diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2025-02-22 00:32:11 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2025-06-17 11:28:43 +0200 |
| commit | 0a7411e2525dddfec7d9094b99d5a71368241f7a (patch) | |
| tree | bf63cdb253f25ea90a5ed9fa42381ecd50aac4d6 | |
| parent | 8d1e2d3efc30f87c146c7c12dac1b3c3636c854a (diff) | |
evaluate: optimize zero length range
commit deda274293f80f9718de4cbb416bd2b2bf296709 upstream.
A rule like the following:
... tcp dport 22-22 ...
results in a range expression to match from 22 to 22.
Simplify to singleton value so a cmp is used instead.
This optimization already exists in set elements which might explain
this overlook.
Fixes: 7a6e16040d65 ("evaluate: allow for zero length ranges")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| -rw-r--r-- | src/evaluate.c | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/src/evaluate.c b/src/evaluate.c index 1578d440..4a4ccc1f 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1204,12 +1204,12 @@ static int __expr_evaluate_range(struct eval_ctx *ctx, struct expr **expr) return 0; } -static int expr_evaluate_range(struct eval_ctx *ctx, struct expr **expr) +static int expr_evaluate_range(struct eval_ctx *ctx, struct expr **exprp) { - struct expr *range = *expr, *left, *right; + struct expr *range = *exprp, *left, *right; int rc; - rc = __expr_evaluate_range(ctx, expr); + rc = __expr_evaluate_range(ctx, exprp); if (rc) return rc; @@ -1219,6 +1219,12 @@ static int expr_evaluate_range(struct eval_ctx *ctx, struct expr **expr) if (mpz_cmp(left->value, right->value) > 0) return expr_error(ctx->msgs, range, "Range negative size"); + if (mpz_cmp(left->value, right->value) == 0) { + *exprp = expr_get(left); + expr_free(range); + return 0; + } + datatype_set(range, left->dtype); range->flags |= EXPR_F_CONSTANT; return 0; |