cmp-exp.c

/*
 * (C) 2011 by Pablo Neira Ayuso <pablo@netfilter.org>
 * (C) 2011 by Vyatta <http://www.vyatta.com>
 *
 * This software may be used and distributed according to the terms
 * of the GNU General Public License, incorporated herein by reference.
 */

#include "internal/internal.h"

static int __cmp(int attr,
                 const struct nf_expect *exp1,
                 const struct nf_expect *exp2,
                 unsigned int flags,
                 int (*cmp)(const struct nf_expect *exp1,
                            const struct nf_expect *exp2,
                            unsigned int flags))
{
        if (test_bit(attr, exp1->set) && test_bit(attr, exp2->set)) {
                return cmp(ct1, ct2, flags);
        } else if (flags & NFCT_CMP_MASK &&
                   test_bit(attr, exp1->set)) {
                return 0;
        } else if (flags & NFCT_CMP_STRICT) {
                return 0;
        }
        return 1;
}

/* merge with cmp_timeout for ct's, put it in src/main.c. */
static int
cmp_timeout(const struct nf_expect *exp1,
            const struct nf_expect *exp2,
            unsigned int flags)
{
        int ret = 0;

#define __NFCT_CMP_TIMEOUT (NFCT_CMP_TIMEOUT_LE | NFCT_CMP_TIMEOUT_GT)

        if (!(flags & __NFCT_CMP_TIMEOUT) &&
            exp1->timeout != exp2->timeout)
                return 0;
        else {
                if (flags & NFCT_CMP_TIMEOUT_GT &&
                    exp1->timeout > exp2->timeout)
                        ret = 1;
                else if (flags & NFCT_CMP_TIMEOUT_LT &&
                         exp1->timeout < exp2->timeout)
                        ret = 1;
                else if (flags & NFCT_CMP_TIMEOUT_EQ &&
                         exp1->timeout == exp2->timeout)
                        ret = 1;

                if (ret == 0)
                        return 0;
        }
        return ret;
}

static int
cmp_status(const struct nf_conntrack *ct1,
           const struct nf_conntrack *ct2,
           unsigned int flags)
{
        return ((ct1->status & ct2->status) == ct1->status);
}

static int
cmp_zone(const struct nf_conntrack *ct1,
         const struct nf_conntrack *ct2,
         unsigned int flags)
{
        return (ct1->zone == ct2->zone);
}

static int cmp_meta(const struct nf_expect *exp1,
                    const struct nf_expect *exp2,
                    unsigned int flags)
{
        if (!__cmp(ATTR_EXP_TIMEOUT, exp1, exp2, flags, cmp_timeout))
                return 0;
        if (!__cmp(ATTR_EXP_FLAGS, exp1, exp2, flags, cmp_status))
                return 0;
        if (!__cmp(ATTR_EXP_ZONE, exp1, exp2, flags, cmp_zone))
                return 0;

        return 1;
}

int cmp_exp(const struct nf_expect *exp1, const struct nf_expect *exp2,
            unsigned int flags)
{
        const struct nf_conntrack *ct1, *ct2;

        ct1 = nfexp_get_attr(exp1, ATTR_EXP_MASTER);
        ct2 = nfexp_get_attr(exp2, ATTR_EXP_MASTER);

        if (!nfct_cmp(ct1, ct2, NFCT_CMP_ORIG|NFCT_CMP_REPL))
                return 0;

        ct1 = nfexp_get_attr(exp1, ATTR_EXP_EXPECTED);
        ct2 = nfexp_get_attr(exp2, ATTR_EXP_EXPECTED);

        if (!nfct_cmp(ct1, ct2, NFCT_CMP_ORIG))
                return 0;

        ct1 = nfexp_get_attr(exp1, ATTR_EXP_MASK);
        ct2 = nfexp_get_attr(exp2, ATTR_EXP_MASK);

        if (!nfct_cmp(ct1, ct2, NFCT_CMP_ORIG))
                return 0;

        if (flags & NFCT_CMP_META) {
                /* FIXME: missing comparison of zone and flags. */
        }

        return 1;
}