Commit 917b6fbd authored by Jan Engelhardt's avatar Jan Engelhardt Committed by David S. Miller

[NETFILTER]: xt_policy: use the new union nf_inet_addr

Signed-off-by: default avatarJan Engelhardt <jengelh@computergmbh.de>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 57de0abb
...@@ -27,18 +27,33 @@ struct xt_policy_spec ...@@ -27,18 +27,33 @@ struct xt_policy_spec
reqid:1; reqid:1;
}; };
#ifndef __KERNEL__
union xt_policy_addr union xt_policy_addr
{ {
struct in_addr a4; struct in_addr a4;
struct in6_addr a6; struct in6_addr a6;
}; };
#endif
struct xt_policy_elem struct xt_policy_elem
{ {
union xt_policy_addr saddr; union {
union xt_policy_addr smask; #ifdef __KERNEL__
union xt_policy_addr daddr; struct {
union xt_policy_addr dmask; union nf_inet_addr saddr;
union nf_inet_addr smask;
union nf_inet_addr daddr;
union nf_inet_addr dmask;
};
#else
struct {
union xt_policy_addr saddr;
union xt_policy_addr smask;
union xt_policy_addr daddr;
union xt_policy_addr dmask;
};
#endif
};
__be32 spi; __be32 spi;
u_int32_t reqid; u_int32_t reqid;
u_int8_t proto; u_int8_t proto;
......
...@@ -13,6 +13,7 @@ ...@@ -13,6 +13,7 @@
#include <linux/init.h> #include <linux/init.h>
#include <net/xfrm.h> #include <net/xfrm.h>
#include <linux/netfilter.h>
#include <linux/netfilter/xt_policy.h> #include <linux/netfilter/xt_policy.h>
#include <linux/netfilter/x_tables.h> #include <linux/netfilter/x_tables.h>
...@@ -21,14 +22,14 @@ MODULE_DESCRIPTION("Xtables IPsec policy matching module"); ...@@ -21,14 +22,14 @@ MODULE_DESCRIPTION("Xtables IPsec policy matching module");
MODULE_LICENSE("GPL"); MODULE_LICENSE("GPL");
static inline bool static inline bool
xt_addr_cmp(const union xt_policy_addr *a1, const union xt_policy_addr *m, xt_addr_cmp(const union nf_inet_addr *a1, const union nf_inet_addr *m,
const union xt_policy_addr *a2, unsigned short family) const union nf_inet_addr *a2, unsigned short family)
{ {
switch (family) { switch (family) {
case AF_INET: case AF_INET:
return !((a1->a4.s_addr ^ a2->a4.s_addr) & m->a4.s_addr); return ((a1->ip ^ a2->ip) & m->ip) == 0;
case AF_INET6: case AF_INET6:
return !ipv6_masked_addr_cmp(&a1->a6, &m->a6, &a2->a6); return ipv6_masked_addr_cmp(&a1->in6, &m->in6, &a2->in6) == 0;
} }
return false; return false;
} }
...@@ -38,12 +39,12 @@ match_xfrm_state(const struct xfrm_state *x, const struct xt_policy_elem *e, ...@@ -38,12 +39,12 @@ match_xfrm_state(const struct xfrm_state *x, const struct xt_policy_elem *e,
unsigned short family) unsigned short family)
{ {
#define MATCH_ADDR(x,y,z) (!e->match.x || \ #define MATCH_ADDR(x,y,z) (!e->match.x || \
(xt_addr_cmp(&e->x, &e->y, (z), family) \ (xt_addr_cmp(&e->x, &e->y, (const union nf_inet_addr *)(z), family) \
^ e->invert.x)) ^ e->invert.x))
#define MATCH(x,y) (!e->match.x || ((e->x == (y)) ^ e->invert.x)) #define MATCH(x,y) (!e->match.x || ((e->x == (y)) ^ e->invert.x))
return MATCH_ADDR(saddr, smask, (union xt_policy_addr *)&x->props.saddr) && return MATCH_ADDR(saddr, smask, &x->props.saddr) &&
MATCH_ADDR(daddr, dmask, (union xt_policy_addr *)&x->id.daddr) && MATCH_ADDR(daddr, dmask, &x->id.daddr) &&
MATCH(proto, x->id.proto) && MATCH(proto, x->id.proto) &&
MATCH(mode, x->props.mode) && MATCH(mode, x->props.mode) &&
MATCH(spi, x->id.spi) && MATCH(spi, x->id.spi) &&
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment