From: Ken-ichirou MATSUZAWA <chamaken@gmail.com>
To: Florian Westphal <fw@strlen.de>
Cc: The netfilter developer mailinglist <netfilter-devel@vger.kernel.org>
Subject: [PATCH v3 2/2 libnetfilter_conntrack] conntrack: zero value handling of mark and zone
Date: Mon, 23 Jun 2014 19:18:10 +0900 [thread overview]
Message-ID: <20140623101810.GC29052@gmail.com> (raw)
In-Reply-To: <20140623101235.GA29052@gmail.com>
This patch enables comparison of 0 value with mark and zone since both CTA_MARK
and CTA_ZONE are not set in case of its value is 0. This patch has just passed
qa test which Florian wrote, I guess there is more sophiscated way that settle
cmp_mark() and cmp_zone().
Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
---
qa/test_api.c | 20 ++++++++++----------
src/conntrack/compare.c | 44 ++++++++++++++++++++++++++++++++++++++++----
2 files changed, 50 insertions(+), 14 deletions(-)
diff --git a/qa/test_api.c b/qa/test_api.c
index 1335b23..c8faeda 100644
--- a/qa/test_api.c
+++ b/qa/test_api.c
@@ -287,15 +287,15 @@ static void test_nfct_cmp_attr(int attr)
flags = NFCT_CMP_STRICT;
assert(test_cmp_attr16(ATTR_ZONE, false, false, 0, 0, flags) == 1);
- assert(test_cmp_attr16(ATTR_ZONE, true, false, 0, 0, flags) == 0);
- assert(test_cmp_attr16(ATTR_ZONE, false, true, 0, 0, flags) == 0);
+ assert(test_cmp_attr16(ATTR_ZONE, true, false, 0, 0, flags) == 1);
+ assert(test_cmp_attr16(ATTR_ZONE, false, true, 0, 0, flags) == 1);
assert(test_cmp_attr16(ATTR_ZONE, true, true, 0, 0, flags) == 1);
assert(test_cmp_attr16(ATTR_ZONE, false, false, 1, 0, flags) == 1); /* verbose */
assert(test_cmp_attr16(ATTR_ZONE, true, false, 1, 0, flags) == 0);
- assert(test_cmp_attr16(ATTR_ZONE, false, true, 1, 0, flags) == 0); /* verbose */
+ assert(test_cmp_attr16(ATTR_ZONE, false, true, 1, 0, flags) == 1); /* verbose */
assert(test_cmp_attr16(ATTR_ZONE, true, true, 1, 0, flags) == 0);
assert(test_cmp_attr16(ATTR_ZONE, false, false, 0, 1, flags) == 1); /* verbose */
- assert(test_cmp_attr16(ATTR_ZONE, true, false, 0, 1, flags) == 0); /* verbose */
+ assert(test_cmp_attr16(ATTR_ZONE, true, false, 0, 1, flags) == 1); /* verbose */
assert(test_cmp_attr16(ATTR_ZONE, false, true, 0, 1, flags) == 0);
assert(test_cmp_attr16(ATTR_ZONE, true, true, 0, 1, flags) == 0);
assert(test_cmp_attr16(ATTR_ZONE, false, false, 1, 1, flags) == 1); /* verbose */
@@ -305,7 +305,7 @@ static void test_nfct_cmp_attr(int attr)
flags = NFCT_CMP_MASK;
assert(test_cmp_attr16(ATTR_ZONE, false, false, 0, 0, flags) == 1);
- assert(test_cmp_attr16(ATTR_ZONE, true, false, 0, 0, flags) == 0);
+ assert(test_cmp_attr16(ATTR_ZONE, true, false, 0, 0, flags) == 1);
assert(test_cmp_attr16(ATTR_ZONE, false, true, 0, 0, flags) == 1);
assert(test_cmp_attr16(ATTR_ZONE, true, true, 0, 0, flags) == 1);
assert(test_cmp_attr16(ATTR_ZONE, false, false, 1, 0, flags) == 1); /* verbose */
@@ -313,7 +313,7 @@ static void test_nfct_cmp_attr(int attr)
assert(test_cmp_attr16(ATTR_ZONE, false, true, 1, 0, flags) == 1); /* verbose */
assert(test_cmp_attr16(ATTR_ZONE, true, true, 1, 0, flags) == 0);
assert(test_cmp_attr16(ATTR_ZONE, false, false, 0, 1, flags) == 1); /* verbose */
- assert(test_cmp_attr16(ATTR_ZONE, true, false, 0, 1, flags) == 0); /* verbose */
+ assert(test_cmp_attr16(ATTR_ZONE, true, false, 0, 1, flags) == 1); /* verbose */
assert(test_cmp_attr16(ATTR_ZONE, false, true, 0, 1, flags) == 1);
assert(test_cmp_attr16(ATTR_ZONE, true, true, 0, 1, flags) == 0);
assert(test_cmp_attr16(ATTR_ZONE, false, false, 1, 1, flags) == 1); /* verbose */
@@ -323,15 +323,15 @@ static void test_nfct_cmp_attr(int attr)
flags = NFCT_CMP_STRICT|NFCT_CMP_MASK;
assert(test_cmp_attr16(ATTR_ZONE, false, false, 0, 0, flags) == 1);
- assert(test_cmp_attr16(ATTR_ZONE, true, false, 0, 0, flags) == 0);
- assert(test_cmp_attr16(ATTR_ZONE, false, true, 0, 0, flags) == 0);
+ assert(test_cmp_attr16(ATTR_ZONE, true, false, 0, 0, flags) == 1);
+ assert(test_cmp_attr16(ATTR_ZONE, false, true, 0, 0, flags) == 1);
assert(test_cmp_attr16(ATTR_ZONE, true, true, 0, 0, flags) == 1);
assert(test_cmp_attr16(ATTR_ZONE, false, false, 1, 0, flags) == 1); /* verbose */
assert(test_cmp_attr16(ATTR_ZONE, true, false, 1, 0, flags) == 0);
- assert(test_cmp_attr16(ATTR_ZONE, false, true, 1, 0, flags) == 0); /* verbose */
+ assert(test_cmp_attr16(ATTR_ZONE, false, true, 1, 0, flags) == 1); /* verbose */
assert(test_cmp_attr16(ATTR_ZONE, true, true, 1, 0, flags) == 0);
assert(test_cmp_attr16(ATTR_ZONE, false, false, 0, 1, flags) == 1); /* verbose */
- assert(test_cmp_attr16(ATTR_ZONE, true, false, 0, 1, flags) == 0); /* verbose */
+ assert(test_cmp_attr16(ATTR_ZONE, true, false, 0, 1, flags) == 1); /* verbose */
assert(test_cmp_attr16(ATTR_ZONE, false, true, 0, 1, flags) == 0);
assert(test_cmp_attr16(ATTR_ZONE, true, true, 0, 1, flags) == 0);
assert(test_cmp_attr16(ATTR_ZONE, false, false, 1, 1, flags) == 1); /* verbose */
diff --git a/src/conntrack/compare.c b/src/conntrack/compare.c
index f4a194a..a3da81b 100644
--- a/src/conntrack/compare.c
+++ b/src/conntrack/compare.c
@@ -291,7 +291,25 @@ cmp_mark(const struct nf_conntrack *ct1,
const struct nf_conntrack *ct2,
unsigned int flags)
{
- return (ct1->mark == ct2->mark);
+ int a = test_bit(ATTR_MARK, ct1->head.set);
+ int b = test_bit(ATTR_MARK, ct2->head.set);
+ if (a & b) {
+ return (ct1->mark == ct2->mark);
+ } else if (!a && !b) {
+ return 1;
+ }
+
+ switch (flags & (NFCT_CMP_STRICT | NFCT_CMP_MASK)) {
+ case NFCT_CMP_MASK:
+ if (!a)
+ return 1;
+ case NFCT_CMP_STRICT | NFCT_CMP_MASK:
+ case NFCT_CMP_STRICT:
+ return nfct_get_attr_u32(ct1, ATTR_MARK)
+ == nfct_get_attr_u32(ct2, ATTR_MARK);
+ default:
+ return 1;
+ }
}
static int
@@ -357,7 +375,25 @@ cmp_zone(const struct nf_conntrack *ct1,
const struct nf_conntrack *ct2,
unsigned int flags)
{
- return (ct1->zone == ct2->zone);
+ int a = test_bit(ATTR_ZONE, ct1->head.set);
+ int b = test_bit(ATTR_ZONE, ct2->head.set);
+ if (a & b) {
+ return (ct1->zone == ct2->zone);
+ } else if (!a && !b) {
+ return 1;
+ }
+
+ switch (flags & (NFCT_CMP_STRICT | NFCT_CMP_MASK)) {
+ case NFCT_CMP_MASK:
+ if (!a)
+ return 1;
+ case NFCT_CMP_STRICT | NFCT_CMP_MASK:
+ case NFCT_CMP_STRICT:
+ return nfct_get_attr_u16(ct1, ATTR_ZONE)
+ == nfct_get_attr_u16(ct2, ATTR_ZONE);
+ default:
+ return 1;
+ }
}
static int
@@ -421,7 +457,7 @@ static int cmp_meta(const struct nf_conntrack *ct1,
{
if (!__cmp(ATTR_ID, ct1, ct2, flags, cmp_id))
return 0;
- if (!__cmp(ATTR_MARK, ct1, ct2, flags, cmp_mark))
+ if (!cmp_mark(ct1, ct2, flags))
return 0;
if (!__cmp(ATTR_TIMEOUT, ct1, ct2, flags, cmp_timeout))
return 0;
@@ -433,7 +469,7 @@ static int cmp_meta(const struct nf_conntrack *ct1,
return 0;
if (!__cmp(ATTR_DCCP_STATE, ct1, ct2, flags, cmp_dccp_state))
return 0;
- if (!__cmp(ATTR_ZONE, ct1, ct2, flags, cmp_zone))
+ if (!cmp_zone(ct1, ct2, flags))
return 0;
if (!__cmp(ATTR_SECCTX, ct1, ct2, flags, cmp_secctx))
return 0;
--
1.9.1
prev parent reply other threads:[~2014-06-23 10:18 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-06-17 12:04 [PATCH v2 libnetfilter_conntrack] zero value handling of mark and zone Ken-ichirou MATSUZAWA
2014-06-17 16:40 ` Florian Westphal
2014-06-19 15:16 ` Florian Westphal
2014-06-23 10:12 ` [PATCH v3 0/2 " Ken-ichirou MATSUZAWA
2014-06-23 10:15 ` [PATCH v3 1/2 libnetfilter_conntrack] qa: update cmp ATTR_ZONE size " Ken-ichirou MATSUZAWA
2014-06-24 15:23 ` Florian Westphal
2014-06-23 10:18 ` Ken-ichirou MATSUZAWA [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140623101810.GC29052@gmail.com \
--to=chamaken@gmail.com \
--cc=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.