summaryrefslogtreecommitdiffstats
path: root/extensions/libip6t_policy.c
diff options
context:
space:
mode:
authorPatrick McHardy <kaber@trash.net>2006-01-12 09:43:18 +0000
committerPatrick McHardy <kaber@trash.net>2006-01-12 09:43:18 +0000
commita46d88df3c786a33e83164a3aa88c215eaf7402c (patch)
tree0bd2c1c0b22c262f8d4d78be0309fe8c770e3158 /extensions/libip6t_policy.c
parent1d0f57c14ad5923d8ffcecc7f372fcc15b3945fa (diff)
Move empty policy element check to also catch last element
Diffstat (limited to 'extensions/libip6t_policy.c')
-rw-r--r--extensions/libip6t_policy.c11
1 files changed, 6 insertions, 5 deletions
diff --git a/extensions/libip6t_policy.c b/extensions/libip6t_policy.c
index 189ca6e1..7498e989 100644
--- a/extensions/libip6t_policy.c
+++ b/extensions/libip6t_policy.c
@@ -283,11 +283,6 @@ static int parse(int c, char **argv, int invert, unsigned int *flags,
exit_error(PARAMETER_PROBLEM,
"policy match: can't invert --next option");
- if (!(e->match.reqid || e->match.spi || e->match.saddr ||
- e->match.daddr || e->match.proto || e->match.mode))
- exit_error(PARAMETER_PROBLEM,
- "policy match: --next without policy element specification");
-
if (++info->len == IP6T_POLICY_MAX_ELEM)
exit_error(PARAMETER_PROBLEM,
"policy match: maximum policy depth reached");
@@ -331,6 +326,12 @@ static void final_check(unsigned int flags)
for (i = 0; i < info->len; i++) {
e = &info->pol[i];
+
+ if (!(e->match.reqid || e->match.spi || e->match.saddr ||
+ e->match.daddr || e->match.proto || e->match.mode))
+ exit_error(PARAMETER_PROBLEM,
+ "policy match: empty policy element");
+
if ((e->match.saddr || e->match.daddr)
&& ((e->mode == IP6T_POLICY_MODE_TUNNEL && e->invert.mode) ||
(e->mode == IP6T_POLICY_MODE_TRANSPORT && !e->invert.mode)))