diff options
Diffstat (limited to 'net-firewall/iptables/files/iptables-1.8.9-fix-checking-existence-of-rule.patch')
| -rw-r--r-- | net-firewall/iptables/files/iptables-1.8.9-fix-checking-existence-of-rule.patch | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/net-firewall/iptables/files/iptables-1.8.9-fix-checking-existence-of-rule.patch b/net-firewall/iptables/files/iptables-1.8.9-fix-checking-existence-of-rule.patch new file mode 100644 index 000000000000..16c894f185e7 --- /dev/null +++ b/net-firewall/iptables/files/iptables-1.8.9-fix-checking-existence-of-rule.patch @@ -0,0 +1,34 @@ +https://git.netfilter.org/iptables/commit/?id=78850e7dba64a949c440dbdbe557f59409c6db48 + +From 78850e7dba64a949c440dbdbe557f59409c6db48 Mon Sep 17 00:00:00 2001 +From: Markus Boehme <markubo@amazon.com> +Date: Mon, 3 Apr 2023 23:13:47 +0200 +Subject: [PATCH] ip6tables: Fix checking existence of rule + +Pass the proper entry size when creating a match mask for checking the +existence of a rule. Failing to do so causes wrong results. + +Reported-by: Jonathan Caicedo <jonathan@jcaicedo.com> +Fixes: eb2546a846776 ("xshared: Share make_delete_mask() between ip{,6}tables") +Signed-off-by: Markus Boehme <markubo@amazon.com> +Signed-off-by: Phil Sutter <phil@nwl.cc> +--- + iptables/ip6tables.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c +index 345af451..9afc32c1 100644 +--- a/iptables/ip6tables.c ++++ b/iptables/ip6tables.c +@@ -331,7 +331,7 @@ check_entry(const xt_chainlabel chain, struct ip6t_entry *fw, + int ret = 1; + unsigned char *mask; + +- mask = make_delete_mask(matches, target, sizeof(fw)); ++ mask = make_delete_mask(matches, target, sizeof(*fw)); + for (i = 0; i < nsaddrs; i++) { + fw->ipv6.src = saddrs[i]; + fw->ipv6.smsk = smasks[i]; +-- +2.42.0.283.g2d96d420d3-goog + |