netfilter: ipset: use unified from/to address masking and check the usage

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>

diff --git a/include/linux/netfilter/ipset/pfxlen.h b/include/linux/netfilter/ipset/pfxlen.h
index 84efa3351e0e62896e05b3937c442fcf0ad2b2db..d55a6ccf662e0b20441e9c04bb6efe04a8d63917 100644 (file)
--- a/include/linux/netfilter/ipset/pfxlen.h
+++ b/include/linux/netfilter/ipset/pfxlen.h
@@ -35,4 +35,10 @@ ip_set_hostmask6(u8 pfxlen)
 
 extern u32 ip_set_range_to_cidr(u32 from, u32 to, u8 *cidr);
 
+#define ip_set_mask_from_to(from, to, cidr)    \
+do {                                           \
+       from &= ip_set_hostmask(cidr);          \
+       to = from | ~ip_set_hostmask(cidr);     \
+} while (0)
+
 #endif /*_PFXLEN_H */

diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c
index 49323110560c839ea557e65218ac1e39cd2c611b..c46e3440159780a2fb809c4a7d3eab139362f9e8 100644 (file)
--- a/net/netfilter/ipset/ip_set_bitmap_ip.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ip.c
@@ -283,8 +283,7 @@ bitmap_ip_uadt(struct ip_set *set, struct nlattr *tb[],
 
                if (cidr > 32)
                        return -IPSET_ERR_INVALID_CIDR;
-               ip &= ip_set_hostmask(cidr);
-               ip_to = ip | ~ip_set_hostmask(cidr);
+               ip_set_mask_from_to(ip, ip_to, cidr);
        } else
                ip_to = ip;
 
@@ -478,8 +477,7 @@ bitmap_ip_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
 
                if (cidr >= 32)
                        return -IPSET_ERR_INVALID_CIDR;
-               first_ip &= ip_set_hostmask(cidr);
-               last_ip = first_ip | ~ip_set_hostmask(cidr);
+               ip_set_mask_from_to(first_ip, last_ip, cidr);
        } else
                return -IPSET_ERR_PROTOCOL;
 

diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
index 5deb7bb3746808c155719e4e6c1fb05847f860a4..aa2cfa1ed474d9b8d6830a69347163d6885df369 100644 (file)
--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
@@ -578,7 +578,7 @@ bitmap_ipmac_create(struct ip_set *set, struct nlattr *tb[],
 
                if (cidr >= 32)
                        return -IPSET_ERR_INVALID_CIDR;
-               last_ip = first_ip | ~ip_set_hostmask(cidr);
+               ip_set_mask_from_to(first_ip, last_ip, cidr);
        } else
                return -IPSET_ERR_PROTOCOL;
 

diff --git a/net/netfilter/ipset/ip_set_hash_ip.c b/net/netfilter/ipset/ip_set_hash_ip.c
index c3bc06d353d3fb998950c744ef0708baa7125456..bdb432e22a8ae8783cddc7d7c060237f71e5a828 100644 (file)
--- a/net/netfilter/ipset/ip_set_hash_ip.c
+++ b/net/netfilter/ipset/ip_set_hash_ip.c
@@ -177,8 +177,7 @@ hash_ip4_uadt(struct ip_set *set, struct nlattr *tb[],
 
                if (cidr > 32)
                        return -IPSET_ERR_INVALID_CIDR;
-               ip &= ip_set_hostmask(cidr);
-               ip_to = ip | ~ip_set_hostmask(cidr);
+               ip_set_mask_from_to(ip, ip_to, cidr);
        } else
                ip_to = ip;
 

diff --git a/net/netfilter/ipset/ip_set_hash_ipport.c b/net/netfilter/ipset/ip_set_hash_ipport.c
index de2e351034a1ba143900f16a05ddc86860de8172..bdeb7160508075f960bacc50786174b88c0c9034 100644 (file)
--- a/net/netfilter/ipset/ip_set_hash_ipport.c
+++ b/net/netfilter/ipset/ip_set_hash_ipport.c
@@ -216,8 +216,7 @@ hash_ipport4_uadt(struct ip_set *set, struct nlattr *tb[],
 
                if (cidr > 32)
                        return -IPSET_ERR_INVALID_CIDR;
-               ip &= ip_set_hostmask(cidr);
-               ip_to = ip | ~ip_set_hostmask(cidr);
+               ip_set_mask_from_to(ip, ip_to, cidr);
        } else
                ip_to = ip;
 

diff --git a/net/netfilter/ipset/ip_set_hash_ipportip.c b/net/netfilter/ipset/ip_set_hash_ipportip.c
index 031ed057c81128faf41b5c6dc11e97228ba295f9..fb986fc6a6f2bd62fc14b748b05595091058799c 100644 (file)
--- a/net/netfilter/ipset/ip_set_hash_ipportip.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportip.c
@@ -224,8 +224,7 @@ hash_ipportip4_uadt(struct ip_set *set, struct nlattr *tb[],
 
                if (cidr > 32)
                        return -IPSET_ERR_INVALID_CIDR;
-               ip &= ip_set_hostmask(cidr);
-               ip_to = ip | ~ip_set_hostmask(cidr);
+               ip_set_mask_from_to(ip, ip_to, cidr);
        } else
                ip_to = ip;
 

diff --git a/net/netfilter/ipset/ip_set_hash_ipportnet.c b/net/netfilter/ipset/ip_set_hash_ipportnet.c
index ef068b03ec1a6e598ff5c760f410d8bacb0c407d..2ed5e758105580253b42c90cfa4a356be7491baf 100644 (file)
--- a/net/netfilter/ipset/ip_set_hash_ipportnet.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportnet.c
@@ -254,8 +254,7 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
 
                if (cidr > 32)
                        return -IPSET_ERR_INVALID_CIDR;
-               ip &= ip_set_hostmask(cidr);
-               ip_to = ip | ~ip_set_hostmask(cidr);
+               ip_set_mask_from_to(ip, ip_to, cidr);
        }
 
        port_to = port = ntohs(data.port);
@@ -273,8 +272,7 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
                if (ip2_from + UINT_MAX == ip2_to)
                        return -IPSET_ERR_HASH_RANGE;
        } else {
-               ip2_from &= ip_set_hostmask(data.cidr);
-               ip2_to = ip2_from | ~ip_set_hostmask(data.cidr);
+               ip_set_mask_from_to(ip2_from, ip2_to, data.cidr);
        }
 
        if (retried)

diff --git a/net/netfilter/ipset/ip_set_hash_netport.c b/net/netfilter/ipset/ip_set_hash_netport.c
index 300103096879fa826e91d0efa201e863e0f12042..90adc2c30665f1e3ad6ad67876d8dfeb207b054d 100644 (file)
--- a/net/netfilter/ipset/ip_set_hash_netport.c
+++ b/net/netfilter/ipset/ip_set_hash_netport.c
@@ -245,8 +245,7 @@ hash_netport4_uadt(struct ip_set *set, struct nlattr *tb[],
                if (ip + UINT_MAX == ip_to)
                        return -IPSET_ERR_HASH_RANGE;
        } else {
-               ip &= ip_set_hostmask(data.cidr);
-               ip_to = ip | ~ip_set_hostmask(data.cidr);
+               ip_set_mask_from_to(ip, ip_to, data.cidr);
        }
 
        if (retried)