diff options
| author |   Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> | 2011-07-21 12:06:18 +0200 |
|---|---|---|
| committer |   Patrick McHardy <kaber@trash.net> | 2011-07-21 12:06:18 +0200 |
| commit | 89dc79b787d20e4b6c4077dcee1c5b1be4ab55b8 (patch) | |
| tree | 24ebd4da0fe7e239e45cbc5a4ec599ee1abba94d /net/netfilter/ipset/ip_set_hash_ipportip.c | |
| parent | netfilter: ipset: make possible to hash some part of the data element only (diff) | |
| download | linux-dev-89dc79b787d20e4b6c4077dcee1c5b1be4ab55b8.tar.xz linux-dev-89dc79b787d20e4b6c4077dcee1c5b1be4ab55b8.zip | |
netfilter: ipset: hash:net,iface fixed to handle overlapping nets behind different interfaces
If overlapping networks with different interfaces was added to
the set, the type did not handle it properly. Example
ipset create test hash:net,iface
ipset add test 192.168.0.0/16,eth0
ipset add test 192.168.0.0/24,eth1
Now, if a packet was sent from 192.168.0.0/24,eth0, the type returned
a match.
In the patch the algorithm is fixed in order to correctly handle
overlapping networks.
Limitation: the same network cannot be stored with more than 64 different
interfaces in a single set.
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Diffstat (limited to 'net/netfilter/ipset/ip_set_hash_ipportip.c')
| -rw-r--r-- | net/netfilter/ipset/ip_set_hash_ipportip.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/netfilter/ipset/ip_set_hash_ipportip.c b/net/netfilter/ipset/ip_set_hash_ipportip.c index 96525f529a54..fb90e344e907 100644 --- a/net/netfilter/ipset/ip_set_hash_ipportip.c +++ b/net/netfilter/ipset/ip_set_hash_ipportip.c @@ -62,7 +62,8 @@ struct hash_ipportip4_telem { static inline bool hash_ipportip4_data_equal(const struct hash_ipportip4_elem *ip1, - const struct hash_ipportip4_elem *ip2) + const struct hash_ipportip4_elem *ip2, + u32 *multi) { return ip1->ip == ip2->ip && ip1->ip2 == ip2->ip2 && @@ -286,7 +287,8 @@ struct hash_ipportip6_telem { static inline bool hash_ipportip6_data_equal(const struct hash_ipportip6_elem *ip1, - const struct hash_ipportip6_elem *ip2) + const struct hash_ipportip6_elem *ip2, + u32 *multi) { return ipv6_addr_cmp(&ip1->ip.in6, &ip2->ip.in6) == 0 && ipv6_addr_cmp(&ip1->ip2.in6, &ip2->ip2.in6) == 0 && |