From 31c9edfedb1632e154e0a07956832b548e8d62bb Mon Sep 17 00:00:00 2001 From: "David S. Miller" Date: Tue, 1 Apr 2003 04:33:36 -0800 Subject: [PATCH] [IPSEC]: In TCP/v6 input, check policy before socket filter. --- net/ipv6/tcp_ipv6.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index 64fc399d0708c..e3a137ba61f70 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -1639,10 +1639,10 @@ process: if(sk->state == TCP_TIME_WAIT) goto do_time_wait; - if (sk_filter(sk, skb, 0)) + if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) goto discard_and_relse; - if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) + if (sk_filter(sk, skb, 0)) goto discard_and_relse; skb->dev = NULL; -- 2.53.0