3 files changed, 47 insertions, 26 deletions

diff --git a/include/net/netfilter/nf_conntrack_expect.h b/include/net/netfilter/nf_conntrack_expect.h
index c0b1d1fb23e1..13643f7f7422 100644
--- a/include/net/netfilter/nf_conntrack_expect.h
+++ b/include/net/netfilter/nf_conntrack_expect.h
@@ -16,7 +16,8 @@ struct nf_conntrack_expect
         struct list_head list;
 
         /* We expect this tuple, with the following mask */
-        struct nf_conntrack_tuple tuple, mask;
+        struct nf_conntrack_tuple tuple;
+        struct nf_conntrack_tuple_mask mask;
 
         /* Function to call after setup and insertion */
         void (*expectfn)(struct nf_conn *new,
diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h
index b43a75ba44ac..d62e6f093af4 100644
--- a/include/net/netfilter/nf_conntrack_helper.h
+++ b/include/net/netfilter/nf_conntrack_helper.h
@@ -24,10 +24,9 @@ struct nf_conntrack_helper
                                          * expected connections */
         unsigned int timeout;           /* timeout for expecteds */
 
-        /* Mask of things we will help (compared against server response) */
+        /* Tuple of things we will help (compared against server response) */
         struct nf_conntrack_tuple tuple;
-        struct nf_conntrack_tuple mask;
-        
+
         /* Function to call when data passes; return verdict, or -1 to
            invalidate. */
         int (*help)(struct sk_buff **pskb,
diff --git a/include/net/netfilter/nf_conntrack_tuple.h b/include/net/netfilter/nf_conntrack_tuple.h
index d02ce876b4ca..99934ab538e6 100644
--- a/include/net/netfilter/nf_conntrack_tuple.h
+++ b/include/net/netfilter/nf_conntrack_tuple.h
@@ -100,6 +100,14 @@ struct nf_conntrack_tuple
         } dst;
 };
 
+struct nf_conntrack_tuple_mask
+{
+        struct {
+                union nf_conntrack_address u3;
+                union nf_conntrack_man_proto u;
+        } src;
+};
+
 /* This is optimized opposed to a memset of the whole structure.  Everything we
  * really care about is the  source/destination unions */
 #define NF_CT_TUPLE_U_BLANK(tuple)                                      \
@@ -161,31 +169,44 @@ static inline int nf_ct_tuple_equal(const struct nf_conntrack_tuple *t1,
         return nf_ct_tuple_src_equal(t1, t2) && nf_ct_tuple_dst_equal(t1, t2);
 }
 
+static inline int nf_ct_tuple_mask_equal(const struct nf_conntrack_tuple_mask *m1,
+                                         const struct nf_conntrack_tuple_mask *m2)
+{
+        return (m1->src.u3.all[0] == m2->src.u3.all[0] &&
+                m1->src.u3.all[1] == m2->src.u3.all[1] &&
+                m1->src.u3.all[2] == m2->src.u3.all[2] &&
+                m1->src.u3.all[3] == m2->src.u3.all[3] &&
+                m1->src.u.all == m2->src.u.all);
+}
+
+static inline int nf_ct_tuple_src_mask_cmp(const struct nf_conntrack_tuple *t1,
+                                           const struct nf_conntrack_tuple *t2,
+                                           const struct nf_conntrack_tuple_mask *mask)
+{
+        int count;
+
+        for (count = 0; count < NF_CT_TUPLE_L3SIZE; count++) {
+                if ((t1->src.u3.all[count] ^ t2->src.u3.all[count]) &
+                    mask->src.u3.all[count])
+                        return 0;
+        }
+
+        if ((t1->src.u.all ^ t2->src.u.all) & mask->src.u.all)
+                return 0;
+
+        if (t1->src.l3num != t2->src.l3num ||
+            t1->dst.protonum != t2->dst.protonum)
+                return 0;
+
+        return 1;
+}
+
 static inline int nf_ct_tuple_mask_cmp(const struct nf_conntrack_tuple *t,
                                        const struct nf_conntrack_tuple *tuple,
-                                       const struct nf_conntrack_tuple *mask)
+                                       const struct nf_conntrack_tuple_mask *mask)
 {
-        int count = 0;
-
-        for (count = 0; count < NF_CT_TUPLE_L3SIZE; count++){
-                if ((t->src.u3.all[count] ^ tuple->src.u3.all[count]) &
-                    mask->src.u3.all[count])
-                        return 0;
-        }
-
-        for (count = 0; count < NF_CT_TUPLE_L3SIZE; count++){
-                if ((t->dst.u3.all[count] ^ tuple->dst.u3.all[count]) &
-                    mask->dst.u3.all[count])
-                        return 0;
-        }
-
-        if ((t->src.u.all ^ tuple->src.u.all) & mask->src.u.all ||
-            (t->dst.u.all ^ tuple->dst.u.all) & mask->dst.u.all ||
-            (t->src.l3num ^ tuple->src.l3num) & mask->src.l3num ||
-            (t->dst.protonum ^ tuple->dst.protonum) & mask->dst.protonum)
-                return 0;
-
-        return 1;
+        return nf_ct_tuple_src_mask_cmp(t, tuple, mask) &&
+               nf_ct_tuple_dst_equal(t, tuple);
 }
 
 #endif /* _NF_CONNTRACK_TUPLE_H */