diff options
| author | Phil Sutter <phil@nwl.cc> | 2020-10-02 09:44:38 +0200 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2020-11-04 15:39:23 +0100 |
| commit | 323259001d617ae359430a03ee3d3e7f107684e0 (patch) | |
| tree | bb45b44cc1208b2e5607bdcd11d447db8e119cad /iptables/nft-arp.c | |
| parent | 06a2eb727b0f350fcfea95839fc8c4674763a35d (diff) | |
nft: Optimize class-based IP prefix matches
Payload expression works on byte-boundaries, leverage this with suitable
prefix lengths.
Signed-off-by: Phil Sutter <phil@nwl.cc>
Diffstat (limited to 'iptables/nft-arp.c')
| -rw-r--r-- | iptables/nft-arp.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c index 67f4529d..952f0c69 100644 --- a/iptables/nft-arp.c +++ b/iptables/nft-arp.c @@ -303,7 +303,8 @@ static bool nft_arp_parse_devaddr(struct nft_xt_ctx *ctx, memcpy(info->mask, ctx->bitwise.mask, ETH_ALEN); ctx->flags &= ~NFT_XT_CTX_BITWISE; } else { - memset(info->mask, 0xff, ETH_ALEN); + memset(info->mask, 0xff, + min(ctx->payload.len, ETH_ALEN)); } return inv; @@ -360,7 +361,9 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx, parse_mask_ipv4(ctx, &fw->arp.smsk); ctx->flags &= ~NFT_XT_CTX_BITWISE; } else { - fw->arp.smsk.s_addr = 0xffffffff; + memset(&fw->arp.smsk, 0xff, + min(ctx->payload.len, + sizeof(struct in_addr))); } if (inv) @@ -380,7 +383,9 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx, parse_mask_ipv4(ctx, &fw->arp.tmsk); ctx->flags &= ~NFT_XT_CTX_BITWISE; } else { - fw->arp.tmsk.s_addr = 0xffffffff; + memset(&fw->arp.tmsk, 0xff, + min(ctx->payload.len, + sizeof(struct in_addr))); } if (inv) |