Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[NETFILTER]: Fix xt_policy address matching

Browse source 
Fix missing inversion in address matching, it was broken during the
conversion to x_tables.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Patrick McHardy 2006-03-22 13:56:33 -08:00 committed by David S. Miller
parent b9f78f9fca
commit 81fbfd6925
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
net/netfilter/xt_policy.c
View file

@ -27,9 +27,9 @@ xt_addr_cmp(const union xt_policy_addr *a1, const union xt_policy_addr *m,
{ {
switch (family) { switch (family) {
case AF_INET: case AF_INET:
return (a1->a4.s_addr ^ a2->a4.s_addr) & m->a4.s_addr; return !((a1->a4.s_addr ^ a2->a4.s_addr) & m->a4.s_addr);
case AF_INET6: case AF_INET6:
return ipv6_masked_addr_cmp(&a1->a6, &m->a6, &a2->a6); return !ipv6_masked_addr_cmp(&a1->a6, &m->a6, &a2->a6);
} }
return 0; return 0;
} }
@ -44,7 +44,7 @@ match_xfrm_state(struct xfrm_state *x, const struct xt_policy_elem *e,
#define MATCH(x,y) (!e->match.x || ((e->x == (y)) ^ e->invert.x)) #define MATCH(x,y) (!e->match.x || ((e->x == (y)) ^ e->invert.x))
return MATCH_ADDR(saddr, smask, (union xt_policy_addr *)&x->props.saddr) && return MATCH_ADDR(saddr, smask, (union xt_policy_addr *)&x->props.saddr) &&
MATCH_ADDR(daddr, dmask, (union xt_policy_addr *)&x->id.daddr.a4) && MATCH_ADDR(daddr, dmask, (union xt_policy_addr *)&x->id.daddr) &&
MATCH(proto, x->id.proto) && MATCH(proto, x->id.proto) &&
MATCH(mode, x->props.mode) && MATCH(mode, x->props.mode) &&
MATCH(spi, x->id.spi) && MATCH(spi, x->id.spi) &&