Commit 0047c65a authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller

[NETFILTER]: Prepare {ipt,ip6t}_policy match for x_tables unification

The IPv4 and IPv6 version of the policy match are identical besides address
comparison and the data structure used for userspace communication. Unify
the data structures to break compatiblity now (before it is released), so
we can port it to x_tables in 2.6.17.
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 878c41ce
...@@ -27,12 +27,18 @@ struct ipt_policy_spec ...@@ -27,12 +27,18 @@ struct ipt_policy_spec
reqid:1; reqid:1;
}; };
union ipt_policy_addr
{
struct in_addr a4;
struct in6_addr a6;
};
struct ipt_policy_elem struct ipt_policy_elem
{ {
u_int32_t saddr; union ipt_policy_addr saddr;
u_int32_t smask; union ipt_policy_addr smask;
u_int32_t daddr; union ipt_policy_addr daddr;
u_int32_t dmask; union ipt_policy_addr dmask;
u_int32_t spi; u_int32_t spi;
u_int32_t reqid; u_int32_t reqid;
u_int8_t proto; u_int8_t proto;
......
...@@ -27,12 +27,18 @@ struct ip6t_policy_spec ...@@ -27,12 +27,18 @@ struct ip6t_policy_spec
reqid:1; reqid:1;
}; };
union ip6t_policy_addr
{
struct in_addr a4;
struct in6_addr a6;
};
struct ip6t_policy_elem struct ip6t_policy_elem
{ {
struct in6_addr saddr; union ip6t_policy_addr saddr;
struct in6_addr smask; union ip6t_policy_addr smask;
struct in6_addr daddr; union ip6t_policy_addr daddr;
struct in6_addr dmask; union ip6t_policy_addr dmask;
u_int32_t spi; u_int32_t spi;
u_int32_t reqid; u_int32_t reqid;
u_int8_t proto; u_int8_t proto;
......
...@@ -26,10 +26,13 @@ MODULE_LICENSE("GPL"); ...@@ -26,10 +26,13 @@ MODULE_LICENSE("GPL");
static inline int static inline int
match_xfrm_state(struct xfrm_state *x, const struct ipt_policy_elem *e) match_xfrm_state(struct xfrm_state *x, const struct ipt_policy_elem *e)
{ {
#define MATCH_ADDR(x,y,z) (!e->match.x || \
((e->x.a4.s_addr == (e->y.a4.s_addr & (z))) \
^ e->invert.x))
#define MATCH(x,y) (!e->match.x || ((e->x == (y)) ^ e->invert.x)) #define MATCH(x,y) (!e->match.x || ((e->x == (y)) ^ e->invert.x))
return MATCH(saddr, x->props.saddr.a4 & e->smask) && return MATCH_ADDR(saddr, smask, x->props.saddr.a4) &&
MATCH(daddr, x->id.daddr.a4 & e->dmask) && MATCH_ADDR(daddr, dmask, x->id.daddr.a4) &&
MATCH(proto, x->id.proto) && MATCH(proto, x->id.proto) &&
MATCH(mode, x->props.mode) && MATCH(mode, x->props.mode) &&
MATCH(spi, x->id.spi) && MATCH(spi, x->id.spi) &&
......
...@@ -27,7 +27,7 @@ static inline int ...@@ -27,7 +27,7 @@ static inline int
match_xfrm_state(struct xfrm_state *x, const struct ip6t_policy_elem *e) match_xfrm_state(struct xfrm_state *x, const struct ip6t_policy_elem *e)
{ {
#define MATCH_ADDR(x,y,z) (!e->match.x || \ #define MATCH_ADDR(x,y,z) (!e->match.x || \
((!ip6_masked_addrcmp(&e->x, &e->y, z)) \ ((!ip6_masked_addrcmp(&e->x.a6, &e->y.a6, z)) \
^ e->invert.x)) ^ e->invert.x))
#define MATCH(x,y) (!e->match.x || ((e->x == (y)) ^ e->invert.x)) #define MATCH(x,y) (!e->match.x || ((e->x == (y)) ^ e->invert.x))
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment