summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2016-01-28 21:07:15 +0100
committerPablo Neira Ayuso <pablo@netfilter.org>2016-01-31 23:43:36 +0100
commitc177581efa78cce6384e306a2f2ee4b057ef6635 (patch)
treeee46a608a101751522a1f1ee196af7869617f98c
parent03dc38424bef6d5be472e28e0a26db3cd09960af (diff)
evaluate: generate ether type payload after meta iiftype
Once the meta iiftype is generated, we shouldn't return from resolve_protocol_conflict() since we also need to generate the ether type payload implicit match after it. This gets rid of the manual proto-ctx update from meta_iiftype_gen_dependency() that we don't need since stmt_evaluate() already handles this for us. Moreover, skip error reporting once we verify that the protocol conflict has been resolved. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-rw-r--r--src/evaluate.c17
1 files changed, 10 insertions, 7 deletions
diff --git a/src/evaluate.c b/src/evaluate.c
index e53627a5..ed78896a 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -360,10 +360,8 @@ conflict_resolution_gen_dependency(struct eval_ctx *ctx, int protocol,
* ether saddr adds another dependeny on ethernet frames.
*/
static int meta_iiftype_gen_dependency(struct eval_ctx *ctx,
- const struct proto_desc *have,
- struct expr *payload)
+ struct expr *payload, struct stmt **res)
{
- enum proto_bases base = payload->payload.base;
struct stmt *nstmt;
uint16_t type;
@@ -377,8 +375,7 @@ static int meta_iiftype_gen_dependency(struct eval_ctx *ctx,
return expr_error(ctx->msgs, payload,
"dependency statement is invalid");
- list_add_tail(&nstmt->list, &ctx->stmt->list);
- ctx->pctx.protocol[base].desc = payload->payload.desc;
+ *res = nstmt;
return 0;
}
@@ -409,9 +406,11 @@ static int resolve_protocol_conflict(struct eval_ctx *ctx,
if (payload->payload.base == PROTO_BASE_LL_HDR &&
proto_is_dummy(desc)) {
- err = meta_iiftype_gen_dependency(ctx, desc, payload);
- if (err <= 0)
+ err = meta_iiftype_gen_dependency(ctx, payload, &nstmt);
+ if (err < 0)
return err;
+
+ list_add_tail(&nstmt->list, &ctx->stmt->list);
}
assert(base < PROTO_BASE_MAX);
@@ -474,6 +473,10 @@ static int __expr_evaluate_payload(struct eval_ctx *ctx, struct expr *expr)
err = resolve_protocol_conflict(ctx, desc, payload);
if (err <= 0)
return err;
+
+ desc = ctx->pctx.protocol[base].desc;
+ if (desc == payload->payload.desc)
+ return 0;
}
return expr_error(ctx->msgs, payload,
"conflicting protocols specified: %s vs. %s",