From e20eac092725c982387181f3df557877b02eb345 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Fri, 15 Apr 2016 15:09:39 +0200 Subject: payload: only merge if adjacent and combined size fits into a register add rule ip6 filter input ip6 saddr ::1/128 ip6 daddr ::1/128 fails, we ask to compare a 32byte immediate which is not supported: [ payload load 32b @ network header + 8 => reg 1 ] [ cmp eq reg 1 0x00000000 0x00000000 0x00000000 0x01000000 0x00000000 0x00000000 0x00000000 0x02000000 ] We would need to use two cmps in this case, i.e.: [ payload load 32b @ network header + 8 => reg 1 ] [ cmp eq reg 1 0x00000000 0x00000000 0x00000000 0x01000000 ] [ cmp eq reg 2 0x00000000 0x00000000 0x00000000 0x02000000 ] Seems however that this requires a bit more changes to how nft handles register allocations, we'd also need to undo the constant merge. Lets disable merging for now so that we generate [ payload load 16b @ network header + 8 => reg 1 ] [ cmp eq reg 1 0x00000000 0x00000000 0x00000000 0x01000000 ] [ payload load 16b @ network header + 24 => reg 1 ] [ cmp eq reg 1 0x00000000 0x00000000 0x00000000 0x02000000 ] ... if merge would bring us over the 128 bit register size. Closes: http://bugzilla.netfilter.org/show_bug.cgi?id=1032 Signed-off-by: Florian Westphal Acked-by: Arturo Borrero Gonzalez Acked-by: Pablo Neira Ayuso --- include/payload.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/payload.h b/include/payload.h index a19e6906..fae3c673 100644 --- a/include/payload.h +++ b/include/payload.h @@ -17,7 +17,7 @@ extern int payload_gen_dependency(struct eval_ctx *ctx, const struct expr *expr, extern int exthdr_gen_dependency(struct eval_ctx *ctx, const struct expr *expr, struct stmt **res); -extern bool payload_is_adjacent(const struct expr *e1, const struct expr *e2); +extern bool payload_can_merge(const struct expr *e1, const struct expr *e2); extern struct expr *payload_expr_join(const struct expr *e1, const struct expr *e2); -- cgit v1.2.3