|
|
@ -20,7 +20,7 @@ |
|
|
|
if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
|
|
|
|
if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
|
|
|
|
IPT_INV_SRCIP) ||
|
|
|
|
IPT_INV_SRCIP) ||
|
|
|
|
FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
|
|
|
|
FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
|
|
|
|
@@ -134,6 +137,26 @@ ip_packet_match(const struct iphdr *ip,
|
|
|
|
@@ -134,6 +137,29 @@ ip_packet_match(const struct iphdr *ip,
|
|
|
|
return true;
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
@ -38,6 +38,9 @@ |
|
|
|
+ if (memcmp(ip->outiface_mask, iface_mask, IFNAMSIZ) != 0)
|
|
|
|
+ if (memcmp(ip->outiface_mask, iface_mask, IFNAMSIZ) != 0)
|
|
|
|
+ return;
|
|
|
|
+ return;
|
|
|
|
+
|
|
|
|
+
|
|
|
|
|
|
|
|
+ if (ip->smsk.s_addr || ip->dmsk.s_addr)
|
|
|
|
|
|
|
|
+ return;
|
|
|
|
|
|
|
|
+
|
|
|
|
+ if (ip->proto)
|
|
|
|
+ if (ip->proto)
|
|
|
|
+ return;
|
|
|
|
+ return;
|
|
|
|
+
|
|
|
|
+
|
|
|
@ -47,7 +50,7 @@ |
|
|
|
static bool
|
|
|
|
static bool
|
|
|
|
ip_checkentry(const struct ipt_ip *ip)
|
|
|
|
ip_checkentry(const struct ipt_ip *ip)
|
|
|
|
{
|
|
|
|
{
|
|
|
|
@@ -561,7 +584,7 @@ static void cleanup_match(struct xt_entr
|
|
|
|
@@ -561,7 +587,7 @@ static void cleanup_match(struct xt_entr
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
static int
|
|
|
|
static int
|
|
|
@ -56,7 +59,7 @@ |
|
|
|
{
|
|
|
|
{
|
|
|
|
const struct xt_entry_target *t;
|
|
|
|
const struct xt_entry_target *t;
|
|
|
|
|
|
|
|
|
|
|
|
@@ -570,6 +593,8 @@ check_entry(const struct ipt_entry *e, c
|
|
|
|
@@ -570,6 +596,8 @@ check_entry(const struct ipt_entry *e, c
|
|
|
|
return -EINVAL;
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
@ -65,7 +68,7 @@ |
|
|
|
if (e->target_offset + sizeof(struct xt_entry_target) >
|
|
|
|
if (e->target_offset + sizeof(struct xt_entry_target) >
|
|
|
|
e->next_offset)
|
|
|
|
e->next_offset)
|
|
|
|
return -EINVAL;
|
|
|
|
return -EINVAL;
|
|
|
|
@@ -931,6 +956,7 @@ copy_entries_to_user(unsigned int total_
|
|
|
|
@@ -931,6 +959,7 @@ copy_entries_to_user(unsigned int total_
|
|
|
|
const struct xt_table_info *private = table->private;
|
|
|
|
const struct xt_table_info *private = table->private;
|
|
|
|
int ret = 0;
|
|
|
|
int ret = 0;
|
|
|
|
const void *loc_cpu_entry;
|
|
|
|
const void *loc_cpu_entry;
|
|
|
@ -73,11 +76,10 @@ |
|
|
|
|
|
|
|
|
|
|
|
counters = alloc_counters(table);
|
|
|
|
counters = alloc_counters(table);
|
|
|
|
if (IS_ERR(counters))
|
|
|
|
if (IS_ERR(counters))
|
|
|
|
@@ -961,6 +987,14 @@ copy_entries_to_user(unsigned int total_
|
|
|
|
@@ -962,6 +991,14 @@ copy_entries_to_user(unsigned int total_
|
|
|
|
ret = -EFAULT;
|
|
|
|
|
|
|
|
goto free_counters;
|
|
|
|
goto free_counters;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
+
|
|
|
|
|
|
|
|
+ flags = e->ip.flags & IPT_F_MASK;
|
|
|
|
+ flags = e->ip.flags & IPT_F_MASK;
|
|
|
|
+ if (copy_to_user(userptr + off
|
|
|
|
+ if (copy_to_user(userptr + off
|
|
|
|
+ + offsetof(struct ipt_entry, ip.flags),
|
|
|
|
+ + offsetof(struct ipt_entry, ip.flags),
|
|
|
@ -85,6 +87,7 @@ |
|
|
|
+ ret = -EFAULT;
|
|
|
|
+ ret = -EFAULT;
|
|
|
|
+ goto free_counters;
|
|
|
|
+ goto free_counters;
|
|
|
|
+ }
|
|
|
|
+ }
|
|
|
|
|
|
|
|
+
|
|
|
|
for (i = sizeof(struct ipt_entry);
|
|
|
|
for (i = sizeof(struct ipt_entry);
|
|
|
|
i < e->target_offset;
|
|
|
|
i < e->target_offset;
|
|
|
|
|
|
|
|
i += m->u.match_size) {
|
|
|
|