Skip to contentSkip to conversation

: xt_hashlimit: fix mask calculation

PATCH In review Patrick McHardy 2 participants 2 messages Apr 7, 2008 – Apr 9, 2008

Subsystems (2)
Networking netfilter
lore
Share & tools
lore

Patrick McHardy

author
#0 lore raw

PATCH 1/2 : xt_hashlimit: fix mask calculation

The following two patches fix an invalid mask calculation in xt_hashlimit for prefix-lengths of 32 and add a missing module dependency from nf_nat to nf_conntrack_ipv4.

Please apply, thanks.

commit 01b916505ef235308d0b3b1f688a76153583bafe

Author: Patrick McHardy <[email protected]>
Date:   Mon Apr 7 13:52:15 2008 +0200

[NETFILTER]: xt_hashlimit: fix mask calculation

Shifts larger than the data type are undefined, don't try to shift an u32 by 32. Also remove some special-casing of bitmasks divisible by 32.

Based on patch by Jan Engelhardt <[email protected]>.

Signed-off-by Patrick McHardy <[email protected]>
net/netfilter/xt_hashlimit.c +5 -18
index dc29007..40d344b 100644
@@ -466,38 +466,25 @@ static inline void rateinfo_recalc(struct dsthash_ent *dh, unsigned long now)
 
 static inline __be32 maskl(__be32 a, unsigned int l)
 {
-	return htonl(ntohl(a) & ~(~(u_int32_t)0 >> l));
+	return l ? htonl(ntohl(a) & ~0 << (32 - l)) : 0;
 }
 
 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
 static void hashlimit_ipv6_mask(__be32 *i, unsigned int p)
 {
 	switch (p) {
-	case 0:
-		i[0] = i[1] = 0;
-		i[2] = i[3] = 0;
-		break;
-	case 1 ... 31:
+	case 0 ... 31:
 		i[0] = maskl(i[0], p);
 		i[1] = i[2] = i[3] = 0;
 		break;
-	case 32:
-		i[1] = i[2] = i[3] = 0;
-		break;
-	case 33 ... 63:
+	case 32 ... 63:
 		i[1] = maskl(i[1], p - 32);
 		i[2] = i[3] = 0;
 		break;
-	case 64:
-		i[2] = i[3] = 0;
-		break;
-	case 65 ... 95:
+	case 64 ... 95:
 		i[2] = maskl(i[2], p - 64);
 		i[3] = 0;
-	case 96:
-		i[3] = 0;
-		break;
-	case 97 ... 127:
+	case 96 ... 127:
 		i[3] = maskl(i[3], p - 96);
 		break;
 	case 128:
maintainer
#1 lore raw

From: Patrick McHardy <[email protected]>
Date: Mon, 07 Apr 2008 13:57:16 +0200

Quoted 5 lines

The following two patches fix an invalid mask calculation in xt_hashlimit for prefix-lengths of 32 and add a missing module dependency from nf_nat to nf_conntrack_ipv4.

Please apply, thanks.

Both applied to net-2.6, thanks Patrick!