From cc7b37d18a687d53e8724b3104b042e6767a9cef Mon Sep 17 00:00:00 2001 From: Anatole Denis Date: Thu, 24 Nov 2016 15:16:20 +0100 Subject: src: Interpret OP_NEQ against a set as OP_LOOKUP Now that the support for inverted matching is in the kernel and in libnftnl, add it to nftables too. This fixes bug #888 Signed-off-by: Anatole Denis Signed-off-by: Pablo Neira Ayuso --- src/evaluate.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'src/evaluate.c') diff --git a/src/evaluate.c b/src/evaluate.c index 51d644fe..c841aafd 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1526,6 +1526,20 @@ static int expr_evaluate_relational(struct eval_ctx *ctx, struct expr **expr) if (byteorder_conversion(ctx, &rel->right, left->byteorder) < 0) return -1; break; + case EXPR_SET: + assert(rel->op == OP_NEQ); + right = rel->right = + implicit_set_declaration(ctx, "__set%d", + left->dtype, left->len, + right); + /* fall through */ + case EXPR_SET_REF: + assert(rel->op == OP_NEQ); + /* Data for range lookups needs to be in big endian order */ + if (right->set->flags & SET_F_INTERVAL && + byteorder_conversion(ctx, &rel->left, BYTEORDER_BIG_ENDIAN) < 0) + return -1; + break; default: BUG("invalid expression type %s\n", right->ops->name); } -- cgit v1.2.3