[NETFILTER]: nf_conntrack: reduce masks to a subset of tuples

[mirror_ubuntu-artful-kernel.git] / net / netfilter / nf_conntrack_expect.c

diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 4130ea662c48f33415ffe57bde5bb900848458e6..83b5ad85e0eed5f8b76bdc84c188d3cbe5803e61 100644 (file)
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -141,25 +141,16 @@ static inline int expect_clash(const struct nf_conntrack_expect *a,
 {
        /* Part covered by intersection of masks must be unequal,
           otherwise they clash */
-       struct nf_conntrack_tuple intersect_mask;
+       struct nf_conntrack_tuple_mask intersect_mask;
        int count;
 
-       intersect_mask.src.l3num = a->mask.src.l3num & b->mask.src.l3num;
        intersect_mask.src.u.all = a->mask.src.u.all & b->mask.src.u.all;
-       intersect_mask.dst.u.all = a->mask.dst.u.all & b->mask.dst.u.all;
-       intersect_mask.dst.protonum = a->mask.dst.protonum
-                                       & b->mask.dst.protonum;
 
        for (count = 0; count < NF_CT_TUPLE_L3SIZE; count++){
                intersect_mask.src.u3.all[count] =
                        a->mask.src.u3.all[count] & b->mask.src.u3.all[count];
        }
 
-       for (count = 0; count < NF_CT_TUPLE_L3SIZE; count++){
-               intersect_mask.dst.u3.all[count] =
-                       a->mask.dst.u3.all[count] & b->mask.dst.u3.all[count];
-       }
-
        return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask);
 }
 
@@ -168,7 +159,7 @@ static inline int expect_matches(const struct nf_conntrack_expect *a,
 {
        return a->master == b->master
                && nf_ct_tuple_equal(&a->tuple, &b->tuple)
-               && nf_ct_tuple_equal(&a->mask, &b->mask);
+               && nf_ct_tuple_mask_equal(&a->mask, &b->mask);
 }
 
 /* Generally a bad idea to call this: could have matched already. */
@@ -224,8 +215,6 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, int family,
        exp->helper = NULL;
        exp->tuple.src.l3num = family;
        exp->tuple.dst.protonum = proto;
-       exp->mask.src.l3num = 0xFFFF;
-       exp->mask.dst.protonum = 0xFF;
 
        if (saddr) {
                memcpy(&exp->tuple.src.u3, saddr, len);
@@ -242,21 +231,6 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, int family,
                memset(&exp->mask.src.u3, 0x00, sizeof(exp->mask.src.u3));
        }
 
-       if (daddr) {
-               memcpy(&exp->tuple.dst.u3, daddr, len);
-               if (sizeof(exp->tuple.dst.u3) > len)
-                       /* address needs to be cleared for nf_ct_tuple_equal */
-                       memset((void *)&exp->tuple.dst.u3 + len, 0x00,
-                              sizeof(exp->tuple.dst.u3) - len);
-               memset(&exp->mask.dst.u3, 0xFF, len);
-               if (sizeof(exp->mask.dst.u3) > len)
-                       memset((void *)&exp->mask.dst.u3 + len, 0x00,
-                              sizeof(exp->mask.dst.u3) - len);
-       } else {
-               memset(&exp->tuple.dst.u3, 0x00, sizeof(exp->tuple.dst.u3));
-               memset(&exp->mask.dst.u3, 0x00, sizeof(exp->mask.dst.u3));
-       }
-
        if (src) {
                exp->tuple.src.u.all = (__force u16)*src;
                exp->mask.src.u.all = 0xFFFF;
@@ -265,13 +239,13 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, int family,
                exp->mask.src.u.all = 0;
        }
 
-       if (dst) {
-               exp->tuple.dst.u.all = (__force u16)*dst;
-               exp->mask.dst.u.all = 0xFFFF;
-       } else {
-               exp->tuple.dst.u.all = 0;
-               exp->mask.dst.u.all = 0;
-       }
+       memcpy(&exp->tuple.dst.u3, daddr, len);
+       if (sizeof(exp->tuple.dst.u3) > len)
+               /* address needs to be cleared for nf_ct_tuple_equal */
+               memset((void *)&exp->tuple.dst.u3 + len, 0x00,
+                      sizeof(exp->tuple.dst.u3) - len);
+
+       exp->tuple.dst.u.all = (__force u16)*dst;
 }
 EXPORT_SYMBOL_GPL(nf_ct_expect_init);