From: Phil Sutter Date: Tue, 24 Oct 2023 09:57:31 +0000 (+0200) Subject: extensions: string: Adjust description of --to to recent kernel changes X-Git-Tag: v1.8.11~194 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ccecb1b90ae2af6e963d27ada8d5fd69d40231c4;p=thirdparty%2Fiptables.git extensions: string: Adjust description of --to to recent kernel changes This reverts commit 920ece2b392fb83bd26416e0e6f8f6a847aacbaa. Since kernel commit c4eee56e14fe ("net: skb_find_text: Ignore patterns extending past 'to'"), pattern scanning no longer happens past --to offset even if skb_seq_read() returned a larger block. Point this out in the description and also drop the '-1' offset which is not true as kernel's selftest in tools/testing/selftests/netfilter/xt_string.sh shows. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1707 Signed-off-by: Phil Sutter --- diff --git a/extensions/libxt_string.man b/extensions/libxt_string.man index efdda492..bdeb0a62 100644 --- a/extensions/libxt_string.man +++ b/extensions/libxt_string.man @@ -7,13 +7,10 @@ Select the pattern matching strategy. (bm = Boyer-Moore, kmp = Knuth-Pratt-Morri Set the offset from which it starts looking for any matching. If not passed, default is 0. .TP \fB\-\-to\fP \fIoffset\fP -Set the offset up to which should be scanned. If the pattern does not start -within this offset, it is not considered a match. +Set the offset up to which should be scanned. That is, byte \fIoffset\fP +(counting from 0) is the last one that is scanned and the maximum position of +\fIpattern\fP's last character. If not passed, default is the packet size. -A second function of this parameter is instructing the kernel how much data -from the packet should be provided. With non-linear skbuffs (e.g. due to -fragmentation), a pattern extending past this offset may not be found. Also see -the related note below about Boyer-Moore algorithm in these cases. .TP [\fB!\fP] \fB\-\-string\fP \fIpattern\fP Matches the given pattern.