diff options
| author | Florian Westphal | 2011-12-16 18:35:15 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso | 2011-12-23 14:50:19 +0100 |
| commit | 0354b48f633ae435acbc01b470a1ce8cfeff3e9f (patch) | |
| tree | 48a2b84c4298194cd51a55b89b7c9cb2714c0840 /net/sctp/socket.c | |
| parent | sch_gred: should not use GFP_KERNEL while holding a spinlock (diff) | |
| download | kernel-qcow2-linux-0354b48f633ae435acbc01b470a1ce8cfeff3e9f.tar.gz kernel-qcow2-linux-0354b48f633ae435acbc01b470a1ce8cfeff3e9f.tar.xz kernel-qcow2-linux-0354b48f633ae435acbc01b470a1ce8cfeff3e9f.zip | |
netfilter: xt_connbytes: handle negation correctly
"! --connbytes 23:42" should match if the packet/byte count is not in range.
As there is no explict "invert match" toggle in the match structure,
userspace swaps the from and to arguments
(i.e., as if "--connbytes 42:23" were given).
However, "what <= 23 && what >= 42" will always be false.
Change things so we use "||" in case "from" is larger than "to".
This change may look like it breaks backwards compatibility when "to" is 0.
However, older iptables binaries will refuse "connbytes 42:0",
and current releases treat it to mean "! --connbytes 0:42",
so we should be fine.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/sctp/socket.c')
0 files changed, 0 insertions, 0 deletions