From 7736631fef63efde9c0fd68af89c3e2900286428 Mon Sep 17 00:00:00 2001 From: "/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org" Date: Tue, 24 Apr 2007 18:39:51 +0000 Subject: - fix compilation warning in snprintf.c - introduce the new compare infrastructure: much simple than previous - introduce nfct_maxsize for nf_conntrack object allocated in the stack - more strict checkings in nfct_set_attr: third parameter is const --- src/conntrack/compare.c | 102 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 102 insertions(+) create mode 100644 src/conntrack/compare.c (limited to 'src/conntrack/compare.c') diff --git a/src/conntrack/compare.c b/src/conntrack/compare.c new file mode 100644 index 0000000..0792a8a --- /dev/null +++ b/src/conntrack/compare.c @@ -0,0 +1,102 @@ +/* + * (C) 2007 by Pablo Neira Ayuso + * + * This software may be used and distributed according to the terms + * of the GNU General Public License, incorporated herein by reference. + */ + +#include "internal.h" + +int __compare(const struct nf_conntrack *ct1, + const struct nf_conntrack *ct2) +{ + if (test_bit(ATTR_MARK, ct1->set) && + test_bit(ATTR_MARK, ct2->set) && + ct1->mark != ct2->mark) + return 0; + + if (test_bit(ATTR_TIMEOUT, ct1->set) && + test_bit(ATTR_TIMEOUT, ct2->set) && + ct1->timeout != ct2->timeout) + return 0; + + if (test_bit(ATTR_STATUS, ct1->set) && + test_bit(ATTR_STATUS, ct2->set) && + ct1->status == ct2->status) + return 0; + + if (test_bit(ATTR_TCP_STATE, ct1->set) && + test_bit(ATTR_TCP_STATE, ct2->set) && + ct1->protoinfo.tcp.state != ct2->protoinfo.tcp.state) + return 0; + + if (test_bit(ATTR_ORIG_L3PROTO, ct1->set) && + test_bit(ATTR_ORIG_L3PROTO, ct2->set) && + ct1->tuple[__DIR_ORIG].l3protonum != AF_UNSPEC && + ct2->tuple[__DIR_ORIG].l3protonum != AF_UNSPEC && + ct1->tuple[__DIR_ORIG].l3protonum != + ct2->tuple[__DIR_ORIG].l3protonum) + return 0; + + if (test_bit(ATTR_REPL_L3PROTO, ct1->set) && + test_bit(ATTR_REPL_L3PROTO, ct2->set) && + ct1->tuple[__DIR_REPL].l3protonum != AF_UNSPEC && + ct2->tuple[__DIR_REPL].l3protonum != AF_UNSPEC && + ct1->tuple[__DIR_REPL].l3protonum != + ct2->tuple[__DIR_REPL].l3protonum) + return 0; + + if (test_bit(ATTR_ORIG_IPV4_SRC, ct1->set) && + test_bit(ATTR_ORIG_IPV4_SRC, ct2->set) && + ct1->tuple[__DIR_ORIG].src.v4 != + ct2->tuple[__DIR_ORIG].src.v4) + return 0; + + if (test_bit(ATTR_ORIG_IPV4_DST, ct1->set) && + test_bit(ATTR_ORIG_IPV4_DST, ct2->set) && + ct1->tuple[__DIR_ORIG].dst.v4 != + ct2->tuple[__DIR_ORIG].dst.v4) + return 0; + + if (test_bit(ATTR_REPL_IPV4_SRC, ct1->set) && + test_bit(ATTR_REPL_IPV4_SRC, ct2->set) && + ct1->tuple[__DIR_REPL].src.v4 != + ct2->tuple[__DIR_REPL].src.v4) + return 0; + + if (test_bit(ATTR_REPL_IPV4_DST, ct1->set) && + test_bit(ATTR_REPL_IPV4_DST, ct2->set) && + ct1->tuple[__DIR_REPL].dst.v4 != + ct2->tuple[__DIR_REPL].dst.v4) + return 0; + + if (test_bit(ATTR_ORIG_IPV6_SRC, ct1->set) && + test_bit(ATTR_ORIG_IPV6_SRC, ct2->set) && + memcmp(&ct1->tuple[__DIR_ORIG].src.v6, + &ct2->tuple[__DIR_ORIG].src.v6, + sizeof(u_int32_t)*4) == 0) + return 0; + + if (test_bit(ATTR_ORIG_IPV6_DST, ct1->set) && + test_bit(ATTR_ORIG_IPV6_DST, ct2->set) && + memcmp(&ct1->tuple[__DIR_ORIG].dst.v6, + &ct2->tuple[__DIR_ORIG].dst.v6, + sizeof(u_int32_t)*4) == 0) + return 0; + + if (test_bit(ATTR_REPL_IPV6_SRC, ct1->set) && + test_bit(ATTR_REPL_IPV6_SRC, ct2->set) && + memcmp(&ct1->tuple[__DIR_REPL].src.v6, + &ct2->tuple[__DIR_REPL].src.v6, + sizeof(u_int32_t)*4) == 0) + return 0; + + if (test_bit(ATTR_REPL_IPV6_DST, ct1->set) && + test_bit(ATTR_REPL_IPV6_DST, ct2->set) && + memcmp(&ct1->tuple[__DIR_REPL].dst.v6, + &ct2->tuple[__DIR_REPL].dst.v6, + sizeof(u_int32_t)*4) == 0) + return 0; + + return 1; +} -- cgit v1.2.3