diff options
| author | Liping Zhang <zlpnobody@gmail.com> | 2016-11-23 22:12:21 +0800 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-12-06 21:42:21 +0100 |
| commit | e0ffdbc78d84e1da090f03ab62da3def0e65159e (patch) | |
| tree | c93f76d2219fe8b7da2c3e18a958b2c6b6ba3074 /net/ipv4 | |
| parent | 11583438b73fbc9117ff8afcbde8c934d0d63713 (diff) | |
| download | op-kernel-dev-e0ffdbc78d84e1da090f03ab62da3def0e65159e.zip op-kernel-dev-e0ffdbc78d84e1da090f03ab62da3def0e65159e.tar.gz | |
netfilter: nft_fib_ipv4: initialize *dest to zero
Otherwise, if fib lookup fail, *dest will be filled with garbage value,
so reverse path filtering will not work properly:
# nft add rule x prerouting fib saddr oif eq 0 drop
Fixes: f6d0cbcf09c5 ("netfilter: nf_tables: add fib expression")
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/ipv4')
| -rw-r--r-- | net/ipv4/netfilter/nft_fib_ipv4.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/ipv4/netfilter/nft_fib_ipv4.c b/net/ipv4/netfilter/nft_fib_ipv4.c index bfffa74..2581363 100644 --- a/net/ipv4/netfilter/nft_fib_ipv4.c +++ b/net/ipv4/netfilter/nft_fib_ipv4.c @@ -122,6 +122,8 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs, fl4.saddr = get_saddr(iph->daddr); } + *dest = 0; + if (fib_lookup(nft_net(pkt), &fl4, &res, FIB_LOOKUP_IGNORE_LINKSTATE)) return; |
