aboutsummaryrefslogtreecommitdiffstats
path: root/net/netfilter
diff options
context:
space:
mode:
authorJozsef Kadlecsik <kadlec@blackhole.kfki.hu>2011-04-13 13:43:23 +0200
committerPatrick McHardy <kaber@trash.net>2011-04-13 13:43:23 +0200
commit0e8a835aa59d08d702af0fcfd296e2218b2e344b (patch)
treecfc99302895c328a9f394ead9695e8e99ac92de1 /net/netfilter
parentb32e3dc7860d00124fa432dba09667e647cb9bcc (diff)
downloadkernel_samsung_smdk4412-0e8a835aa59d08d702af0fcfd296e2218b2e344b.zip
kernel_samsung_smdk4412-0e8a835aa59d08d702af0fcfd296e2218b2e344b.tar.gz
kernel_samsung_smdk4412-0e8a835aa59d08d702af0fcfd296e2218b2e344b.tar.bz2
netfilter: ipset: bitmap:ip,mac type requires "src" for MAC
Enforce that the second "src/dst" parameter of the set match and SET target must be "src", because we have access to the source MAC only in the packet. The previous behaviour, that the type required the second parameter but actually ignored the value was counter-intuitive and confusing. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Patrick McHardy <kaber@trash.net>
Diffstat (limited to 'net/netfilter')
-rw-r--r--net/netfilter/ipset/ip_set_bitmap_ipmac.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
index 00a3324..a274300 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
@@ -343,6 +343,10 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb,
ipset_adtfn adtfn = set->variant->adt[adt];
struct ipmac data;
+ /* MAC can be src only */
+ if (!(flags & IPSET_DIM_TWO_SRC))
+ return 0;
+
data.id = ntohl(ip4addr(skb, flags & IPSET_DIM_ONE_SRC));
if (data.id < map->first_ip || data.id > map->last_ip)
return -IPSET_ERR_BITMAP_RANGE;