Messages in this thread | | | Date | Wed, 02 Sep 2009 16:54:09 +0200 | From | Patrick McHardy <> | Subject | Re: [PATCH 1/3] netfilter: xt_ipvs (netfilter matcher for IPVS) |
| |
Hannes Eder wrote: > This implements the kernel-space side of the netfilter matcher > xt_ipvs.
Looks mostly fine to me, just one question:
> +bool ipvs_mt(const struct sk_buff *skb, const struct xt_match_param *par) > +{ > + const struct xt_ipvs *data = par->matchinfo; > + const u_int8_t family = par->family; > + struct ip_vs_iphdr iph; > + struct ip_vs_protocol *pp; > + struct ip_vs_conn *cp; > + int af; > + bool match = true; > + > + if (data->bitmask == XT_IPVS_IPVS_PROPERTY) { > + match = skb->ipvs_property ^ > + !!(data->invert & XT_IPVS_IPVS_PROPERTY); > + goto out; > + } > + > + /* other flags than XT_IPVS_IPVS_PROPERTY are set */ > + if (!skb->ipvs_property) { > + match = false; > + goto out; > + } > + > + switch (skb->protocol) { > + case htons(ETH_P_IP): > + af = AF_INET; > + break; > +#ifdef CONFIG_IP_VS_IPV6 > + case htons(ETH_P_IPV6): > + af = AF_INET6; > + break; > +#endif > + default: > + match = false; > + goto out; > + }
In the NF_INET_LOCAL_OUT hook skb->protocol is invalid. So if you don't need this, it would make sense to restrict the match to the other hooks.
Even easier would be to use par->family, which contains the address family and doesn't need any translation.
| |