netfilter: x_tables: use correct integer types

Sparse complains because __be32 and u32 are mixed without
conversions.  Use the correct types, no code changes.

Furthermore, xt_DSCP generates a bit truncation warning:
"cast truncates bits from constant value (ffffff03 becomes 3)"

The truncation is fine (and wanted). Add a private definition and use that
instead.

objdiff shows no changes.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/xt_DSCP.c b/net/netfilter/xt_DSCP.c
index eababc3..cfa4451 100644 (file)
--- a/net/netfilter/xt_DSCP.c
+++ b/net/netfilter/xt_DSCP.c
@@ -24,6 +24,8 @@ MODULE_ALIAS("ip6t_DSCP");
 MODULE_ALIAS("ipt_TOS");
 MODULE_ALIAS("ip6t_TOS");
 
+#define XT_DSCP_ECN_MASK       3u
+
 static unsigned int
 dscp_tg(struct sk_buff *skb, const struct xt_action_param *par)
 {
@@ -34,8 +36,7 @@ dscp_tg(struct sk_buff *skb, const struct xt_action_param *par)
                if (skb_ensure_writable(skb, sizeof(struct iphdr)))
                        return NF_DROP;
 
-               ipv4_change_dsfield(ip_hdr(skb),
-                                   (__force __u8)(~XT_DSCP_MASK),
+               ipv4_change_dsfield(ip_hdr(skb), XT_DSCP_ECN_MASK,
                                    dinfo->dscp << XT_DSCP_SHIFT);
 
        }
@@ -52,8 +53,7 @@ dscp_tg6(struct sk_buff *skb, const struct xt_action_param *par)
                if (skb_ensure_writable(skb, sizeof(struct ipv6hdr)))
                        return NF_DROP;
 
-               ipv6_change_dsfield(ipv6_hdr(skb),
-                                   (__force __u8)(~XT_DSCP_MASK),
+               ipv6_change_dsfield(ipv6_hdr(skb), XT_DSCP_ECN_MASK,
                                    dinfo->dscp << XT_DSCP_SHIFT);
        }
        return XT_CONTINUE;

diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index 122db9f..116a885 100644 (file)
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -239,8 +239,8 @@ tcpmss_tg6(struct sk_buff *skb, const struct xt_action_param *par)
                oldlen = ipv6h->payload_len;
                newlen = htons(ntohs(oldlen) + ret);
                if (skb->ip_summed == CHECKSUM_COMPLETE)
-                       skb->csum = csum_add(csum_sub(skb->csum, oldlen),
-                                            newlen);
+                       skb->csum = csum_add(csum_sub(skb->csum, (__force __wsum)oldlen),
+                                            (__force __wsum)newlen);
                ipv6h->payload_len = newlen;
        }
        return XT_CONTINUE;

diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index 46fcac7..5d04ef8 100644 (file)
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -62,10 +62,10 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
                key[4] = zone->id;
        } else {
                const struct iphdr *iph = ip_hdr(skb);
-               key[0] = (info->flags & XT_CONNLIMIT_DADDR) ?
-                         iph->daddr : iph->saddr;
 
-               key[0] &= info->mask.ip;
+               key[0] = (info->flags & XT_CONNLIMIT_DADDR) ?
+                        (__force __u32)iph->daddr : (__force __u32)iph->saddr;
+               key[0] &= (__force __u32)info->mask.ip;
                key[1] = zone->id;
        }