From: Ken-ichirou MATSUZAWA <chamaken@gmail.com>
To: Florian Westphal <fw@strlen.de>
Cc: The netfilter developer mailinglist <netfilter-devel@vger.kernel.org>
Subject: [PATCH v3 2/2 libnetfilter_conntrack] conntrack: zero value handling of mark and zone
Date: Mon, 23 Jun 2014 19:18:10 +0900 [thread overview]
Message-ID: <20140623101810.GC29052@gmail.com> (raw)
In-Reply-To: <20140623101235.GA29052@gmail.com>
This patch enables comparison of 0 value with mark and zone since both CTA_MARK
and CTA_ZONE are not set in case of its value is 0. This patch has just passed
qa test which Florian wrote, I guess there is more sophiscated way that settle
cmp_mark() and cmp_zone().
Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
---
qa/test_api.c | 20 ++++++++++----------
src/conntrack/compare.c | 44 ++++++++++++++++++++++++++++++++++++++++----
2 files changed, 50 insertions(+), 14 deletions(-)
diff --git a/qa/test_api.c b/qa/test_api.c
index 1335b23..c8faeda 100644
--- a/qa/test_api.c
+++ b/qa/test_api.c
@@ -287,15 +287,15 @@ static void test_nfct_cmp_attr(int attr)
flags = NFCT_CMP_STRICT;
assert(test_cmp_attr16(ATTR_ZONE, false, false, 0, 0, flags) == 1);
- assert(test_cmp_attr16(ATTR_ZONE, true, false, 0, 0, flags) == 0);
- assert(test_cmp_attr16(ATTR_ZONE, false, true, 0, 0, flags) == 0);
+ assert(test_cmp_attr16(ATTR_ZONE, true, false, 0, 0, flags) == 1);
+ assert(test_cmp_attr16(ATTR_ZONE, false, true, 0, 0, flags) == 1);
assert(test_cmp_attr16(ATTR_ZONE, true, true, 0, 0, flags) == 1);
assert(test_cmp_attr16(ATTR_ZONE, false, false, 1, 0, flags) == 1); /* verbose */
assert(test_cmp_attr16(ATTR_ZONE, true, false, 1, 0, flags) == 0);
- assert(test_cmp_attr16(ATTR_ZONE, false, true, 1, 0, flags) == 0); /* verbose */
+ assert(test_cmp_attr16(ATTR_ZONE, false, true, 1, 0, flags) == 1); /* verbose */
assert(test_cmp_attr16(ATTR_ZONE, true, true, 1, 0, flags) == 0);
assert(test_cmp_attr16(ATTR_ZONE, false, false, 0, 1, flags) == 1); /* verbose */
- assert(test_cmp_attr16(ATTR_ZONE, true, false, 0, 1, flags) == 0); /* verbose */
+ assert(test_cmp_attr16(ATTR_ZONE, true, false, 0, 1, flags) == 1); /* verbose */
assert(test_cmp_attr16(ATTR_ZONE, false, true, 0, 1, flags) == 0);
assert(test_cmp_attr16(ATTR_ZONE, true, true, 0, 1, flags) == 0);
assert(test_cmp_attr16(ATTR_ZONE, false, false, 1, 1, flags) == 1); /* verbose */
@@ -305,7 +305,7 @@ static void test_nfct_cmp_attr(int attr)
flags = NFCT_CMP_MASK;
assert(test_cmp_attr16(ATTR_ZONE, false, false, 0, 0, flags) == 1);
- assert(test_cmp_attr16(ATTR_ZONE, true, false, 0, 0, flags) == 0);
+ assert(test_cmp_attr16(ATTR_ZONE, true, false, 0, 0, flags) == 1);
assert(test_cmp_attr16(ATTR_ZONE, false, true, 0, 0, flags) == 1);
assert(test_cmp_attr16(ATTR_ZONE, true, true, 0, 0, flags) == 1);
assert(test_cmp_attr16(ATTR_ZONE, false, false, 1, 0, flags) == 1); /* verbose */
@@ -313,7 +313,7 @@ static void test_nfct_cmp_attr(int attr)
assert(test_cmp_attr16(ATTR_ZONE, false, true, 1, 0, flags) == 1); /* verbose */
assert(test_cmp_attr16(ATTR_ZONE, true, true, 1, 0, flags) == 0);
assert(test_cmp_attr16(ATTR_ZONE, false, false, 0, 1, flags) == 1); /* verbose */
- assert(test_cmp_attr16(ATTR_ZONE, true, false, 0, 1, flags) == 0); /* verbose */
+ assert(test_cmp_attr16(ATTR_ZONE, true, false, 0, 1, flags) == 1); /* verbose */
assert(test_cmp_attr16(ATTR_ZONE, false, true, 0, 1, flags) == 1);
assert(test_cmp_attr16(ATTR_ZONE, true, true, 0, 1, flags) == 0);
assert(test_cmp_attr16(ATTR_ZONE, false, false, 1, 1, flags) == 1); /* verbose */
@@ -323,15 +323,15 @@ static void test_nfct_cmp_attr(int attr)
flags = NFCT_CMP_STRICT|NFCT_CMP_MASK;
assert(test_cmp_attr16(ATTR_ZONE, false, false, 0, 0, flags) == 1);
- assert(test_cmp_attr16(ATTR_ZONE, true, false, 0, 0, flags) == 0);
- assert(test_cmp_attr16(ATTR_ZONE, false, true, 0, 0, flags) == 0);
+ assert(test_cmp_attr16(ATTR_ZONE, true, false, 0, 0, flags) == 1);
+ assert(test_cmp_attr16(ATTR_ZONE, false, true, 0, 0, flags) == 1);
assert(test_cmp_attr16(ATTR_ZONE, true, true, 0, 0, flags) == 1);
assert(test_cmp_attr16(ATTR_ZONE, false, false, 1, 0, flags) == 1); /* verbose */
assert(test_cmp_attr16(ATTR_ZONE, true, false, 1, 0, flags) == 0);
- assert(test_cmp_attr16(ATTR_ZONE, false, true, 1, 0, flags) == 0); /* verbose */
+ assert(test_cmp_attr16(ATTR_ZONE, false, true, 1, 0, flags) == 1); /* verbose */
assert(test_cmp_attr16(ATTR_ZONE, true, true, 1, 0, flags) == 0);
assert(test_cmp_attr16(ATTR_ZONE, false, false, 0, 1, flags) == 1); /* verbose */
- assert(test_cmp_attr16(ATTR_ZONE, true, false, 0, 1, flags) == 0); /* verbose */
+ assert(test_cmp_attr16(ATTR_ZONE, true, false, 0, 1, flags) == 1); /* verbose */
assert(test_cmp_attr16(ATTR_ZONE, false, true, 0, 1, flags) == 0);
assert(test_cmp_attr16(ATTR_ZONE, true, true, 0, 1, flags) == 0);
assert(test_cmp_attr16(ATTR_ZONE, false, false, 1, 1, flags) == 1); /* verbose */
diff --git a/src/conntrack/compare.c b/src/conntrack/compare.c
index f4a194a..a3da81b 100644
--- a/src/conntrack/compare.c
+++ b/src/conntrack/compare.c
@@ -291,7 +291,25 @@ cmp_mark(const struct nf_conntrack *ct1,
const struct nf_conntrack *ct2,
unsigned int flags)
{
- return (ct1->mark == ct2->mark);
+ int a = test_bit(ATTR_MARK, ct1->head.set);
+ int b = test_bit(ATTR_MARK, ct2->head.set);
+ if (a & b) {
+ return (ct1->mark == ct2->mark);
+ } else if (!a && !b) {
+ return 1;
+ }
+
+ switch (flags & (NFCT_CMP_STRICT | NFCT_CMP_MASK)) {
+ case NFCT_CMP_MASK:
+ if (!a)
+ return 1;
+ case NFCT_CMP_STRICT | NFCT_CMP_MASK:
+ case NFCT_CMP_STRICT:
+ return nfct_get_attr_u32(ct1, ATTR_MARK)
+ == nfct_get_attr_u32(ct2, ATTR_MARK);
+ default:
+ return 1;
+ }
}
static int
@@ -357,7 +375,25 @@ cmp_zone(const struct nf_conntrack *ct1,
const struct nf_conntrack *ct2,
unsigned int flags)
{
- return (ct1->zone == ct2->zone);
+ int a = test_bit(ATTR_ZONE, ct1->head.set);
+ int b = test_bit(ATTR_ZONE, ct2->head.set);
+ if (a & b) {
+ return (ct1->zone == ct2->zone);
+ } else if (!a && !b) {
+ return 1;
+ }
+
+ switch (flags & (NFCT_CMP_STRICT | NFCT_CMP_MASK)) {
+ case NFCT_CMP_MASK:
+ if (!a)
+ return 1;
+ case NFCT_CMP_STRICT | NFCT_CMP_MASK:
+ case NFCT_CMP_STRICT:
+ return nfct_get_attr_u16(ct1, ATTR_ZONE)
+ == nfct_get_attr_u16(ct2, ATTR_ZONE);
+ default:
+ return 1;
+ }
}
static int
@@ -421,7 +457,7 @@ static int cmp_meta(const struct nf_conntrack *ct1,
{
if (!__cmp(ATTR_ID, ct1, ct2, flags, cmp_id))
return 0;
- if (!__cmp(ATTR_MARK, ct1, ct2, flags, cmp_mark))
+ if (!cmp_mark(ct1, ct2, flags))
return 0;
if (!__cmp(ATTR_TIMEOUT, ct1, ct2, flags, cmp_timeout))
return 0;
@@ -433,7 +469,7 @@ static int cmp_meta(const struct nf_conntrack *ct1,
return 0;
if (!__cmp(ATTR_DCCP_STATE, ct1, ct2, flags, cmp_dccp_state))
return 0;
- if (!__cmp(ATTR_ZONE, ct1, ct2, flags, cmp_zone))
+ if (!cmp_zone(ct1, ct2, flags))
return 0;
if (!__cmp(ATTR_SECCTX, ct1, ct2, flags, cmp_secctx))
return 0;
--
1.9.1
prev parent reply other threads:[~2014-06-23 10:18 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-06-17 12:04 [PATCH v2 libnetfilter_conntrack] zero value handling of mark and zone Ken-ichirou MATSUZAWA
2014-06-17 16:40 ` Florian Westphal
2014-06-19 15:16 ` Florian Westphal
2014-06-23 10:12 ` [PATCH v3 0/2 " Ken-ichirou MATSUZAWA
2014-06-23 10:15 ` [PATCH v3 1/2 libnetfilter_conntrack] qa: update cmp ATTR_ZONE size " Ken-ichirou MATSUZAWA
2014-06-24 15:23 ` Florian Westphal
2014-06-23 10:18 ` Ken-ichirou MATSUZAWA [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140623101810.GC29052@gmail.com \
--to=chamaken@gmail.com \
--cc=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).