tree 24ebd4da0fe7e239e45cbc5a4ec599ee1abba94d
parent a6a7b759ba62e62542308e091f7fc9cfac4f978e
author Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> 1311242778 +0200
committer Patrick McHardy <kaber@trash.net> 1311242778 +0200

netfilter: ipset: hash:net,iface fixed to handle overlapping nets behind different interfaces

If overlapping networks with different interfaces was added to
the set, the type did not handle it properly. Example

    ipset create test hash:net,iface
    ipset add test 192.168.0.0/16,eth0
    ipset add test 192.168.0.0/24,eth1

Now, if a packet was sent from 192.168.0.0/24,eth0, the type returned
a match.

In the patch the algorithm is fixed in order to correctly handle
overlapping networks.

Limitation: the same network cannot be stored with more than 64 different
interfaces in a single set.

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>