[NETFILTER]: Fix multiple bugs in ipv6header match

This patch fixes following bugs in ip6t_ipv6header.c

- The cast of the pointer to the next IPv6 extension header is wrong.
- The logical operation is wrong. These fixes intends

	- soft mode without invert flag "!"
		match if the packet contains all of the specified headers.

	- soft mode with invert flag "!"
		match if the packet DOESN'T contain all of the specified
		headers.

	- strict mode without invert flag "!"
		match if the packet contains JUST ONLY the specified headers.
		if the packet doesn't contain some specified headers or
		contains unspecified headers, the packet doesn't match with
		rule.

	- strict mode with invert flag "!"
		NOT MATCH if the packet contains JUST ONLY the specified
		headers. Otherwise, match. So, if the packet contains some
		specified headers and DOESN'T contain other specified headers,
		the packet MATCHES with rule.
Signed-off-by: Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Patrick McHardy <kaber@trash.net>

net/ipv6/netfilter/ip6t_ipv6header.c

@@ -68,7 +68,7 @@ ipv6header_match(const struct sk_buff *skb,
 			break;
 		}
 
-		hdr=(struct ipv6_opt_hdr *)skb->data+ptr;
+		hdr=(struct ipv6_opt_hdr *)(skb->data+ptr);
 
 		/* Calculate the header length */
                 if (nexthdr == NEXTHDR_FRAGMENT) {
@@ -111,10 +111,14 @@ ipv6header_match(const struct sk_buff *skb,
 		temp |= MASK_PROTO;
 
 	if (info->modeflag)
-		return (!( (temp & info->matchflags)
-			^ info->matchflags) ^ info->invflags);
-	else
-		return (!( temp ^ info->matchflags) ^ info->invflags);
+		return !((temp ^ info->matchflags ^ info->invflags)
+			 & info->matchflags);
+	else {
+		if (info->invflags)
+			return temp != info->matchflags;
+		else
+			return temp == info->matchflags;
+	}
 }
 
 static int
@@ -124,11 +128,18 @@ ipv6header_checkentry(const char *tablename,
 		      unsigned int matchsize,
 		      unsigned int hook_mask)
 {
+	const struct ip6t_ipv6header_info *info = matchinfo;
+
 	/* Check for obvious errors */
 	/* This match is valid in all hooks! */
 	if (matchsize != IP6T_ALIGN(sizeof(struct ip6t_ipv6header_info)))
 		return 0;
 
+	/* invflags is 0 or 0xff in hard mode */
+	if ((!info->modeflag) && info->invflags != 0x00
+			      && info->invflags != 0xFF)
+		return 0;
+
 	return 1;
 }