Skip to content

Commit

Permalink
tproxy: Add missing CAP_NET_ADMIN check to ipv6 side
Browse files Browse the repository at this point in the history
IP_TRANSPARENT requires root (more precisely CAP_NET_ADMIN privielges)
for IPV6.

However as I see right now this check was missed from the IPv6
implementation.

Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Balazs Scheidler authored and David S. Miller committed Oct 24, 2010
1 parent 0561cf3 commit b889416
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions net/ipv6/ipv6_sockglue.c
Original file line number Diff line number Diff line change
Expand Up @@ -343,6 +343,10 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
break;

case IPV6_TRANSPARENT:
if (!capable(CAP_NET_ADMIN)) {
retv = -EPERM;
break;
}
if (optlen < sizeof(int))
goto e_inval;
/* we don't have a separate transparent bit for IPV6 we use the one in the IPv4 socket */
Expand Down

0 comments on commit b889416

Please sign in to comment.