Re: [PATCH libnftnl] expr: imm: Fix immediate verdict comparison

[Pablo Neira Ayuso <pablo@netfilter.org>]

[-- Attachment #1: Type: text/plain, Size: 1475 bytes --]

On Thu, Aug 25, 2016 at 04:56:58PM +0200, Carlos Falgueras García wrote:
> An immediate expression of type 'DATA_VERDICT' can have set a chain (jump
> or goto), in this cases we must compare its 'union nftnl_data_reg' using
> 'DATA_CHAIN' flag instead of 'DATA_VERDICT'
> 
> Before this patch compare expressions "jump -> chain_a" and
> "jump -> chain_b" returns they are equals.
> 
> Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net>
> ---
>  src/expr/immediate.c | 12 +++++++++---
>  1 file changed, 9 insertions(+), 3 deletions(-)
> 
> diff --git a/src/expr/immediate.c b/src/expr/immediate.c
> index cb8a81b..b26fc8d 100644
> --- a/src/expr/immediate.c
> +++ b/src/expr/immediate.c
> @@ -329,10 +329,16 @@ static bool nftnl_expr_immediate_cmp(const struct nftnl_expr *e1,
>  
>  	if (e1->flags & (1 << NFTNL_EXPR_IMM_DREG))
>  		eq &= (i1->dreg == i2->dreg);
> -	if (e1->flags & (1 << NFTNL_EXPR_IMM_VERDICT))
> -		eq &= nftnl_data_reg_cmp(&i1->data, &i2->data, DATA_VERDICT);
> -	else if (e1->flags & (1 << NFTNL_EXPR_IMM_DATA))
> +	if (e1->flags & (1 << NFTNL_EXPR_IMM_VERDICT)) {
> +		if (e1->flags & (1 << NFTNL_EXPR_IMM_CHAIN))
> +			eq &= nftnl_data_reg_cmp(&i1->data, &i2->data,
> +						 DATA_CHAIN);
> +		else
> +			eq &= nftnl_data_reg_cmp(&i1->data, &i2->data,
> +						 DATA_VERDICT);

Probably better with this patch below? You don't need to split the
lines.

No need to resend, just review and confirm this change is OK and I'll
apply this here.

[-- Attachment #2: y.patch --]
[-- Type: text/x-diff, Size: 1827 bytes --]

>From 521b6b1a7cc99445cf983403add23f373836d1a8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Carlos=20Falgueras=20Garc=C3=ADa?= <carlosfg@riseup.net>
Date: Thu, 25 Aug 2016 16:56:58 +0200
Subject: [PATCH] expr: imm: Fix immediate verdict comparison
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

An immediate expression of type 'DATA_VERDICT' can have set a chain (jump
or goto), in this cases we must compare its 'union nftnl_data_reg' using
'DATA_CHAIN' flag instead of 'DATA_VERDICT'

Before this patch compare expressions "jump -> chain_a" and
"jump -> chain_b" returns they are equals.

Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/expr/immediate.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/src/expr/immediate.c b/src/expr/immediate.c
index cb8a81b..8636738 100644
--- a/src/expr/immediate.c
+++ b/src/expr/immediate.c
@@ -326,13 +326,20 @@ static bool nftnl_expr_immediate_cmp(const struct nftnl_expr *e1,
 	struct nftnl_expr_immediate *i1 = nftnl_expr_data(e1);
 	struct nftnl_expr_immediate *i2 = nftnl_expr_data(e2);
 	bool eq = true;
+	int type;
 
 	if (e1->flags & (1 << NFTNL_EXPR_IMM_DREG))
 		eq &= (i1->dreg == i2->dreg);
-	if (e1->flags & (1 << NFTNL_EXPR_IMM_VERDICT))
-		eq &= nftnl_data_reg_cmp(&i1->data, &i2->data, DATA_VERDICT);
-	else if (e1->flags & (1 << NFTNL_EXPR_IMM_DATA))
+	if (e1->flags & (1 << NFTNL_EXPR_IMM_VERDICT)) {
+		if (e1->flags & (1 << NFTNL_EXPR_IMM_CHAIN))
+			type = DATA_CHAIN;
+		else
+			type = DATA_VERDICT;
+
+		eq &= nftnl_data_reg_cmp(&i1->data, &i2->data, type);
+	} else if (e1->flags & (1 << NFTNL_EXPR_IMM_DATA)) {
 		eq &= nftnl_data_reg_cmp(&i1->data, &i2->data, DATA_VALUE);
+	}
 
 	return eq;
 }
-- 
2.1.4