diff options
| author | Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> | 2011-07-21 12:06:18 +0200 |
|---|---|---|
| committer | Patrick McHardy <kaber@trash.net> | 2011-07-21 12:06:18 +0200 |
| commit | 89dc79b787d20e4b6c4077dcee1c5b1be4ab55b8 (patch) | |
| tree | 24ebd4da0fe7e239e45cbc5a4ec599ee1abba94d /net/netfilter/ipset/ip_set_hash_net.c | |
| parent | a6a7b759ba62e62542308e091f7fc9cfac4f978e (diff) | |
netfilter: ipset: hash:net,iface fixed to handle overlapping nets behind different interfaces
If overlapping networks with different interfaces was added to
the set, the type did not handle it properly. Example
ipset create test hash:net,iface
ipset add test 192.168.0.0/16,eth0
ipset add test 192.168.0.0/24,eth1
Now, if a packet was sent from 192.168.0.0/24,eth0, the type returned
a match.
In the patch the algorithm is fixed in order to correctly handle
overlapping networks.
Limitation: the same network cannot be stored with more than 64 different
interfaces in a single set.
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Diffstat (limited to 'net/netfilter/ipset/ip_set_hash_net.c')
| -rw-r--r-- | net/netfilter/ipset/ip_set_hash_net.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/netfilter/ipset/ip_set_hash_net.c b/net/netfilter/ipset/ip_set_hash_net.c index 2d4b1f48e8c9..60d016541c58 100644 --- a/net/netfilter/ipset/ip_set_hash_net.c +++ b/net/netfilter/ipset/ip_set_hash_net.c @@ -58,7 +58,8 @@ struct hash_net4_telem { static inline bool hash_net4_data_equal(const struct hash_net4_elem *ip1, - const struct hash_net4_elem *ip2) + const struct hash_net4_elem *ip2, + u32 *multi) { return ip1->ip == ip2->ip && ip1->cidr == ip2->cidr; } @@ -249,7 +250,8 @@ struct hash_net6_telem { static inline bool hash_net6_data_equal(const struct hash_net6_elem *ip1, - const struct hash_net6_elem *ip2) + const struct hash_net6_elem *ip2, + u32 *multi) { return ipv6_addr_cmp(&ip1->ip.in6, &ip2->ip.in6) == 0 && ip1->cidr == ip2->cidr; |