dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

netfilter: ipset: hash:net,iface timeout bug fixed 

Timed out entries were still matched till the garbage collector
purged them out. The fix is verified in the testsuite.

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Jozsef Kadlecsik 2012-01-13 22:55:54 +01:00 committed by Pablo Neira Ayuso
parent 2a7cef2a4b
commit 7f81c951d9
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
include/linux/netfilter/ipset/ip_set_ahash.h
View File

@ -1005,9 +1005,17 @@ type_pf_ttest_cidrs(struct ip_set *set, struct type_pf_elem *d, u32 timeout)
n = hbucket(t, key);
for (i = 0; i < n->pos; i++) {
data = ahash_tdata(n, i);
#ifdef IP_SET_HASH_WITH_MULTI
if (type_pf_data_equal(data, d, &multi)) {
if (!type_pf_data_expired(data))
return type_pf_data_match(data);
multi = 0;
}
#else
if (type_pf_data_equal(data, d, &multi) &&
!type_pf_data_expired(data))
return type_pf_data_match(data);
#endif
}
}
return 0;