Re: [PATCH] Incorrect xt_iprange boundary check for IPv6

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Saturday 2011-01-22 15:10, Thomas Jacob wrote:

>iprange_ipv6_sub was substracting 2 unsigned ints and then casting
>the result to int to find out whether they are lt, eq or gt each
>other, this doesn't work if the full 32 bits of each part
>can be used in IPv6 addresses. Patch should remedy that without
>significant performance penalties.

Correctness before speed ;)

The algo change looks ok to me, thanks for spotting.

> static inline int
>-iprange_ipv6_sub(const struct in6_addr *a, const struct in6_addr *b)
>+iprange_ipv6_lt(const struct in6_addr *a, const struct in6_addr *b)
> {
> 	unsigned int i;
>-	int r;
> 
> 	for (i = 0; i < 4; ++i) {
>-		r = ntohl(a->s6_addr32[i]) - ntohl(b->s6_addr32[i]);
>-		if (r != 0)
>-			return r;
>+		if(ntohl(a->s6_addr32[i]) != ntohl(b->s6_addr32[i]))
>+			return ntohl(a->s6_addr32[i]) < ntohl(b->s6_addr32[i]);
> 	}
> 
> 	return 0;
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux