[IPSEC]: In TCP/v6 input, check policy before socket filter.

31c9edfe · David S. Miller · 6bb23a88 · 31c9edfe
Commit 31c9edfe authored Apr 01, 2003 by David S. Miller
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 2 deletions

net/ipv6/tcp_ipv6.c net/ipv6/tcp_ipv6.c +2 -2

No files found.
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1639,10 +1639,10 @@ static int tcp_v6_rcv(struct sk_buff **pskb)
 	if(sk->state == TCP_TIME_WAIT)
 		goto do_time_wait;

-	if (sk_filter(sk, skb, 0))
+	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
 		goto discard_and_relse;

-	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
+	if (sk_filter(sk, skb, 0))
 		goto discard_and_relse;

 	skb->dev = NULL;