tree e6d487c5d0dd82da34b53cc64bfd7c2d5e9f98f1
parent af9d32ad6718b9a80fa89f557cc1fbb63a93ec15
author Patrick McHardy <kaber@trash.net> 1238005595 +0100
committer Patrick McHardy <kaber@trash.net> 1238005595 +0100

netfilter: {ip,ip6,arp}_tables: fix incorrect loop detection

Commit e1b4b9f ([NETFILTER]: {ip,ip6,arp}_tables: fix exponential worst-case
search for loops) introduced a regression in the loop detection algorithm,
causing sporadic incorrectly detected loops.

When a chain has already been visited during the check, it is treated as
having a standard target containing a RETURN verdict directly at the
beginning in order to not check it again. The real target of the first
rule is then incorrectly treated as STANDARD target and checked not to
contain invalid verdicts.

Fix by making sure the rule does actually contain a standard target.

Based on patch by Francis Dupont <Francis_Dupont@isc.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>