From 044fcf5f4c1e94e0c57876b2a98fc4a7975498d0 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Fri, 31 May 2013 17:35:41 +0200 Subject: conntrack, expect: fix _cmp api with STRICT checking Normal comparision succeeds when the _common_ attribute subset have same values. When STRICT matching is specified, the comparision should succeed only when both objects have same attribute subset and attribute values match. However, STRICT comparision often fails as an attribute missing in both objects is erronously considered an error. Signed-off-by: Florian Westphal --- src/conntrack/compare.c | 6 +++++- src/expect/compare.c | 7 ++++++- 2 files changed, 11 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/conntrack/compare.c b/src/conntrack/compare.c index e282a24..97c25cb 100644 --- a/src/conntrack/compare.c +++ b/src/conntrack/compare.c @@ -17,8 +17,12 @@ static int __cmp(int attr, const struct nf_conntrack *ct2, unsigned int flags)) { - if (test_bit(attr, ct1->head.set) && test_bit(attr, ct2->head.set)) { + int a = test_bit(attr, ct1->head.set); + int b = test_bit(attr, ct2->head.set); + if (a && b) { return cmp(ct1, ct2, flags); + } else if (!a && !b) { + return 1; } else if (flags & NFCT_CMP_MASK && test_bit(attr, ct1->head.set)) { return 0; diff --git a/src/expect/compare.c b/src/expect/compare.c index a524f4c..484d7b1 100644 --- a/src/expect/compare.c +++ b/src/expect/compare.c @@ -18,8 +18,13 @@ static int exp_cmp(int attr, const struct nf_expect *exp2, unsigned int flags)) { - if (test_bit(attr, exp1->set) && test_bit(attr, exp2->set)) { + int a = test_bit(attr, exp1->set); + int b = test_bit(attr, exp2->set); + + if (a && b) { return cmp(exp1, exp2, flags); + } else if (!a && !b) { + return 1; } else if (flags & NFCT_CMP_MASK && test_bit(attr, exp1->set)) { return 0; -- cgit v1.2.3