Commit 1ed9887e authored by Gao Feng's avatar Gao Feng Committed by Pablo Neira Ayuso

netfilter: xt_multiport: Fix wrong unmatch result with multiple ports

I lost one test case in the last commit for xt_multiport.
For example, the rule is "-m multiport --dports 22,80,443".
When first port is unmatched and the second is matched, the curent codes
could not return the right result.
It would return false directly when the first port is unmatched.

Fixes: dd2602d0 ("netfilter: xt_multiport: Use switch case instead
of multiple condition checks")
Signed-off-by: default avatarGao Feng <fgao@ikuai8.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 18140969
...@@ -44,12 +44,18 @@ ports_match_v1(const struct xt_multiport_v1 *minfo, ...@@ -44,12 +44,18 @@ ports_match_v1(const struct xt_multiport_v1 *minfo,
switch (minfo->flags) { switch (minfo->flags) {
case XT_MULTIPORT_SOURCE: case XT_MULTIPORT_SOURCE:
return (src >= s && src <= e) ^ minfo->invert; if (src >= s && src <= e)
return true ^ minfo->invert;
break;
case XT_MULTIPORT_DESTINATION: case XT_MULTIPORT_DESTINATION:
return (dst >= s && dst <= e) ^ minfo->invert; if (dst >= s && dst <= e)
return true ^ minfo->invert;
break;
case XT_MULTIPORT_EITHER: case XT_MULTIPORT_EITHER:
return ((dst >= s && dst <= e) || if ((dst >= s && dst <= e) ||
(src >= s && src <= e)) ^ minfo->invert; (src >= s && src <= e))
return true ^ minfo->invert;
break;
default: default:
break; break;
} }
...@@ -59,11 +65,17 @@ ports_match_v1(const struct xt_multiport_v1 *minfo, ...@@ -59,11 +65,17 @@ ports_match_v1(const struct xt_multiport_v1 *minfo,
switch (minfo->flags) { switch (minfo->flags) {
case XT_MULTIPORT_SOURCE: case XT_MULTIPORT_SOURCE:
return (src == s) ^ minfo->invert; if (src == s)
return true ^ minfo->invert;
break;
case XT_MULTIPORT_DESTINATION: case XT_MULTIPORT_DESTINATION:
return (dst == s) ^ minfo->invert; if (dst == s)
return true ^ minfo->invert;
break;
case XT_MULTIPORT_EITHER: case XT_MULTIPORT_EITHER:
return (src == s || dst == s) ^ minfo->invert; if (src == s || dst == s)
return true ^ minfo->invert;
break;
default: default:
break; break;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment