mirror of
https://git.openwrt.org/openwrt/openwrt.git
synced 2026-03-14 23:09:45 +01:00
44b1993f76
From the upstream repo:
Instead of assuming only one register is used, track all 16 regs
individually.
This avoids need for the 'PREV_PAYLOAD' hack and also avoids the need to
clear out old flags:
When we see that register 'x' will be written to, that register state is
reset automatically.
Existing dissector decodes
ip saddr 1.2.3.4 meta l4proto tcp
... as
-s 6.0.0.0 -p tcp
iptables-nft -s 1.2.3.4 -p tcp is decoded correctly because the expressions
are ordered like:
meta l4proto tcp ip saddr 1.2.3.4
|
... and 'meta l4proto' did clear the PAYLOAD flag.
The simpler fix is:
ctx->flags &= ~NFT_XT_CTX_PAYLOAD;
in nft_parse_cmp(), but that breaks dissection of '1-42', because
the second compare ('cmp lte 42') will not find the
payload expression anymore.
This commit fixes #11169 and openwrt/packages#22727, and potentially anyone that uses iptables-nft legacy support.
Signed-off-by: Rodrigo B. de Sousa Martins <rodrigo.sousa.577@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16504
[Added patch header]
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
|
||
|---|---|---|
| .. | ||
| 010-add-set-dscpmark-support.patch | ||
| 020-treewide-use-uint-instead-of-u_int.patch | ||
| 030-revert-fix-build-for-missing-ETH_ALEN-definition.patch | ||
| 040-xshared-Fix-build-for-Werror-format-security.patch | ||
| 050-build-fix-error-during-out-of-tree-build.patch | ||
| 060-libxtables-unexport-init_extensions-declarations.patch | ||
| 070-extensions-string-Review-parse_string-function.patch | ||
| 101-remove-check-already.patch | ||
| 102-iptables-disable-modprobe.patch | ||
| 103-optional-xml.patch | ||
| 104-nft-track-each-register-individually.patch | ||
| 200-configurable_builtin.patch | ||
| 600-shared-libext.patch | ||
| 700-disable-legacy-revisions.patch | ||
| 800-flowoffload_target.patch | ||