summaryrefslogtreecommitdiffstats
path: root/net/ipv4
diff options
context:
space:
mode:
authorLiping Zhang <zlpnobody@gmail.com>2016-11-23 22:12:21 +0800
committerPablo Neira Ayuso <pablo@netfilter.org>2016-12-06 21:42:21 +0100
commite0ffdbc78d84e1da090f03ab62da3def0e65159e (patch)
treec93f76d2219fe8b7da2c3e18a958b2c6b6ba3074 /net/ipv4
parent11583438b73fbc9117ff8afcbde8c934d0d63713 (diff)
downloadop-kernel-dev-e0ffdbc78d84e1da090f03ab62da3def0e65159e.zip
op-kernel-dev-e0ffdbc78d84e1da090f03ab62da3def0e65159e.tar.gz
netfilter: nft_fib_ipv4: initialize *dest to zero
Otherwise, if fib lookup fail, *dest will be filled with garbage value, so reverse path filtering will not work properly: # nft add rule x prerouting fib saddr oif eq 0 drop Fixes: f6d0cbcf09c5 ("netfilter: nf_tables: add fib expression") Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Acked-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/ipv4')
-rw-r--r--net/ipv4/netfilter/nft_fib_ipv4.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/net/ipv4/netfilter/nft_fib_ipv4.c b/net/ipv4/netfilter/nft_fib_ipv4.c
index bfffa74..2581363 100644
--- a/net/ipv4/netfilter/nft_fib_ipv4.c
+++ b/net/ipv4/netfilter/nft_fib_ipv4.c
@@ -122,6 +122,8 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs,
fl4.saddr = get_saddr(iph->daddr);
}
+ *dest = 0;
+
if (fib_lookup(nft_net(pkt), &fl4, &res, FIB_LOOKUP_IGNORE_LINKSTATE))
return;
OpenPOWER on IntegriCloud