[PATCH] iptables: fix the dead loop when meeting unknown options

[PATCH] iptables: fix the dead loop when meeting unknown options

[Changli Gao]

Signed-off-by: Changli Gao <xiaosuo@gmail.com>
---
 xshared.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/xshared.c b/xshared.c
index 404a9f5..87402b4 100644
--- a/xshared.c
+++ b/xshared.c
@@ -92,7 +92,7 @@ static bool should_load_proto(struct iptables_command_state *cs)
 	if (find_proto(cs->protocol, XTF_DONT_LOAD,
 	    cs->options & OPT_NUMERIC, NULL) == NULL)
 		return true;
-	return cs->proto_used;
+	return !cs->proto_used;
 }
 
 struct xtables_match *load_proto(struct iptables_command_state *cs)

Re: [PATCH] iptables: fix the dead loop when meeting unknown options

[Jan Engelhardt]

On Monday 2011-03-14 07:23, Changli Gao wrote:

>Signed-off-by: Changli Gao <xiaosuo@gmail.com>
>---
> xshared.c |    2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>diff --git a/xshared.c b/xshared.c
>index 404a9f5..87402b4 100644
>--- a/xshared.c
>+++ b/xshared.c
>@@ -92,7 +92,7 @@ static bool should_load_proto(struct iptables_command_state *cs)
> 	if (find_proto(cs->protocol, XTF_DONT_LOAD,
> 	    cs->options & OPT_NUMERIC, NULL) == NULL)
> 		return true;
>-	return cs->proto_used;
>+	return !cs->proto_used;
> }

Could you, for completeness, give the command that causes the infinite 
loop?

thanks,
Jan

Re: [PATCH] iptables: fix the dead loop when meeting unknown options

[Changli Gao]

On Thu, Apr 14, 2011 at 3:20 PM, Jan Engelhardt <jengelh@medozas.de> wrote:
> On Monday 2011-03-14 07:23, Changli Gao wrote:
>
>>Signed-off-by: Changli Gao <xiaosuo@gmail.com>
>>---
>> xshared.c |    2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>diff --git a/xshared.c b/xshared.c
>>index 404a9f5..87402b4 100644
>>--- a/xshared.c
>>+++ b/xshared.c
>>@@ -92,7 +92,7 @@ static bool should_load_proto(struct iptables_command_state *cs)
>>       if (find_proto(cs->protocol, XTF_DONT_LOAD,
>>           cs->options & OPT_NUMERIC, NULL) == NULL)
>>               return true;
>>-      return cs->proto_used;
>>+      return !cs->proto_used;
>> }
>
> Could you, for completeness, give the command that causes the infinite
> loop?
>

I can't remember it clearly. At that time, I was testing connlimit.
Maybe a spell mistake in the option list for connlimit. You can refer
to the comment above the code, and the code isn't consistent with the
comment. This bug maybe just a typo by you. :)

-- 
Regards,
Changli Gao(xiaosuo@gmail.com)
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html