From: Patrick McHardy Date: Sat, 4 Feb 2006 10:17:26 +0000 (-0800) Subject: [NETFILTER]: Check policy length in policy match strict mode X-Git-Tag: v2.6.16-rc3~146^2~3 X-Git-Url: https://openfabrics.org/gitweb/?a=commitdiff_plain;h=e55f1bc5dcb60a47764f6eabd1501d2cb98fb2c4;p=~shefty%2Frdma-dev.git [NETFILTER]: Check policy length in policy match strict mode Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller --- diff --git a/net/ipv4/netfilter/ipt_policy.c b/net/ipv4/netfilter/ipt_policy.c index 18ca8258a1c..a48949a3a75 100644 --- a/net/ipv4/netfilter/ipt_policy.c +++ b/net/ipv4/netfilter/ipt_policy.c @@ -89,7 +89,7 @@ match_policy_out(const struct sk_buff *skb, const struct ipt_policy_info *info) return 0; } - return strict ? 1 : 0; + return strict ? i == info->len : 0; } static int match(const struct sk_buff *skb, diff --git a/net/ipv6/netfilter/ip6t_policy.c b/net/ipv6/netfilter/ip6t_policy.c index afe1cc4c18a..9f38cd0a648 100644 --- a/net/ipv6/netfilter/ip6t_policy.c +++ b/net/ipv6/netfilter/ip6t_policy.c @@ -91,7 +91,7 @@ match_policy_out(const struct sk_buff *skb, const struct ip6t_policy_info *info) return 0; } - return strict ? 1 : 0; + return strict ? i == info->len : 0; } static int match(const struct sk_buff *skb,