diff options
| author | Jeremy Sowden <jeremy@azazel.net> | 2022-12-23 16:24:40 +0000 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2023-01-02 17:19:02 +0100 |
| commit | 43d7b069f43e047b05f0e0ad5d5528afedc4ac1d (patch) | |
| tree | e5114af0f5131dcb75f6aa35511ac12b710bd87b /src/conntrack/filter.c | |
| parent | 37ebad02ea478ae6e1cccc757a2390f0849918e6 (diff) | |
conntrack: fix BPF code for filtering on big-endian architectures
The BPF for checking the subsystem ID looks for it in the righthand byte of
`nlh->nlmsg_type`. However, it will only be there on little-endian archi-
tectures. The result is that on big-endian architectures the subsystem ID
doesn't match, all packets are immediately accepted, and all filters are
ignored.
Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=896716
Fixes: b245e4092c5a ("src: allow to use nfct handler for conntrack and expectations at the same time")
Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/conntrack/filter.c')
0 files changed, 0 insertions, 0 deletions