Re: [PATCH 1/1] payload: only merge if adjacent and combined size fits into a register

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Sat, Apr 16, 2016 at 03:17:56PM +0200, Arturo Borrero Gonzalez wrote:
> On 15 April 2016 at 15:09, Florian Westphal <fw@strlen.de> wrote:
> > add rule ip6 filter input ip6 saddr ::1/128 ip6 daddr ::1/128 fails,
> > we ask to compare a 32byte immediate which is not supported:
> >
> >   [ payload load 32b @ network header + 8 => reg 1 ]
> >   [ cmp eq reg 1 0x00000000 0x00000000 0x00000000 0x01000000 0x00000000 0x00000000 0x00000000 0x02000000 ]
> >
> > We would need to use two cmps in this case, i.e.:
> >
> >   [ payload load 32b @ network header + 8 => reg 1 ]
> >   [ cmp eq reg 1 0x00000000 0x00000000 0x00000000 0x01000000 ]
> >   [ cmp eq reg 2 0x00000000 0x00000000 0x00000000 0x02000000 ]
> >
> > Seems however that this requires a bit more changes to how nft
> > handles register allocations, we'd also need to undo the constant merge.
> >
> > Lets disable merging for now so that we generate
> >
> >   [ payload load 16b @ network header + 8 => reg 1 ]
> >   [ cmp eq reg 1 0x00000000 0x00000000 0x00000000 0x01000000 ]
> >   [ payload load 16b @ network header + 24 => reg 1 ]
> >   [ cmp eq reg 1 0x00000000 0x00000000 0x00000000 0x02000000 ]
> >
> > ... if merge would bring us over the 128 bit register size.
> >
> > Closes: http://bugzilla.netfilter.org/show_bug.cgi?id=1032
> > Signed-off-by: Florian Westphal <fw@strlen.de>
> > ---
> >  include/payload.h               |  2 +-
> >  src/payload.c                   | 27 ++++++++++++++++++++-------
> >  src/rule.c                      |  2 +-
> >  tests/py/ip6/ip6.t              |  1 +
> >  tests/py/ip6/ip6.t.payload.inet |  9 +++++++++
> >  tests/py/ip6/ip6.t.payload.ip6  |  7 +++++++
> >  6 files changed, 39 insertions(+), 9 deletions(-)
> >
> 
> Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>

Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>