diff options
| author |   Florian Westphal <fw@strlen.de> | 2023-10-11 09:59:37 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2023-10-18 10:26:43 +0200 |
| commit | 35c038b0a4be197679deefaf96998241cb7efc88 (patch) | |
| tree | 74b83200f08035ab4dbf5ea1756de7fb7ad05c79 /net/netfilter/nf_nat_proto.c | |
| parent | netfilter: conntrack: convert nf_conntrack_update to netfilter verdicts (diff) | |
| download | wireguard-linux-35c038b0a4be197679deefaf96998241cb7efc88.tar.xz wireguard-linux-35c038b0a4be197679deefaf96998241cb7efc88.zip | |
netfilter: nf_nat: mask out non-verdict bits when checking return value
Same as previous change: we need to mask out the non-verdict bits, as
upcoming patches may embed an errno value in NF_STOLEN verdicts too.
NF_DROP could already do this, but not all called functions do this.
Checks that only test ret vs NF_ACCEPT are fine, the 'errno parts'
are always 0 for those.
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'net/netfilter/nf_nat_proto.c')
| -rw-r--r-- | net/netfilter/nf_nat_proto.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/net/netfilter/nf_nat_proto.c b/net/netfilter/nf_nat_proto.c index 5a049740758f..6d969468c779 100644 --- a/net/netfilter/nf_nat_proto.c +++ b/net/netfilter/nf_nat_proto.c @@ -999,11 +999,12 @@ static unsigned int nf_nat_ipv6_in(void *priv, struct sk_buff *skb, const struct nf_hook_state *state) { - unsigned int ret; + unsigned int ret, verdict; struct in6_addr daddr = ipv6_hdr(skb)->daddr; ret = nf_nat_ipv6_fn(priv, skb, state); - if (ret != NF_DROP && ret != NF_STOLEN && + verdict = ret & NF_VERDICT_MASK; + if (verdict != NF_DROP && verdict != NF_STOLEN && ipv6_addr_cmp(&daddr, &ipv6_hdr(skb)->daddr)) skb_dst_drop(skb); |