diff options
| author | Phil Sutter <phil@nwl.cc> | 2024-06-12 14:22:54 +0200 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2024-06-12 17:14:27 +0200 |
| commit | 9d0f4d239ab9d530120d3bc885d7ea41161ddf0b (patch) | |
| tree | 3c553c29023fde0ff181e7eba345839a5b46030f /iptables | |
| parent | 0234117d24609070f08ef36a11795c3c8e4c19bf (diff) | |
The former FIXME comment pointed at the fact that struct ebt_entry does
not have a 'flags' field (unlike struct ipt_ip). In fact, ebt_entry's
equivalent is 'bitmask' field. Comparing that instead is the right
thing to do, even though it does not seem to make a difference in
practice: No rule options alter just the bitmask value, nor is it
possible to fill an associated field with default values (e.g. all-zero
MAC and mask).
Since the situation described above might change and there is a slight
performance improvement in some cases (e.g. comparing rules differing
only by specified/omitted source/dest MAC address), add the check
anyway.
Suggested-by: Michael Estner <michaelestner@web.de>
Signed-off-by: Phil Sutter <phil@nwl.cc>
Diffstat (limited to 'iptables')
| -rw-r--r-- | iptables/nft-bridge.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c index 922ce983..f4a3c69a 100644 --- a/iptables/nft-bridge.c +++ b/iptables/nft-bridge.c @@ -373,9 +373,9 @@ static bool nft_bridge_is_same(const struct iptables_command_state *cs_a, int i; if (a->ethproto != b->ethproto || - /* FIXME: a->flags != b->flags || */ + a->bitmask != b->bitmask || a->invflags != b->invflags) { - DEBUGP("different proto/flags/invflags\n"); + DEBUGP("different proto/bitmask/invflags\n"); return false; } |