mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-30 22:26:55 +00:00
Code Issues Releases Wiki Activity

netfilter: connlimit: make same_source_net signed

Browse source 
currently returns 1 if they're the same.  Make it work like mem/strcmp
so it can be used as rbtree search function.

Reviewed-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Florian Westphal 2014-03-12 23:49:50 +01:00 committed by Pablo Neira Ayuso
parent 1442e7507d
commit 50e0e9b129
1 changed files with 5 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
net/netfilter/xt_connlimit.c
View file

@ -78,13 +78,14 @@ static inline bool already_closed(const struct nf_conn *conn)
return 0; return 0;
} }
static inline unsigned int static int
same_source_net(const union nf_inet_addr *addr, same_source_net(const union nf_inet_addr *addr,
const union nf_inet_addr *mask, const union nf_inet_addr *mask,
const union nf_inet_addr *u3, u_int8_t family) const union nf_inet_addr *u3, u_int8_t family)
{ {
if (family == NFPROTO_IPV4) { if (family == NFPROTO_IPV4) {
return (addr->ip & mask->ip) == (u3->ip & mask->ip); return ntohl(addr->ip & mask->ip) -
ntohl(u3->ip & mask->ip);
} else { } else {
union nf_inet_addr lh, rh; union nf_inet_addr lh, rh;
unsigned int i; unsigned int i;
@ -94,7 +95,7 @@ same_source_net(const union nf_inet_addr *addr,
rh.ip6[i] = u3->ip6[i] & mask->ip6[i]; rh.ip6[i] = u3->ip6[i] & mask->ip6[i];
} }
return memcmp(&lh.ip6, &rh.ip6, sizeof(lh.ip6)) == 0; return memcmp(&lh.ip6, &rh.ip6, sizeof(lh.ip6));
} }
} }
@ -143,7 +144,7 @@ static int count_hlist(struct net *net,
continue; continue;
} }
if (same_source_net(addr, mask, &conn->addr, family)) if (same_source_net(addr, mask, &conn->addr, family) == 0)
/* same source network -> be counted! */ /* same source network -> be counted! */
++matches; ++matches;
nf_ct_put(found_ct); nf_ct_put(found_ct);