diff options
| author | Florian Westphal <fw@strlen.de> | 2011-12-16 18:35:15 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2011-12-23 14:50:19 +0100 |
| commit | 0354b48f633ae435acbc01b470a1ce8cfeff3e9f (patch) | |
| tree | 48a2b84c4298194cd51a55b89b7c9cb2714c0840 /net | |
| parent | 3f1e6d3fd37bd4f25e5b19f1c7ca21850426c33f (diff) | |
| download | linux-3.10-0354b48f633ae435acbc01b470a1ce8cfeff3e9f.tar.gz linux-3.10-0354b48f633ae435acbc01b470a1ce8cfeff3e9f.tar.bz2 linux-3.10-0354b48f633ae435acbc01b470a1ce8cfeff3e9f.zip | |
netfilter: xt_connbytes: handle negation correctly
"! --connbytes 23:42" should match if the packet/byte count is not in range.
As there is no explict "invert match" toggle in the match structure,
userspace swaps the from and to arguments
(i.e., as if "--connbytes 42:23" were given).
However, "what <= 23 && what >= 42" will always be false.
Change things so we use "||" in case "from" is larger than "to".
This change may look like it breaks backwards compatibility when "to" is 0.
However, older iptables binaries will refuse "connbytes 42:0",
and current releases treat it to mean "! --connbytes 0:42",
so we should be fine.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/xt_connbytes.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/net/netfilter/xt_connbytes.c b/net/netfilter/xt_connbytes.c index 5b138506690..9ddf1c3bfb3 100644 --- a/net/netfilter/xt_connbytes.c +++ b/net/netfilter/xt_connbytes.c @@ -87,10 +87,10 @@ connbytes_mt(const struct sk_buff *skb, struct xt_action_param *par) break; } - if (sinfo->count.to) + if (sinfo->count.to >= sinfo->count.from) return what <= sinfo->count.to && what >= sinfo->count.from; - else - return what >= sinfo->count.from; + else /* inverted */ + return what < sinfo->count.to || what > sinfo->count.from; } static int connbytes_mt_check(const struct xt_mtchk_param *par) |