Commit 35c038b0 authored by Florian Westphal's avatar Florian Westphal
Browse files

netfilter: nf_nat: mask out non-verdict bits when checking return value 



Same as previous change: we need to mask out the non-verdict bits, as
upcoming patches may embed an errno value in NF_STOLEN verdicts too.

NF_DROP could already do this, but not all called functions do this.

Checks that only test ret vs NF_ACCEPT are fine, the 'errno parts'
are always 0 for those.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
parent 6291b3a6

net/netfilter/nf_nat_proto.c

+3 −2
Original line number Diff line number Diff line
@@ -999,11 +999,12 @@ static unsigned int 
nf_nat_ipv6_in(void *priv, struct sk_buff *skb,

	       const struct nf_hook_state *state)

{

	unsigned int ret;

	unsigned int ret, verdict;

	struct in6_addr daddr = ipv6_hdr(skb)->daddr;



	ret = nf_nat_ipv6_fn(priv, skb, state);

	if (ret != NF_DROP && ret != NF_STOLEN &&

	verdict = ret & NF_VERDICT_MASK;

	if (verdict != NF_DROP && verdict != NF_STOLEN &&

	    ipv6_addr_cmp(&daddr, &ipv6_hdr(skb)->daddr))

		skb_dst_drop(skb);