From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 23/26] etherdevice.h & bridge: netfilter: Add and use ether_addr_equal_masked
Date: Wed, 6 Jul 2016 16:24:05 +0200 [thread overview]
Message-ID: <1467815048-2240-24-git-send-email-pablo@netfilter.org> (raw)
In-Reply-To: <1467815048-2240-1-git-send-email-pablo@netfilter.org>
From: Joe Perches <joe@perches.com>
There are code duplications of a masked ethernet address comparison here
so make it a separate function instead.
Miscellanea:
o Neaten alignment of FWINV macro uses to make it clearer for the reader
Signed-off-by: Joe Perches <joe@perches.com>
Acked-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/linux/etherdevice.h | 23 +++++++++++++++++++
net/bridge/netfilter/ebt_arp.c | 17 +++++---------
net/bridge/netfilter/ebt_stp.c | 49 ++++++++++++++++++-----------------------
net/bridge/netfilter/ebtables.c | 17 +++++---------
4 files changed, 57 insertions(+), 49 deletions(-)
diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h
index 37ff4a6..6fec9e8 100644
--- a/include/linux/etherdevice.h
+++ b/include/linux/etherdevice.h
@@ -374,6 +374,29 @@ static inline bool ether_addr_equal_unaligned(const u8 *addr1, const u8 *addr2)
}
/**
+ * ether_addr_equal_masked - Compare two Ethernet addresses with a mask
+ * @addr1: Pointer to a six-byte array containing the 1st Ethernet address
+ * @addr2: Pointer to a six-byte array containing the 2nd Ethernet address
+ * @mask: Pointer to a six-byte array containing the Ethernet address bitmask
+ *
+ * Compare two Ethernet addresses with a mask, returns true if for every bit
+ * set in the bitmask the equivalent bits in the ethernet addresses are equal.
+ * Using a mask with all bits set is a slower ether_addr_equal.
+ */
+static inline bool ether_addr_equal_masked(const u8 *addr1, const u8 *addr2,
+ const u8 *mask)
+{
+ int i;
+
+ for (i = 0; i < ETH_ALEN; i++) {
+ if ((addr1[i] ^ addr2[i]) & mask[i])
+ return false;
+ }
+
+ return true;
+}
+
+/**
* is_etherdev_addr - Tell if given Ethernet address belongs to the device.
* @dev: Pointer to a device structure
* @addr: Pointer to a six-byte array containing the Ethernet address
diff --git a/net/bridge/netfilter/ebt_arp.c b/net/bridge/netfilter/ebt_arp.c
index cd457b8..cca0a89 100644
--- a/net/bridge/netfilter/ebt_arp.c
+++ b/net/bridge/netfilter/ebt_arp.c
@@ -65,7 +65,6 @@ ebt_arp_mt(const struct sk_buff *skb, struct xt_action_param *par)
if (info->bitmask & (EBT_ARP_SRC_MAC | EBT_ARP_DST_MAC)) {
const unsigned char *mp;
unsigned char _mac[ETH_ALEN];
- uint8_t verdict, i;
if (ah->ar_hln != ETH_ALEN || ah->ar_hrd != htons(ARPHRD_ETHER))
return false;
@@ -74,11 +73,9 @@ ebt_arp_mt(const struct sk_buff *skb, struct xt_action_param *par)
sizeof(_mac), &_mac);
if (mp == NULL)
return false;
- verdict = 0;
- for (i = 0; i < 6; i++)
- verdict |= (mp[i] ^ info->smaddr[i]) &
- info->smmsk[i];
- if (FWINV(verdict != 0, EBT_ARP_SRC_MAC))
+ if (FWINV(!ether_addr_equal_masked(mp, info->smaddr,
+ info->smmsk),
+ EBT_ARP_SRC_MAC))
return false;
}
@@ -88,11 +85,9 @@ ebt_arp_mt(const struct sk_buff *skb, struct xt_action_param *par)
sizeof(_mac), &_mac);
if (mp == NULL)
return false;
- verdict = 0;
- for (i = 0; i < 6; i++)
- verdict |= (mp[i] ^ info->dmaddr[i]) &
- info->dmmsk[i];
- if (FWINV(verdict != 0, EBT_ARP_DST_MAC))
+ if (FWINV(!ether_addr_equal_masked(mp, info->dmaddr,
+ info->dmmsk),
+ EBT_ARP_DST_MAC))
return false;
}
}
diff --git a/net/bridge/netfilter/ebt_stp.c b/net/bridge/netfilter/ebt_stp.c
index e77f90b..45f73d5 100644
--- a/net/bridge/netfilter/ebt_stp.c
+++ b/net/bridge/netfilter/ebt_stp.c
@@ -46,7 +46,6 @@ static bool ebt_filter_config(const struct ebt_stp_info *info,
const struct ebt_stp_config_info *c;
u16 v16;
u32 v32;
- int verdict, i;
c = &info->config;
if ((info->bitmask & EBT_STP_FLAGS) &&
@@ -54,66 +53,62 @@ static bool ebt_filter_config(const struct ebt_stp_info *info,
return false;
if (info->bitmask & EBT_STP_ROOTPRIO) {
v16 = NR16(stpc->root);
- if (FWINV(v16 < c->root_priol ||
- v16 > c->root_priou, EBT_STP_ROOTPRIO))
+ if (FWINV(v16 < c->root_priol || v16 > c->root_priou,
+ EBT_STP_ROOTPRIO))
return false;
}
if (info->bitmask & EBT_STP_ROOTADDR) {
- verdict = 0;
- for (i = 0; i < 6; i++)
- verdict |= (stpc->root[2+i] ^ c->root_addr[i]) &
- c->root_addrmsk[i];
- if (FWINV(verdict != 0, EBT_STP_ROOTADDR))
+ if (FWINV(!ether_addr_equal_masked(&stpc->root[2], c->root_addr,
+ c->root_addrmsk),
+ EBT_STP_ROOTADDR))
return false;
}
if (info->bitmask & EBT_STP_ROOTCOST) {
v32 = NR32(stpc->root_cost);
- if (FWINV(v32 < c->root_costl ||
- v32 > c->root_costu, EBT_STP_ROOTCOST))
+ if (FWINV(v32 < c->root_costl || v32 > c->root_costu,
+ EBT_STP_ROOTCOST))
return false;
}
if (info->bitmask & EBT_STP_SENDERPRIO) {
v16 = NR16(stpc->sender);
- if (FWINV(v16 < c->sender_priol ||
- v16 > c->sender_priou, EBT_STP_SENDERPRIO))
+ if (FWINV(v16 < c->sender_priol || v16 > c->sender_priou,
+ EBT_STP_SENDERPRIO))
return false;
}
if (info->bitmask & EBT_STP_SENDERADDR) {
- verdict = 0;
- for (i = 0; i < 6; i++)
- verdict |= (stpc->sender[2+i] ^ c->sender_addr[i]) &
- c->sender_addrmsk[i];
- if (FWINV(verdict != 0, EBT_STP_SENDERADDR))
+ if (FWINV(!ether_addr_equal_masked(&stpc->sender[2],
+ c->sender_addr,
+ c->sender_addrmsk),
+ EBT_STP_SENDERADDR))
return false;
}
if (info->bitmask & EBT_STP_PORT) {
v16 = NR16(stpc->port);
- if (FWINV(v16 < c->portl ||
- v16 > c->portu, EBT_STP_PORT))
+ if (FWINV(v16 < c->portl || v16 > c->portu, EBT_STP_PORT))
return false;
}
if (info->bitmask & EBT_STP_MSGAGE) {
v16 = NR16(stpc->msg_age);
- if (FWINV(v16 < c->msg_agel ||
- v16 > c->msg_ageu, EBT_STP_MSGAGE))
+ if (FWINV(v16 < c->msg_agel || v16 > c->msg_ageu,
+ EBT_STP_MSGAGE))
return false;
}
if (info->bitmask & EBT_STP_MAXAGE) {
v16 = NR16(stpc->max_age);
- if (FWINV(v16 < c->max_agel ||
- v16 > c->max_ageu, EBT_STP_MAXAGE))
+ if (FWINV(v16 < c->max_agel || v16 > c->max_ageu,
+ EBT_STP_MAXAGE))
return false;
}
if (info->bitmask & EBT_STP_HELLOTIME) {
v16 = NR16(stpc->hello_time);
- if (FWINV(v16 < c->hello_timel ||
- v16 > c->hello_timeu, EBT_STP_HELLOTIME))
+ if (FWINV(v16 < c->hello_timel || v16 > c->hello_timeu,
+ EBT_STP_HELLOTIME))
return false;
}
if (info->bitmask & EBT_STP_FWDD) {
v16 = NR16(stpc->forward_delay);
- if (FWINV(v16 < c->forward_delayl ||
- v16 > c->forward_delayu, EBT_STP_FWDD))
+ if (FWINV(v16 < c->forward_delayl || v16 > c->forward_delayu,
+ EBT_STP_FWDD))
return false;
}
return true;
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 5a61f35..5721a25 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -130,7 +130,6 @@ ebt_basic_match(const struct ebt_entry *e, const struct sk_buff *skb,
const struct ethhdr *h = eth_hdr(skb);
const struct net_bridge_port *p;
__be16 ethproto;
- int verdict, i;
if (skb_vlan_tag_present(skb))
ethproto = htons(ETH_P_8021Q);
@@ -157,19 +156,15 @@ ebt_basic_match(const struct ebt_entry *e, const struct sk_buff *skb,
return 1;
if (e->bitmask & EBT_SOURCEMAC) {
- verdict = 0;
- for (i = 0; i < 6; i++)
- verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
- e->sourcemsk[i];
- if (FWINV2(verdict != 0, EBT_ISOURCE))
+ if (FWINV2(!ether_addr_equal_masked(h->h_source,
+ e->sourcemac, e->sourcemsk),
+ EBT_ISOURCE))
return 1;
}
if (e->bitmask & EBT_DESTMAC) {
- verdict = 0;
- for (i = 0; i < 6; i++)
- verdict |= (h->h_dest[i] ^ e->destmac[i]) &
- e->destmsk[i];
- if (FWINV2(verdict != 0, EBT_IDEST))
+ if (FWINV2(!ether_addr_equal_masked(h->h_dest,
+ e->destmac, e->destmsk),
+ EBT_IDEST))
return 1;
}
return 0;
--
2.1.4
next prev parent reply other threads:[~2016-07-06 14:27 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-07-06 14:23 [PATCH 00/26] Netfilter updates for net-next Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 01/26] bridge: netfilter: checkpatch data type fixes Pablo Neira Ayuso
2016-07-06 21:32 ` Stephen Hemminger
2016-07-06 14:23 ` [PATCH 02/26] netfilter: helper: avoid extra expectation iterations on unregister Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 03/26] netfilter: x_tables: fix possible ZERO_SIZE_PTR pointer dereferencing error Pablo Neira Ayuso
2016-07-06 18:11 ` Sergei Shtylyov
2016-07-06 14:23 ` [PATCH 04/26] netfilter: nf_log: handle NFPROTO_INET properly in nf_logger_[find_get|put] Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 05/26] netfilter: xt_TRACE: add explicitly nf_logger_find_get call Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 06/26] netfilter: conntrack: align nf_conn on cacheline boundary Pablo Neira Ayuso
2016-07-06 14:45 ` David Laight
2016-07-06 15:01 ` Florian Westphal
2016-07-06 14:23 ` [PATCH 07/26] netfilter: make comparision helpers stub functions in ZONES=n case Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 08/26] netfilter: nf_log: Remove NULL check Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 09/26] netfilter: move zone info into struct nf_conn Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 10/26] netfilter: Allow xt_owner in any user namespace Pablo Neira Ayuso
2017-10-18 23:00 ` [10/26] " Andrei Vagin
2016-07-06 14:23 ` [PATCH 11/26] netfilter: nf_reject_ipv4: don't send tcp RST if the packet is non-TCP Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 12/26] netfilter: xt_NFLOG: nflog-range does not truncate packets Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 13/26] netfilter: nf_tables: add generic macros to check for generation mask Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 14/26] netfilter: nf_tables: add generation mask to tables Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 15/26] netfilter: nf_tables: add generation mask to chains Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 16/26] netfilter: nf_tables: add generation mask to sets Pablo Neira Ayuso
2016-07-06 14:23 ` [PATCH 17/26] netfilter: nft_rbtree: check for next generation when deactivating elements Pablo Neira Ayuso
2016-07-06 14:24 ` [PATCH 18/26] netfilter: nft_hash: support deletion of inactive elements Pablo Neira Ayuso
2016-07-06 14:24 ` [PATCH 19/26] netfilter: conntrack: allow increasing bucket size via sysctl too Pablo Neira Ayuso
2016-07-06 14:24 ` [PATCH 20/26] netfilter: nf_tables: get rid of NFT_BASECHAIN_DISABLED Pablo Neira Ayuso
2016-07-06 14:24 ` [PATCH 21/26] netfilter: nf_tables: add support for inverted logic in nft_lookup Pablo Neira Ayuso
2016-07-06 14:24 ` [PATCH 22/26] netfilter: x_tables: simplify ip{6}table_mangle_hook() Pablo Neira Ayuso
2016-07-06 14:24 ` Pablo Neira Ayuso [this message]
2016-07-06 14:24 ` [PATCH 24/26] netfilter: Remove references to obsolete CONFIG_IP_ROUTE_FWMARK Pablo Neira Ayuso
2016-07-06 14:24 ` [PATCH 25/26] netfilter: Convert FWINV<[foo]> macros and uses to NF_INVF Pablo Neira Ayuso
2016-07-06 14:24 ` [PATCH 26/26] netfilter: nf_log: fix error on write NONE to logger choice sysctl Pablo Neira Ayuso
2016-07-06 16:15 ` [PATCH 00/26] Netfilter updates for net-next David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1467815048-2240-24-git-send-email-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).