]> git.ipfire.org Git - thirdparty/nftables.git/commitdiff
netlink_delinearize: and/shift postprocessing
authorFlorian Westphal <fw@strlen.de>
Fri, 3 Dec 2021 19:04:31 +0000 (20:04 +0100)
committerFlorian Westphal <fw@strlen.de>
Thu, 9 Dec 2021 10:12:32 +0000 (11:12 +0100)
Before this patch:
in:  frag frag-off @s4
in:  ip version @s8

out: (@nh,0,8 & 0xf0) >> 4 == @s8
out: (frag unknown & 0xfff8 [invalid type]) >> 3 == @s4

after:
out: frag frag-off >> 0 == @s4
out: ip version >> 0 == @s8

Next patch adds support for zero-shift removal.

Signed-off-by: Florian Westphal <fw@strlen.de>
src/netlink_delinearize.c

index 1f820e68e9f19fa53bc7f7987220f982d1166b85..e37a34f37ba29f81c87e3b60b1fe48123b22128e 100644 (file)
@@ -2414,6 +2414,13 @@ static void relational_binop_postprocess(struct rule_pp_ctx *ctx,
                 * templates.
                 */
                binop_postprocess(ctx, expr, &expr->left);
+       } else if (binop->op == OP_RSHIFT && binop->left->op == OP_AND &&
+                  binop->right->etype == EXPR_VALUE && binop->left->right->etype == EXPR_VALUE) {
+               /* Handle 'ip version @s4' and similar, i.e. set lookups where the lhs needs
+                * fixups to mask out unwanted bits AND a shift.
+                */
+
+               binop_postprocess(ctx, binop, &binop->left);
        }
 }