From: Florian Westphal <fw@strlen.de>
To: <netfilter-devel@vger.kernel.org>
Cc: Florian Westphal <fw@strlen.de>
Subject: [PATCH nft v2 2/3] payload: do not remove icmp echo dependency
Date: Tue, 15 Jun 2021 18:01:50 +0200 [thread overview]
Message-ID: <20210615160151.10594-3-fw@strlen.de> (raw)
In-Reply-To: <20210615160151.10594-1-fw@strlen.de>
"icmp type echo-request icmp id 2" and "icmp id 2" are not the same,
the latter gains an implicit dependency on both echo-request and
echo-reply.
Change payload dependency tracking to not store dependency in case
the value type is ICMP(6)_ECHO(REPLY).
Signed-off-by: Florian Westphal <fw@strlen.de>
---
src/payload.c | 61 +++++++++++++++++++++++++++++++--------------------
1 file changed, 37 insertions(+), 24 deletions(-)
diff --git a/src/payload.c b/src/payload.c
index cfa952248a15..97b60713e800 100644
--- a/src/payload.c
+++ b/src/payload.c
@@ -98,12 +98,16 @@ static void payload_expr_pctx_update(struct proto_ctx *ctx,
desc = proto_find_upper(base, proto);
if (!desc) {
- if (base == &proto_icmp || base == &proto_icmp6) {
+ if (base == &proto_icmp) {
/* proto 0 is ECHOREPLY, just pretend its ECHO.
* Not doing this would need an additional marker
* bit to tell when icmp.type was set.
*/
ctx->th_dep.icmp.type = proto ? proto : ICMP_ECHO;
+ } else if (base == &proto_icmp6) {
+ if (proto == ICMP6_ECHO_REPLY)
+ proto = ICMP6_ECHO_REQUEST;
+ ctx->th_dep.icmp.type = proto;
}
return;
}
@@ -554,33 +558,39 @@ void payload_dependency_reset(struct payload_dep_ctx *ctx)
memset(ctx, 0, sizeof(*ctx));
}
-static uint8_t icmp_get_type(const struct proto_desc *desc, uint8_t value)
+static bool payload_dependency_store_icmp_type(struct payload_dep_ctx *ctx,
+ const struct stmt *stmt)
{
- if (desc == &proto_icmp && value == 0)
- return ICMP_ECHO;
+ struct expr *dep = stmt->expr;
+ const struct proto_desc *desc;
+ const struct expr *right;
+ uint8_t type;
- return value;
-}
+ if (dep->left->etype != EXPR_PAYLOAD)
+ return false;
-static uint8_t icmp_get_dep_type(const struct proto_desc *desc, struct expr *right)
-{
- if (right->etype == EXPR_VALUE && right->len == BITS_PER_BYTE)
- return icmp_get_type(desc, mpz_get_uint8(right->value));
+ right = dep->right;
+ if (right->etype != EXPR_VALUE || right->len != BITS_PER_BYTE)
+ return false;
- return 0;
-}
+ desc = dep->left->payload.desc;
+ if (desc == &proto_icmp) {
+ type = mpz_get_uint8(right->value);
-static void payload_dependency_store_icmp_type(struct payload_dep_ctx *ctx)
-{
- struct expr *dep = ctx->pdep->expr;
- const struct proto_desc *desc;
+ if (type == ICMP_ECHOREPLY)
+ type = ICMP_ECHO;
- if (dep->left->etype != EXPR_PAYLOAD)
- return;
+ ctx->icmp_type = type;
- desc = dep->left->payload.desc;
- if (desc == &proto_icmp || desc == &proto_icmp6)
- ctx->icmp_type = icmp_get_dep_type(dep->left->payload.desc, dep->right);
+ return type == ICMP_ECHO;
+ } else if (desc == &proto_icmp6) {
+ type = mpz_get_uint8(right->value);
+
+ ctx->icmp_type = type;
+ return type == ICMP6_ECHO_REQUEST || type == ICMP6_ECHO_REPLY;
+ }
+
+ return false;
}
/**
@@ -593,10 +603,13 @@ static void payload_dependency_store_icmp_type(struct payload_dep_ctx *ctx)
void payload_dependency_store(struct payload_dep_ctx *ctx,
struct stmt *stmt, enum proto_bases base)
{
- ctx->pbase = base + 1;
- ctx->pdep = stmt;
+ bool ignore_dep = payload_dependency_store_icmp_type(ctx, stmt);
+
+ if (ignore_dep)
+ return;
- payload_dependency_store_icmp_type(ctx);
+ ctx->pdep = stmt;
+ ctx->pbase = base + 1;
}
/**
--
2.31.1
next prev parent reply other threads:[~2021-06-15 16:02 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-15 16:01 [PATCH nft v2 0/3] fix icmpv6 id dependeny handling Florian Westphal
2021-06-15 16:01 ` [PATCH nft v2 1/3] netlink_delinearize: add missing icmp id/sequence support Florian Westphal
2021-06-30 15:13 ` Phil Sutter
2021-06-30 15:34 ` Florian Westphal
2021-06-30 15:58 ` Florian Westphal
2021-06-30 17:12 ` Phil Sutter
2021-06-15 16:01 ` Florian Westphal [this message]
2021-06-15 16:01 ` [PATCH nft v2 3/3] tests: add a icmp-reply only and icmpv6 id test cases Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210615160151.10594-3-fw@strlen.de \
--to=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).