Jan Engelhardt wrote:
> diff --git a/net/ipv4/netfilter/iptable_filter.c b/net/ipv4/netfilter/iptable_filter.c
> index b320208..7f64ea5 100644
> --- a/net/ipv4/netfilter/iptable_filter.c
> +++ b/net/ipv4/netfilter/iptable_filter.c
> @@ -67,19 +67,15 @@ iptable_filter_hook(unsigned int hook,
> const struct net_device *out,
> int (*okfn)(struct sk_buff *))
> {
> - if (hook == NF_INET_LOCAL_OUT) {
> - if (skb->len < sizeof(struct iphdr) ||
> - ip_hdrlen(skb) < sizeof(struct iphdr))
> - /* root is playing with raw sockets. */
> - return NF_ACCEPT;
> -
> - return ipt_do_table(skb, hook, in, out,
> - dev_net(out)->ipv4.iptable_filter);
> - }
> + const struct net *net;
> +
> + if (hook == NF_INET_LOCAL_OUT && (skb->len < sizeof(struct iphdr) ||
> + ip_hdrlen(skb) < sizeof(struct iphdr)))
This also looks strange. The length tests belong together, so this would
make it much more readable:
if (hook == NF_INET_LOCAL_OUT &&
(skb->len < sizeof(struct iphdr) ||
ip_hdrlen(skb) < sizeof(struct iphdr)))
...
Please also fix up similar cases in case there are any.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
