Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8ca31ce5 authored by Yasuyuki Kozakai's avatar Yasuyuki Kozakai Committed by David S. Miller
Browse files

netfilter: ip6t_{hbh,dst}: Rejects not-strict mode on rule insertion 



The current code ignores rules for internal options in HBH/DST options
header in packet processing if 'Not strict' mode is specified (which is not
implemented). Clearly it is not expected by user.

Kernel should reject HBH/DST rule insertion with 'Not strict' mode
in the first place.

Signed-off-by: default avatarYasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5fbcd260

net/ipv6/netfilter/ip6t_hbh.c

+6 −2
Original line number Original line Diff line number Diff line
@@ -97,8 +97,6 @@ hbh_mt6(const struct sk_buff *skb, const struct net_device *in, 
	hdrlen -= 2;

	hdrlen -= 2;

	if (!(optinfo->flags & IP6T_OPTS_OPTS)) {

	if (!(optinfo->flags & IP6T_OPTS_OPTS)) {

		return ret;

		return ret;

	} else if (optinfo->flags & IP6T_OPTS_NSTRICT) {

		pr_debug("Not strict - not implemented");

	} else {

	} else {

		pr_debug("Strict ");

		pr_debug("Strict ");

		pr_debug("#%d ", optinfo->optsnr);

		pr_debug("#%d ", optinfo->optsnr);
@@ -177,6 +175,12 @@ hbh_mt6_check(const char *tablename, const void *entry, 
		pr_debug("ip6t_opts: unknown flags %X\n", optsinfo->invflags);

		pr_debug("ip6t_opts: unknown flags %X\n", optsinfo->invflags);

		return false;

		return false;

	}

	}



	if (optsinfo->flags & IP6T_OPTS_NSTRICT) {

		pr_debug("ip6t_opts: Not strict - not implemented");

		return false;

	}



	return true;

	return true;

}

}