netfilter: ipt_CLUSTERIP: check MAC address when duplicate config is set

[tomoyo/tomoyo-test1.git] / net / ipv4 / netfilter / ipt_CLUSTERIP.c

diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index d4d549a..b61977d 100644 (file)
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -509,7 +509,8 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par)
                        if (IS_ERR(config))
                                return PTR_ERR(config);
                }
-       }
+       } else if (memcmp(&config->clustermac, &cipinfo->clustermac, ETH_ALEN))
+               return -EINVAL;
 
        ret = nf_ct_netns_get(par->net, par->family);
        if (ret < 0) {