From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Florian Westphal <fw@strlen.de>
Cc: netfilter-devel <netfilter-devel@vger.kernel.org>
Subject: Re: [PATCH] netfilter: xt_connbytes: handle negation correctly
Date: Fri, 23 Dec 2011 14:51:09 +0100 [thread overview]
Message-ID: <20111223135109.GA10482@1984> (raw)
In-Reply-To: <1324056915-637-1-git-send-email-fw@strlen.de>
On Fri, Dec 16, 2011 at 06:35:15PM +0100, Florian Westphal wrote:
> "! --connbytes 23:42" should match if the packet/byte count is not in range.
>
> As there is no explict "invert match" toggle in the match structure,
> userspace swaps the from and to arguments
> (i.e., as if "--connbytes 42:23" were given).
>
> However, "what <= 23 && what >= 42" will always be false.
>
> Change things so we use "||" in case "from" is larger than "to".
>
> This change may look like it breaks backwards compatibility when "to" is 0.
> However, older iptables binaries will refuse "connbytes 42:0",
> and current releases treat it to mean "! --connbytes 0:42",
> so we should be fine.
Applied, thanks Florian. I'll pass this for 3.2-rc inclusion.
next prev parent reply other threads:[~2011-12-23 13:51 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-12-16 17:35 [PATCH] netfilter: xt_connbytes: handle negation correctly Florian Westphal
2011-12-23 13:51 ` Pablo Neira Ayuso [this message]
-- strict thread matches above, loose matches on Subject: below --
2011-12-23 14:04 Netfilter updates for 3.2-rc pablo
2011-12-23 14:04 ` [PATCH] netfilter: xt_connbytes: handle negation correctly pablo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20111223135109.GA10482@1984 \
--to=pablo@netfilter.org \
--cc=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.