[NETFILTER]: Check policy length in policy match strict mode

[linux-2.6-omap-h63xx.git] / net / ipv6 / netfilter / ip6t_esp.c

diff --git a/net/ipv6/netfilter/ip6t_esp.c b/net/ipv6/netfilter/ip6t_esp.c
index 24bc0cde43a174d4090d4b6d5897c68246e5c966..724285df87115e5e75e26e99c248ca0cab823dfd 100644 (file)
--- a/net/ipv6/netfilter/ip6t_esp.c
+++ b/net/ipv6/netfilter/ip6t_esp.c
@@ -9,6 +9,7 @@
 
 #include <linux/module.h>
 #include <linux/skbuff.h>
+#include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <linux/types.h>
 #include <net/checksum.h>
@@ -55,7 +56,7 @@ match(const struct sk_buff *skb,
        /* Make sure this isn't an evil packet */
        /*DEBUGP("ipv6_esp entered \n");*/
 
-       if (ipv6_find_hdr(skb, &ptr, NEXTHDR_ESP) < 0)
+       if (ipv6_find_hdr(skb, &ptr, NEXTHDR_ESP, NULL) < 0)
                return 0;
 
        eh = skb_header_pointer(skb, ptr, sizeof(_esp), &_esp);
@@ -75,7 +76,7 @@ match(const struct sk_buff *skb,
 /* Called when user tries to insert an entry of this type. */
 static int
 checkentry(const char *tablename,
-          const struct ip6t_ip6 *ip,
+          const void *ip,
           void *matchinfo,
           unsigned int matchinfosize,
           unsigned int hook_mask)