netfilter: xt_mangle: only check verdict part of return value

These checks assume that the caller only returns NF_DROP without
any errno embedded in the upper bits.

This is fine right now, but followup patches will start to propagate
such errors to allow kfree_skb_drop_reason() in the called functions,
those would then indicate 'errno << 8 | NF_STOLEN'.

To not break things we have to mask those parts out.

Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/net/ipv4/netfilter/iptable_mangle.c b/net/ipv4/netfilter/iptable_mangle.c
index 3abb430af9e6f12be81eeed7d02cdb15b9077279..385d945d8ebea04bbe92676a3ee57dccf06434ce 100644 (file)
--- a/net/ipv4/netfilter/iptable_mangle.c
+++ b/net/ipv4/netfilter/iptable_mangle.c
@@ -36,12 +36,12 @@ static const struct xt_table packet_mangler = {
 static unsigned int
 ipt_mangle_out(void *priv, struct sk_buff *skb, const struct nf_hook_state *state)
 {
-       unsigned int ret;
+       unsigned int ret, verdict;
        const struct iphdr *iph;
-       u_int8_t tos;
        __be32 saddr, daddr;
-       u_int32_t mark;
+       u32 mark;
        int err;
+       u8 tos;
 
        /* Save things which could affect route */
        mark = skb->mark;
@@ -51,8 +51,9 @@ ipt_mangle_out(void *priv, struct sk_buff *skb, const struct nf_hook_state *stat
        tos = iph->tos;
 
        ret = ipt_do_table(priv, skb, state);
+       verdict = ret & NF_VERDICT_MASK;
        /* Reroute for ANY change. */
-       if (ret != NF_DROP && ret != NF_STOLEN) {
+       if (verdict != NF_DROP && verdict != NF_STOLEN) {
                iph = ip_hdr(skb);
 
                if (iph->saddr != saddr ||

diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index a88b2ce4a3cb8d1e4cf0776122611c98f0879bf5..8dd4cd0c47bd4db87b14754a4c5d2bcbd115619a 100644 (file)
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -31,10 +31,10 @@ static const struct xt_table packet_mangler = {
 static unsigned int
 ip6t_mangle_out(void *priv, struct sk_buff *skb, const struct nf_hook_state *state)
 {
-       unsigned int ret;
        struct in6_addr saddr, daddr;
-       u_int8_t hop_limit;
-       u_int32_t flowlabel, mark;
+       unsigned int ret, verdict;
+       u32 flowlabel, mark;
+       u8 hop_limit;
        int err;
 
        /* save source/dest address, mark, hoplimit, flowlabel, priority,  */
@@ -47,8 +47,9 @@ ip6t_mangle_out(void *priv, struct sk_buff *skb, const struct nf_hook_state *sta
        flowlabel = *((u_int32_t *)ipv6_hdr(skb));
 
        ret = ip6t_do_table(priv, skb, state);
+       verdict = ret & NF_VERDICT_MASK;
 
-       if (ret != NF_DROP && ret != NF_STOLEN &&
+       if (verdict != NF_DROP && verdict != NF_STOLEN &&
            (!ipv6_addr_equal(&ipv6_hdr(skb)->saddr, &saddr) ||
             !ipv6_addr_equal(&ipv6_hdr(skb)->daddr, &daddr) ||
             skb->mark != mark ||