Patchwork [PATCHv2] netfilter: ip6t_NPT: Fix translation for non-multiple of 32 prefix lengths

login
register
mail settings
Submitter Matthias Schiffer
Date March 30, 2013, 8:23 p.m.
Message ID <cf3234de124418a6954f079e473c3e01ea96952f.1364674922.git.mschiffer@universe-factory.net>
Download mbox | patch
Permalink /patch/232553/
State Accepted
Headers show

Comments

Matthias Schiffer - March 30, 2013, 8:23 p.m.
The bitmask used for the prefix mangling was being calculated incorrectly,
leading to the wrong part of the address being replaced when the prefix length
wasn't a multiple of 32.

Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
---
Hi, this patch should to 3.9 and, if possible, 3.8-stable.

v2: Remove a redundant pair of parentheses.

Regards,
Matthias Schiffer

 net/ipv6/netfilter/ip6t_NPT.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Matthias Schiffer - April 3, 2013, 9:42 a.m.
On 03/30/2013 09:23 PM, Matthias Schiffer wrote:
> The bitmask used for the prefix mangling was being calculated incorrectly,
> leading to the wrong part of the address being replaced when the prefix length
> wasn't a multiple of 32.
> 
> Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
> ---
> Hi, this patch should to 3.9 and, if possible, 3.8-stable.
> 
> v2: Remove a redundant pair of parentheses.
> 
> Regards,
> Matthias Schiffer
> 

*ping* Anybody read the patch? Any comments?
Pablo Neira - April 3, 2013, 10:21 a.m.
On Sat, Mar 30, 2013 at 09:23:12PM +0100, Matthias Schiffer wrote:
> The bitmask used for the prefix mangling was being calculated incorrectly,
> leading to the wrong part of the address being replaced when the prefix length
> wasn't a multiple of 32.

Applied, thanks Matthias.

> Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
> ---
> Hi, this patch should to 3.9 and, if possible, 3.8-stable.

Will do.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/net/ipv6/netfilter/ip6t_NPT.c b/net/ipv6/netfilter/ip6t_NPT.c
index 33608c6..cb63114 100644
--- a/net/ipv6/netfilter/ip6t_NPT.c
+++ b/net/ipv6/netfilter/ip6t_NPT.c
@@ -57,7 +57,7 @@  static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt,
 		if (pfx_len - i >= 32)
 			mask = 0;
 		else
-			mask = htonl(~((1 << (pfx_len - i)) - 1));
+			mask = htonl((1 << (i - pfx_len + 32)) - 1);
 
 		idx = i / 32;
 		addr->s6_addr32[idx] &= mask;