diff options
author | /C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org </C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org> | 2007-04-24 18:39:51 +0000 |
---|---|---|
committer | /C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org </C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org> | 2007-04-24 18:39:51 +0000 |
commit | 7736631fef63efde9c0fd68af89c3e2900286428 (patch) | |
tree | 62d74d3733dc9e06bc608f70944278c6d9d13137 /src/conntrack/compare.c | |
parent | 888062dd7196528a54753155c71572725597aa25 (diff) |
- fix compilation warning in snprintf.c
- introduce the new compare infrastructure: much simple than previous
- introduce nfct_maxsize for nf_conntrack object allocated in the stack
- more strict checkings in nfct_set_attr: third parameter is const
Diffstat (limited to 'src/conntrack/compare.c')
-rw-r--r-- | src/conntrack/compare.c | 102 |
1 files changed, 102 insertions, 0 deletions
diff --git a/src/conntrack/compare.c b/src/conntrack/compare.c new file mode 100644 index 0000000..0792a8a --- /dev/null +++ b/src/conntrack/compare.c @@ -0,0 +1,102 @@ +/* + * (C) 2007 by Pablo Neira Ayuso <pablo@netfilter.org> + * + * This software may be used and distributed according to the terms + * of the GNU General Public License, incorporated herein by reference. + */ + +#include "internal.h" + +int __compare(const struct nf_conntrack *ct1, + const struct nf_conntrack *ct2) +{ + if (test_bit(ATTR_MARK, ct1->set) && + test_bit(ATTR_MARK, ct2->set) && + ct1->mark != ct2->mark) + return 0; + + if (test_bit(ATTR_TIMEOUT, ct1->set) && + test_bit(ATTR_TIMEOUT, ct2->set) && + ct1->timeout != ct2->timeout) + return 0; + + if (test_bit(ATTR_STATUS, ct1->set) && + test_bit(ATTR_STATUS, ct2->set) && + ct1->status == ct2->status) + return 0; + + if (test_bit(ATTR_TCP_STATE, ct1->set) && + test_bit(ATTR_TCP_STATE, ct2->set) && + ct1->protoinfo.tcp.state != ct2->protoinfo.tcp.state) + return 0; + + if (test_bit(ATTR_ORIG_L3PROTO, ct1->set) && + test_bit(ATTR_ORIG_L3PROTO, ct2->set) && + ct1->tuple[__DIR_ORIG].l3protonum != AF_UNSPEC && + ct2->tuple[__DIR_ORIG].l3protonum != AF_UNSPEC && + ct1->tuple[__DIR_ORIG].l3protonum != + ct2->tuple[__DIR_ORIG].l3protonum) + return 0; + + if (test_bit(ATTR_REPL_L3PROTO, ct1->set) && + test_bit(ATTR_REPL_L3PROTO, ct2->set) && + ct1->tuple[__DIR_REPL].l3protonum != AF_UNSPEC && + ct2->tuple[__DIR_REPL].l3protonum != AF_UNSPEC && + ct1->tuple[__DIR_REPL].l3protonum != + ct2->tuple[__DIR_REPL].l3protonum) + return 0; + + if (test_bit(ATTR_ORIG_IPV4_SRC, ct1->set) && + test_bit(ATTR_ORIG_IPV4_SRC, ct2->set) && + ct1->tuple[__DIR_ORIG].src.v4 != + ct2->tuple[__DIR_ORIG].src.v4) + return 0; + + if (test_bit(ATTR_ORIG_IPV4_DST, ct1->set) && + test_bit(ATTR_ORIG_IPV4_DST, ct2->set) && + ct1->tuple[__DIR_ORIG].dst.v4 != + ct2->tuple[__DIR_ORIG].dst.v4) + return 0; + + if (test_bit(ATTR_REPL_IPV4_SRC, ct1->set) && + test_bit(ATTR_REPL_IPV4_SRC, ct2->set) && + ct1->tuple[__DIR_REPL].src.v4 != + ct2->tuple[__DIR_REPL].src.v4) + return 0; + + if (test_bit(ATTR_REPL_IPV4_DST, ct1->set) && + test_bit(ATTR_REPL_IPV4_DST, ct2->set) && + ct1->tuple[__DIR_REPL].dst.v4 != + ct2->tuple[__DIR_REPL].dst.v4) + return 0; + + if (test_bit(ATTR_ORIG_IPV6_SRC, ct1->set) && + test_bit(ATTR_ORIG_IPV6_SRC, ct2->set) && + memcmp(&ct1->tuple[__DIR_ORIG].src.v6, + &ct2->tuple[__DIR_ORIG].src.v6, + sizeof(u_int32_t)*4) == 0) + return 0; + + if (test_bit(ATTR_ORIG_IPV6_DST, ct1->set) && + test_bit(ATTR_ORIG_IPV6_DST, ct2->set) && + memcmp(&ct1->tuple[__DIR_ORIG].dst.v6, + &ct2->tuple[__DIR_ORIG].dst.v6, + sizeof(u_int32_t)*4) == 0) + return 0; + + if (test_bit(ATTR_REPL_IPV6_SRC, ct1->set) && + test_bit(ATTR_REPL_IPV6_SRC, ct2->set) && + memcmp(&ct1->tuple[__DIR_REPL].src.v6, + &ct2->tuple[__DIR_REPL].src.v6, + sizeof(u_int32_t)*4) == 0) + return 0; + + if (test_bit(ATTR_REPL_IPV6_DST, ct1->set) && + test_bit(ATTR_REPL_IPV6_DST, ct2->set) && + memcmp(&ct1->tuple[__DIR_REPL].dst.v6, + &ct2->tuple[__DIR_REPL].dst.v6, + sizeof(u_int32_t)*4) == 0) + return 0; + + return 1; +} |