netfilter: xt_conntrack: fix inverted conntrack direction test
authorFlorian Westphal <fw@strlen.de>
Mon, 4 Apr 2011 15:06:21 +0000 (17:06 +0200)
committerPatrick McHardy <kaber@trash.net>
Mon, 4 Apr 2011 15:06:21 +0000 (17:06 +0200)
--ctdir ORIGINAL matches REPLY packets, and vv:

userspace sets "invert_flags &= ~XT_CONNTRACK_DIRECTION" in ORIGINAL
case.

Thus: (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^
      !!(info->invert_flags & XT_CONNTRACK_DIRECTION))

yields "1 ^ 0", which is true -> returns false.

Reproducer:
iptables -I OUTPUT 1 -p tcp --syn -m conntrack --ctdir ORIGINAL

Signed-off-by: Florian Westphal <fwestphal@astaro.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
net/netfilter/xt_conntrack.c

index 2c0086a..481a86f 100644 (file)
@@ -195,7 +195,7 @@ conntrack_mt(const struct sk_buff *skb, struct xt_action_param *par,
                return info->match_flags & XT_CONNTRACK_STATE;
        if ((info->match_flags & XT_CONNTRACK_DIRECTION) &&
            (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^
                return info->match_flags & XT_CONNTRACK_STATE;
        if ((info->match_flags & XT_CONNTRACK_DIRECTION) &&
            (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^
-           !!(info->invert_flags & XT_CONNTRACK_DIRECTION))
+           !(info->invert_flags & XT_CONNTRACK_DIRECTION))
                return false;
 
        if (info->match_flags & XT_CONNTRACK_ORIGSRC)
                return false;
 
        if (info->match_flags & XT_CONNTRACK_ORIGSRC)