diff options
| author |   David S. Miller <davem@conan.davemloft.net> | 2011-06-16 21:38:01 -0400 |
|---|---|---|
| committer | David S. Miller <davem@conan.davemloft.net> | 2011-06-16 21:38:01 -0400 |
| commit | 3009adf5acb2245216651318c2226812fd1b01a6 (patch) | |
| tree | 3fa6a085be2eab409aec447ab8bd7c4737321688 /net/ipv4/netfilter/ipt_ecn.c | |
| parent | net/hplance: hplance_init() should be __devinit (diff) | |
| parent | netfilter: nf_nat: avoid double seq_adjust for loopback (diff) | |
| download | linux-dev-3009adf5acb2245216651318c2226812fd1b01a6.tar.xz linux-dev-3009adf5acb2245216651318c2226812fd1b01a6.zip | |
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6
Diffstat (limited to 'net/ipv4/netfilter/ipt_ecn.c')
| -rw-r--r-- | net/ipv4/netfilter/ipt_ecn.c | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/net/ipv4/netfilter/ipt_ecn.c b/net/ipv4/netfilter/ipt_ecn.c index af6e9c778345..2b57e52c746c 100644 --- a/net/ipv4/netfilter/ipt_ecn.c +++ b/net/ipv4/netfilter/ipt_ecn.c @@ -25,7 +25,8 @@ MODULE_LICENSE("GPL"); static inline bool match_ip(const struct sk_buff *skb, const struct ipt_ecn_info *einfo) { - return (ip_hdr(skb)->tos & IPT_ECN_IP_MASK) == einfo->ip_ect; + return ((ip_hdr(skb)->tos & IPT_ECN_IP_MASK) == einfo->ip_ect) ^ + !!(einfo->invert & IPT_ECN_OP_MATCH_IP); } static inline bool match_tcp(const struct sk_buff *skb, @@ -76,8 +77,6 @@ static bool ecn_mt(const struct sk_buff *skb, struct xt_action_param *par) return false; if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR)) { - if (ip_hdr(skb)->protocol != IPPROTO_TCP) - return false; if (!match_tcp(skb, info, &par->hotdrop)) return false; } @@ -97,7 +96,7 @@ static int ecn_mt_check(const struct xt_mtchk_param *par) return -EINVAL; if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR) && - ip->proto != IPPROTO_TCP) { + (ip->proto != IPPROTO_TCP || ip->invflags & IPT_INV_PROTO)) { pr_info("cannot match TCP bits in rule for non-tcp packets\n"); return -EINVAL; } |