Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit db898aa2 authored by Patrick McHardy's avatar Patrick McHardy
Browse files

netfilter: ipt_ecn: fix inversion for IP header ECN match 



Userspace allows to specify inversion for IP header ECN matches, the
kernel silently accepts it, but doesn't invert the match result.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent 58d5a025

net/ipv4/netfilter/ipt_ecn.c

+2 −1
Original line number Diff line number Diff line
@@ -25,7 +25,8 @@ MODULE_LICENSE("GPL"); 
static inline bool match_ip(const struct sk_buff *skb,

			    const struct ipt_ecn_info *einfo)

{

	return (ip_hdr(skb)->tos & IPT_ECN_IP_MASK) == einfo->ip_ect;

	return ((ip_hdr(skb)->tos & IPT_ECN_IP_MASK) == einfo->ip_ect) ^

	       !!(einfo->invert & IPT_ECN_OP_MATCH_IP);

}



static inline bool match_tcp(const struct sk_buff *skb,