Re: [nft PATCH 1/4] payload: generate dependency in the appropriate byteorder

["Álvaro Neira Ayuso" <alvaroneay@gmail.com>]

El 22/09/14 09:54, Patrick McHardy escribió:
> On Sun, Sep 21, 2014 at 09:32:34PM +0200, Alvaro Neira Ayuso wrote:
>> If we add a dependency, the constant expression on the right
>> hand side must be represented in the appropriate order.
>
> What problem does this actually fix? Please include an example what is
> broken if you want to fix something.

Sure. For example, with the new complete reject support. If we want to 
add a reject rule for bridge, I add a ether type dependency to delimit 
the traffic that we want to filter.

Example without this patch:

nft add rule bridge filter input reject with icmp-host-unreach --debug 
netlink

[ payload load 2b @ link header + 12 => reg 1 ]
[ cmp eq reg 1 0x00000800 ]
[ reject type 0 code 1 ]

When we create the payload expression we have the right value in host 
endian but this has to be in big endian.

With this patch, if we add the same rule:

nft add rule bridge filter input reject with icmp-host-unreach --debug 
netlink

[ payload load 2b @ link header + 12 => reg 1 ]
[ cmp eq reg 1 0x00000008 ]
[ reject type 0 code 1 ]

The new dependency is converted to big endian.

>
>> Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com>
>> ---
>>   src/payload.c |    3 +--
>>   1 file changed, 1 insertion(+), 2 deletions(-)
>>
>> diff --git a/src/payload.c b/src/payload.c
>> index 1eee4e0..a3bbe51 100644
>> --- a/src/payload.c
>> +++ b/src/payload.c
>> @@ -216,8 +216,7 @@ int payload_gen_dependency(struct eval_ctx *ctx, const struct expr *expr,
>>   		left = payload_expr_alloc(&expr->location, desc, desc->protocol_key);
>>
>>   	right = constant_expr_alloc(&expr->location, tmpl->dtype,
>> -				    BYTEORDER_HOST_ENDIAN,
>> -				    tmpl->len,
>> +				    tmpl->dtype->byteorder, tmpl->len,
>>   				    constant_data_ptr(protocol, tmpl->len));
>>
>>   	dep = relational_expr_alloc(&expr->location, OP_EQ, left, right);
>> --
>> 1.7.10.4
>>

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html