From a05009d5e798d7a7fc690511a1d4923c8bf98b50 Mon Sep 17 00:00:00 2001 From: Felix Fietkau <nbd@nbd.name> Date: Mon, 30 Oct 2017 16:17:48 +0530 Subject: [PATCH] netfilter: reduce match memory access Signed-off-by: Felix Fietkau <nbd@nbd.name> --- net/ipv4/netfilter/ip_tables.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c index e25b4469f..9574df2f7 100644 --- a/net/ipv4/netfilter/ip_tables.c +++ b/net/ipv4/netfilter/ip_tables.c @@ -61,9 +61,9 @@ ip_packet_match(const struct iphdr *ip, if (ipinfo->flags & IPT_F_NO_DEF_MATCH) return true; - if (NF_INVF(ipinfo, IPT_INV_SRCIP, + if (NF_INVF(ipinfo, IPT_INV_SRCIP, ipinfo->smsk.s_addr && (ip->saddr & ipinfo->smsk.s_addr) != ipinfo->src.s_addr) || - NF_INVF(ipinfo, IPT_INV_DSTIP, + NF_INVF(ipinfo, IPT_INV_DSTIP, ipinfo->dmsk.s_addr && (ip->daddr & ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr)) return false; -- GitLab