summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPatrick McHardy <kaber@trash.net>2006-03-22 13:56:33 -0800
committerDavid S. Miller <davem@davemloft.net>2006-03-22 13:56:33 -0800
commit81fbfd6925c064b764cb0536aed9232c7b48f6df (patch)
tree213acf4e98cde24c1899ea9b384970f3e999a9c9
parentb9f78f9fca626875af8adc0f7366a38b8e625a0e (diff)
downloadlinux-3.10-81fbfd6925c064b764cb0536aed9232c7b48f6df.tar.gz
linux-3.10-81fbfd6925c064b764cb0536aed9232c7b48f6df.tar.bz2
linux-3.10-81fbfd6925c064b764cb0536aed9232c7b48f6df.zip
[NETFILTER]: Fix xt_policy address matching
Fix missing inversion in address matching, it was broken during the conversion to x_tables. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/netfilter/xt_policy.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/net/netfilter/xt_policy.c b/net/netfilter/xt_policy.c
index d57a611ae0d..1099cb005fc 100644
--- a/net/netfilter/xt_policy.c
+++ b/net/netfilter/xt_policy.c
@@ -27,9 +27,9 @@ xt_addr_cmp(const union xt_policy_addr *a1, const union xt_policy_addr *m,
{
switch (family) {
case AF_INET:
- return (a1->a4.s_addr ^ a2->a4.s_addr) & m->a4.s_addr;
+ return !((a1->a4.s_addr ^ a2->a4.s_addr) & m->a4.s_addr);
case AF_INET6:
- return ipv6_masked_addr_cmp(&a1->a6, &m->a6, &a2->a6);
+ return !ipv6_masked_addr_cmp(&a1->a6, &m->a6, &a2->a6);
}
return 0;
}
@@ -44,7 +44,7 @@ match_xfrm_state(struct xfrm_state *x, const struct xt_policy_elem *e,
#define MATCH(x,y) (!e->match.x || ((e->x == (y)) ^ e->invert.x))
return MATCH_ADDR(saddr, smask, (union xt_policy_addr *)&x->props.saddr) &&
- MATCH_ADDR(daddr, dmask, (union xt_policy_addr *)&x->id.daddr.a4) &&
+ MATCH_ADDR(daddr, dmask, (union xt_policy_addr *)&x->id.daddr) &&
MATCH(proto, x->id.proto) &&
MATCH(mode, x->props.mode) &&
MATCH(spi, x->id.spi) &&