Patchwork [4/5] netfilter: ip6t_NPT: Fix prefix mangling

login
register
mail settings
Submitter Pablo Neira
Date Feb. 9, 2013, 12:03 p.m.
Message ID <1360411440-6526-5-git-send-email-pablo@netfilter.org>
Download mbox | patch
Permalink /patch/219389/
State Accepted
Headers show

Comments

Pablo Neira - Feb. 9, 2013, 12:03 p.m.
From: YOSHIFUJI Hideaki / 吉藤英明 <yoshfuji@linux-ipv6.org>

Make sure only the bits that are part of the prefix are mangled.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/ipv6/netfilter/ip6t_NPT.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Patch

diff --git a/net/ipv6/netfilter/ip6t_NPT.c b/net/ipv6/netfilter/ip6t_NPT.c
index 68788c8..87b759c 100644
--- a/net/ipv6/netfilter/ip6t_NPT.c
+++ b/net/ipv6/netfilter/ip6t_NPT.c
@@ -51,7 +51,7 @@  static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt,
 
 		idx = i / 32;
 		addr->s6_addr32[idx] &= mask;
-		addr->s6_addr32[idx] |= npt->dst_pfx.in6.s6_addr32[idx];
+		addr->s6_addr32[idx] |= ~mask & npt->dst_pfx.in6.s6_addr32[idx];
 	}
 
 	if (pfx_len <= 48)