Commit db6d857b authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nft_quota: fix overquota logic 



Use xor to decide to break further rule evaluation or not, since the
existing logic doesn't achieve the expected inversion.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 0d9932b2

net/netfilter/nft_quota.c

+1 −1
Original line number Diff line number Diff line
@@ -33,7 +33,7 @@ static void nft_quota_eval(const struct nft_expr *expr, 
{

	struct nft_quota *priv = nft_expr_priv(expr);



	if (nft_quota(priv, pkt) < 0 && !priv->invert)

	if ((nft_quota(priv, pkt) < 0) ^ priv->invert)

		regs->verdict.code = NFT_BREAK;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE