netfilter: ip6t_NPT: Fix translation for non-multiple of 32 prefix lengths
authorMatthias Schiffer <mschiffer@universe-factory.net>
Sat, 30 Mar 2013 10:23:12 +0000 (10:23 +0000)
committerPablo Neira Ayuso <pablo@netfilter.org>
Wed, 3 Apr 2013 10:24:56 +0000 (12:24 +0200)
The bitmask used for the prefix mangling was being calculated
incorrectly, leading to the wrong part of the address being replaced
when the prefix length wasn't a multiple of 32.

Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/ipv6/netfilter/ip6t_NPT.c

index 33608c610276d87e9845b75555fadc6771765606..cb631143721c0afb13152121c74a9d49f51e99dc 100644 (file)
@@ -57,7 +57,7 @@ static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt,
                if (pfx_len - i >= 32)
                        mask = 0;
                else
-                       mask = htonl(~((1 << (pfx_len - i)) - 1));
+                       mask = htonl((1 << (i - pfx_len + 32)) - 1);
 
                idx = i / 32;
                addr->s6_addr32[idx] &= mask;