* [PATCH] netfilter: xt_conntrack: fix inverted conntrack direction test
@ 2011-04-04 14:19 Florian Westphal
2011-04-04 15:07 ` Patrick McHardy
0 siblings, 1 reply; 2+ messages in thread
From: Florian Westphal @ 2011-04-04 14:19 UTC (permalink / raw)
To: netfilter-devel; +Cc: Florian Westphal
--ctdir ORIGINAL matches REPLY packets, and vv:
userspace sets "invert_flags &= ~XT_CONNTRACK_DIRECTION" in ORIGINAL
case.
Thus: (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^
!!(info->invert_flags & XT_CONNTRACK_DIRECTION))
yields "1 ^ 0", which is true -> returns false.
Reproducer:
iptables -I OUTPUT 1 -p tcp --syn -m conntrack --ctdir ORIGINAL
Signed-off-by: Florian Westphal <fwestphal@astaro.com>
---
net/netfilter/xt_conntrack.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/netfilter/xt_conntrack.c b/net/netfilter/xt_conntrack.c
index 2c0086a..481a86f 100644
--- a/net/netfilter/xt_conntrack.c
+++ b/net/netfilter/xt_conntrack.c
@@ -195,7 +195,7 @@ conntrack_mt(const struct sk_buff *skb, struct xt_action_param *par,
return info->match_flags & XT_CONNTRACK_STATE;
if ((info->match_flags & XT_CONNTRACK_DIRECTION) &&
(CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^
- !!(info->invert_flags & XT_CONNTRACK_DIRECTION))
+ !(info->invert_flags & XT_CONNTRACK_DIRECTION))
return false;
if (info->match_flags & XT_CONNTRACK_ORIGSRC)
--
1.7.3.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] netfilter: xt_conntrack: fix inverted conntrack direction test
2011-04-04 14:19 [PATCH] netfilter: xt_conntrack: fix inverted conntrack direction test Florian Westphal
@ 2011-04-04 15:07 ` Patrick McHardy
0 siblings, 0 replies; 2+ messages in thread
From: Patrick McHardy @ 2011-04-04 15:07 UTC (permalink / raw)
To: Florian Westphal; +Cc: netfilter-devel
On 04.04.2011 16:19, Florian Westphal wrote:
> --ctdir ORIGINAL matches REPLY packets, and vv:
>
> userspace sets "invert_flags &= ~XT_CONNTRACK_DIRECTION" in ORIGINAL
> case.
>
> Thus: (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^
> !!(info->invert_flags & XT_CONNTRACK_DIRECTION))
>
> yields "1 ^ 0", which is true -> returns false.
>
> Reproducer:
> iptables -I OUTPUT 1 -p tcp --syn -m conntrack --ctdir ORIGINAL
Applied, thanks Florian.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2011-04-04 15:07 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-04-04 14:19 [PATCH] netfilter: xt_conntrack: fix inverted conntrack direction test Florian Westphal
2011-04-04 15:07 ` Patrick McHardy
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).