From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Tom Yan <tom.ty89@gmail.com>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: [PATCH nft 2/3] netlink_linearize: incorrect netlink bytecode with binary operation and flags
Date: Tue, 27 Jul 2021 23:05:03 +0200 [thread overview]
Message-ID: <20210727210503.GA15429@salvia> (raw)
In-Reply-To: <CAGnHSE=e-iYaz3KOMBq1JSVRd0HTL=TKQ_HHMadfyd2Nr8__yg@mail.gmail.com>
On Wed, Jul 28, 2021 at 02:36:18AM +0800, Tom Yan wrote:
> Hmm, that means `tcp flags & (fin | syn | rst | ack) syn` is now
> equivalent to 'tcp flags & (fin | syn | rst | ack) == syn'.
Yes, those two are equivalent.
> Does that mean `tcp flags syn` (was supposed to be and) is now
> equivalent to `tcp flags == syn`
tcp flag syn
is a shortcut to match on the syn bit regarless other bit values, it's
a property of the bitmask datatypes.
tcp flags == syn
is an exact match, it checks that the syn bit is set on.
> instead of `tcp flags & syn == syn` / `tcp flags & syn != 0`?
these two above are equivalent, I just sent a patch to fix the
tcp flags & syn == syn case.
> Suppose `tcp flags & syn != 0` should then be translated to `tcp flags
> syn / syn` instead, please note that while nft translates `tcp flags &
> syn == syn` to `tcp flags syn / syn`, it does not accept the
> translation as input (when the mask is not a comma-separated list):
>
> # nft --debug=netlink add rule meh tcp_flags 'tcp flags syn / syn'
> Error: syntax error, unexpected newline, expecting comma
> add rule meh tcp_flags tcp flags syn / syn
> ^
The most simple way to express this is: tcp flags == syn.
> Also, does that mean `tcp flags & (fin | syn | rst | ack) fin,syn,ack`
> will now be equivalent to `tcp flags & (fin | syn | rst | ack) = (fin
> | syn | ack)`
Yes, those two are equivalent. This is the same example as the one you
have used at the beginning of this email.
> instead of (ultimately) `tcp flags & (fin | syn | ack) != 0`?
That's equivalent to:
tcp flags fin,syn,ack
A quick summary:
- If you want an exact match:
tcp flags == fin,syn,ack
- If you want to check that those three bits are set on (regardless
the remaining bits):
tcp flags fin,syn,ack / fin,syn,ack
- If you want to check that any of these three bits is set on:
tcp flags fin,syn,ack
> Which means `tcp flags & (fin | syn | ack) != 0` should not be
> translated to `tcp flags fin,syn,ack`?
tcp flags & (fin | syn | ack) != 0 is checking for any of these three
bits to be set on, this translation is correct.
next prev parent reply other threads:[~2021-07-27 21:05 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-27 15:37 [PATCH nft 1/3] expression: missing != in flagcmp expression print function Pablo Neira Ayuso
2021-07-27 15:37 ` [PATCH nft 2/3] netlink_linearize: incorrect netlink bytecode with binary operation and flags Pablo Neira Ayuso
2021-07-27 18:36 ` Tom Yan
2021-07-27 21:05 ` Pablo Neira Ayuso [this message]
2021-07-29 1:48 ` Tom Yan
2021-07-29 7:03 ` Pablo Neira Ayuso
2021-07-29 10:41 ` Tom Yan
2021-07-29 10:58 ` Tom Yan
2021-07-29 15:16 ` Tom Yan
2021-07-30 4:53 ` Tom Yan
2021-07-29 2:57 ` Tom Yan
2021-07-29 6:55 ` Pablo Neira Ayuso
2021-07-27 15:37 ` [PATCH nft 3/3] evaluate: disallow negation with binary operation Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210727210503.GA15429@salvia \
--to=pablo@netfilter.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=tom.ty89@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.