Pablo Neira Ayuso f0d1f04f0a netfilter: fix wrong arithmetics regarding NFT_REJECT_ICMPX_MAX
NFT_REJECT_ICMPX_MAX should be __NFT_REJECT_ICMPX_MAX - 1.

nft_reject_icmp_code() and nft_reject_icmpv6_code() are called from the
packet path, so BUG_ON in case we try to access an unknown abstracted
ICMP code. This should not happen since we already validate this from
nft_reject_{inet,bridge}_init().

Fixes: 51b0a5d ("netfilter: nft_reject: introduce icmp code abstraction for inet and bridge")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2014-10-07 20:16:31 +02:00
..
2014-09-10 12:40:10 -07:00
2014-08-22 12:23:11 -07:00
2014-10-04 20:44:44 -04:00
2014-09-30 17:08:06 -04:00
2014-09-10 12:40:10 -07:00
2013-09-23 16:52:45 -04:00
2014-09-07 16:07:25 -07:00
2014-08-13 18:13:19 -06:00
2014-09-10 14:00:58 -07:00
2013-11-21 13:09:42 -05:00