From: Florian Westphal Date: Fri, 16 Dec 2011 17:35:15 +0000 (+0100) Subject: netfilter: xt_connbytes: handle negation correctly X-Git-Tag: v3.2-rc7~7^2^2 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0354b48f633ae435acbc01b470a1ce8cfeff3e9f;p=pandora-kernel.git netfilter: xt_connbytes: handle negation correctly "! --connbytes 23:42" should match if the packet/byte count is not in range. As there is no explict "invert match" toggle in the match structure, userspace swaps the from and to arguments (i.e., as if "--connbytes 42:23" were given). However, "what <= 23 && what >= 42" will always be false. Change things so we use "||" in case "from" is larger than "to". This change may look like it breaks backwards compatibility when "to" is 0. However, older iptables binaries will refuse "connbytes 42:0", and current releases treat it to mean "! --connbytes 0:42", so we should be fine. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso --- Reading git-diff-tree failed