
27
27
{
28
-
return (ip_hdr(skb)->tos & IPT_ECN_IP_MASK) == einfo->ip_ect;
28
+
return ((ip_hdr(skb)->tos & IPT_ECN_IP_MASK) == einfo->ip_ect) ^
29
+
!!(einfo->invert & IPT_ECN_OP_MATCH_IP);
29
30
}
30
31
31
32
static inline bool match_tcp(const struct sk_buff *skb,