Re: [PATCH] Incorrect xt_iprange boundary check for IPv6

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sun, 2011-01-23 at 14:53 +0100, Jozsef Kadlecsik wrote:
> > -			return r;
> > +		if(ntohl(a->s6_addr32[i]) != ntohl(b->s6_addr32[i]))
> > +			return ntohl(a->s6_addr32[i]) < ntohl(b->s6_addr32[i]);
> >  	}
> 
> Why do you convert to host order in the inequality test? It could be left 
> out.

Yes it can be, just a left over from the old code I suppose. Didn't
really thing about that ;)

But if we are talking about performance, what about the following
part:       

if (info->flags & IPRANGE_SRC) {
  m  = iprange_ipv6_lt(&iph->saddr, &info->src_min.in6);
  m |= iprange_ipv6_lt(&info->src_max.in6, &iph->saddr);
  m ^= !!(info->flags & IPRANGE_SRC_INV);
  if (m)
    return false;
}

Shouldn't this be  m ||= .. in the second call to iprange_ipv6_lt,
to allow for some short circuit optimizations? Or in order
to reduce the rather asymmetric behaviour then, shouldn't these two
function calls be merged into something like

static inline int
iprange_ipv6_cmp(const struct in6_addr *a, const struct in6_addr *b,  
   const struct in6_addr *x )
{
        unsigned int i;

        for (i = 0; i < 4; ++i) {
                if(x->s6_addr32[i] != a->s6_addr32[i])
                  return ntohl(x->s6_addr32[i])<ntohl(a->s6_addr32[i]);
                if(x->s6_addr32[i] != b->s6_addr32[i])
                  return ntohl(b->s6_addr32[i])<ntohl(x->s6_addr32[i]);
               
        }

        return 0;
}

Or would that be bad from a 1st level caching point of view?

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux