diff options
author | Florian Westphal <fw@strlen.de> | 2022-09-23 14:17:08 +0200 |
---|---|---|
committer | Florian Westphal <fw@strlen.de> | 2022-09-28 11:53:56 +0200 |
commit | f315af1cf88714702dcc51dc00b109df3d52e9e9 (patch) | |
tree | de364dc9be3a87e7e7a7d6797e23edb1733876b8 /iptables/tests/shell/testcases/ebtables/0003-ebtables-restore-defaults_0 | |
parent | d1aa01483b5cac8c70c9385033e60efd7a744e1f (diff) |
nft: track each register individually
Instead of assuming only one register is used, track all 16 regs
individually.
This avoids need for the 'PREV_PAYLOAD' hack and also avoids the need to
clear out old flags:
When we see that register 'x' will be written to, that register state is
reset automatically.
Existing dissector decodes
ip saddr 1.2.3.4 meta l4proto tcp
... as
-s 6.0.0.0 -p tcp
iptables-nft -s 1.2.3.4 -p tcp is decoded correctly because the expressions
are ordered like:
meta l4proto tcp ip saddr 1.2.3.4
|
... and 'meta l4proto' did clear the PAYLOAD flag.
The simpler fix is:
ctx->flags &= ~NFT_XT_CTX_PAYLOAD;
in nft_parse_cmp(), but that breaks dissection of '1-42', because
the second compare ('cmp lte 42') will not find the
payload expression anymore.
Link: https://lore.kernel.org/netfilter-devel/20220922143544.GA22541@breakpoint.cc/T/#t
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Phil Sutter <phil@nwl.cc>
Diffstat (limited to 'iptables/tests/shell/testcases/ebtables/0003-ebtables-restore-defaults_0')
0 files changed, 0 insertions, 0 deletions