Re: [PATCH] NETFILTER: add support for invert condition (!) in ipt_limit

[Patrick McHardy <kaber@trash.net>]

Marco Innocenti wrote:
> On Mon, Oct 17, 2005 at 06:45:47PM +0900, YOSHIFUJI Hideaki / ?$B5HF#1QL@ wrote:
> 
>>>-		return 1;
>>>+		return 1 ^ r->invert;
>>
>>!r->invert
> 
> 
> I've seen it in ipt_multiport.c and I copied it.
> Should ipt_multiport.c be corrected?

Probably, I've never liked these strange looking expressions.

> diff -uprN linux-2.6.13.4/include/linux/netfilter_ipv4/ipt_limit.h linux-2.6.13.4.mio/include/linux/netfilter_ipv4/ipt_limit.h
> --- linux-2.6.13.4/include/linux/netfilter_ipv4/ipt_limit.h	2005-10-10 20:54:29.000000000 +0200
> +++ linux-2.6.13.4.mio/include/linux/netfilter_ipv4/ipt_limit.h	2005-10-15 16:25:02.000000000 +0200
> @@ -9,6 +9,7 @@
>  struct ipt_rateinfo {
>  	u_int32_t avg;    /* Average secs between packets * scale */
>  	u_int32_t burst;  /* Period multiplier for upper limit. */
> +	u_int8_t invert;
>  
>  	/* Used internally by the kernel */
>  	unsigned long prev;

This breaks userspace compatibility, you need to use a new revision
if you want to change this structure. Look at ipt_MARK for an example.