]> git.ipfire.org Git - thirdparty/nftables.git/commitdiff
mergesort: Align concatenation sort order with Big Endian
authorPhil Sutter <phil@nwl.cc>
Wed, 12 Nov 2025 23:14:43 +0000 (00:14 +0100)
committerPhil Sutter <phil@nwl.cc>
Tue, 27 Jan 2026 22:01:54 +0000 (23:01 +0100)
By exporting all concat components in a way independent from host
byteorder and importing that blob of data in the same way aligns sort
order between hosts of different Endianness.

Fixes: 741a06ac15d2b ("mergesort: find base value expression type via recursion")
Signed-off-by: Phil Sutter <phil@nwl.cc>
22 files changed:
src/mergesort.c
tests/py/any/ct.t.json.output
tests/py/any/tcpopt.t.json.output
tests/shell/testcases/maps/dumps/named_ct_objects.json-nft
tests/shell/testcases/maps/dumps/named_ct_objects.nft
tests/shell/testcases/maps/dumps/typeof_integer_0.json-nft
tests/shell/testcases/maps/dumps/typeof_integer_0.nft
tests/shell/testcases/nft-f/dumps/0012different_defines_0.json-nft
tests/shell/testcases/nft-f/dumps/0012different_defines_0.nft
tests/shell/testcases/optimizations/dumps/merge_nat_inet.json-nft
tests/shell/testcases/optimizations/dumps/merge_nat_inet.nft
tests/shell/testcases/optimizations/dumps/merge_reject.json-nft
tests/shell/testcases/optimizations/dumps/merge_reject.nft
tests/shell/testcases/optimizations/dumps/merge_stmts_concat.json-nft
tests/shell/testcases/optimizations/dumps/merge_stmts_concat.nft
tests/shell/testcases/optimizations/dumps/merge_stmts_concat_vmap.json-nft
tests/shell/testcases/optimizations/dumps/merge_stmts_concat_vmap.nft
tests/shell/testcases/sets/dumps/0029named_ifname_dtype_0.nft
tests/shell/testcases/sets/dumps/0037_set_with_inet_service_0.json-nft
tests/shell/testcases/sets/dumps/0037_set_with_inet_service_0.nft
tests/shell/testcases/sets/dumps/typeof_sets_0.nft
tests/shell/testcases/sets/typeof_sets_0

index 97e36917280f308e1e3aced2d55b91714a3eb008..7b318423a572b1a72eab0ba7a6ce839c35b87f96 100644 (file)
@@ -20,11 +20,11 @@ static void concat_expr_msort_value(const struct expr *expr, mpz_t value)
 
        list_for_each_entry(i, &expr_concat(expr)->expressions, list) {
                ilen = div_round_up(i->len, BITS_PER_BYTE);
-               mpz_export_data(data + len, i->value, i->byteorder, ilen);
+               mpz_export_data(data + len, i->value, BYTEORDER_BIG_ENDIAN, ilen);
                len += ilen;
        }
 
-       mpz_import_data(value, data, BYTEORDER_HOST_ENDIAN, len);
+       mpz_import_data(value, data, BYTEORDER_BIG_ENDIAN, len);
 }
 
 static mpz_srcptr expr_msort_value(const struct expr *expr, mpz_t value)
index 82634c2da67206d515c950cf4a45b97936d92a1b..3f7959301354a92ce8e1b806e7b9d5cae012e671 100644 (file)
                 "set": [
                     {
                         "concat": [
-                            "new",
-                            305419896
+                            "established",
+                            309876276
                         ]
                     },
                     {
                         "concat": [
-                            "established",
-                            309876276
+                            "new",
+                            305419896
                         ]
                     },
                     {
                     [
                         {
                             "concat": [
-                                "new",
-                                305419896
+                                "established",
+                                2271560481
                             ]
                         },
                         {
-                            "drop": null
+                            "accept": null
                         }
                     ],
                     [
                         {
                             "concat": [
-                                "established",
-                                2271560481
+                                "new",
+                                305419896
                             ]
                         },
                         {
-                            "accept": null
+                            "drop": null
                         }
                     ]
                 ]
index ae979e7747762aacd214c8a7fce43af4a3e76172..4f170cf62e41107dcef351b7d8c5703471d515d2 100644 (file)
         }
     }
 ]
-
-# tcp option mptcp subtype . tcp dport { mp-capable . 10, mp-join . 100, add-addr . 200, remove-addr . 300, mp-prio . 400, mp-fail . 500, mp-fastclose . 600, mp-tcprst . 700 }
-[
-    {
-        "match": {
-            "left": {
-                "concat": [
-                    {
-                        "tcp option": {
-                            "field": "subtype",
-                            "name": "mptcp"
-                        }
-                    },
-                    {
-                        "payload": {
-                            "field": "dport",
-                            "protocol": "tcp"
-                        }
-                    }
-                ]
-            },
-            "op": "==",
-            "right": {
-                "set": [
-                    {
-                        "concat": [
-                            "mp-capable",
-                            10
-                        ]
-                    },
-                    {
-                        "concat": [
-                            "remove-addr",
-                            300
-                        ]
-                    },
-                    {
-                        "concat": [
-                            "mp-fastclose",
-                            600
-                        ]
-                    },
-                    {
-                        "concat": [
-                            "mp-join",
-                            100
-                        ]
-                    },
-                    {
-                        "concat": [
-                            "mp-prio",
-                            400
-                        ]
-                    },
-                    {
-                        "concat": [
-                            "mp-tcprst",
-                            700
-                        ]
-                    },
-                    {
-                        "concat": [
-                            "add-addr",
-                            200
-                        ]
-                    },
-                    {
-                        "concat": [
-                            "mp-fail",
-                            500
-                        ]
-                    }
-                ]
-            }
-        }
-    }
-]
index 34c8798dee8fbf106615821501bf37697a1bf33f..21ab05653a6d3178aed6362c9b6ee2efb6c28738 100644 (file)
                     [
                       {
                         "concat": [
-                          "feed::17",
-                          512
+                          "dead::beef",
+                          123
                         ]
                       },
                       "exp2"
                     [
                       {
                         "concat": [
-                          "dead::beef",
-                          123
+                          "feed::17",
+                          512
                         ]
                       },
                       "exp2"
index dab683bf5cdbdbcc595ec15556acba52b7fc8cb3..18b52eb16a0522bab4d43e7d73725cc32d119a9c 100644 (file)
@@ -58,7 +58,7 @@ table inet t {
                ct expectation set ip saddr map @exp
                ct expectation set ip6 saddr map { dead::beef : "exp2" }
                ct expectation set ip6 daddr map { dead::beef : "exp2", feed::17 : "exp2" }
-               ct expectation set ip6 daddr . tcp dport map { feed::17 . 512 : "exp2", dead::beef . 123 : "exp2" }
+               ct expectation set ip6 daddr . tcp dport map { dead::beef . 123 : "exp2", feed::17 . 512 : "exp2" }
                ct helper set ip6 saddr map { 1c3::c01d : "myftp", dead::beef : "myftp" }
                ct helper set ip6 saddr map @helpobj
                ct timeout set ip daddr map @timeoutmap
index 1df729b40a74ff18fcd9cd666f8328f47af57c68..65474c9e2a1b13be657890bff888ecfa27ff9c89 100644 (file)
           [
             {
               "concat": [
-                30,
-                30
+                20,
+                36
               ]
             },
             {
-              "drop": null
+              "accept": null
             }
           ],
           [
             {
               "concat": [
-                20,
-                36
+                30,
+                30
               ]
             },
             {
-              "accept": null
+              "drop": null
             }
           ]
         ]
index 19c24febffcc5bd803251db80d7fb655c83b2a31..7bd7daaad7610df85e4b8460fc86bbf04584603f 100644 (file)
@@ -8,8 +8,8 @@ table inet t {
 
        map m2 {
                typeof udp length . @ih,32,32 : verdict
-               elements = { 30 . 0x1e : drop,
-                            20 . 0x24 : accept }
+               elements = { 20 . 0x24 : accept,
+                            30 . 0x1e : drop }
        }
 
        chain c {
index 0e7ea228501b4ea932b20df33e58bd3b31f12902..e266bf4c8a6982e06361cb7c5257678e7f9c9c8c 100644 (file)
                 "set": [
                   {
                     "concat": [
-                      "fe0::2",
-                      "tcp"
+                      "fe0::1",
+                      "udp"
                     ]
                   },
                   {
                     "concat": [
-                      "fe0::1",
-                      "udp"
+                      "fe0::2",
+                      "tcp"
                     ]
                   }
                 ]
index 4734b2fd8bd13ec0e335df4c123a027e74354eb8..a6e16e7dd0336f1260c9c7dab601d91e35128778 100644 (file)
@@ -8,7 +8,7 @@ table inet t {
                ip6 daddr fe0::1 ip6 saddr fe0::2
                ip saddr vmap { 10.0.0.0 : drop, 10.0.0.2 : accept }
                ip6 daddr vmap { fe0::1 : drop, fe0::2 : accept }
-               ip6 saddr . ip6 nexthdr { fe0::2 . tcp, fe0::1 . udp }
+               ip6 saddr . ip6 nexthdr { fe0::1 . udp, fe0::2 . tcp }
                ip daddr . iif vmap { 10.0.0.0 . "lo" : accept }
                tcp dport 100-222
                udp dport vmap { 100-222 : accept }
index 99930f112ec69831ee0842ae91b8da496360bb1a..7df802e6bd90be8ab3dc5a4b4b4ddf3b5925940b 100644 (file)
                         {
                           "concat": [
                             "enp2s0",
-                            "72.2.3.70",
-                            80
+                            "72.2.3.66",
+                            443
                           ]
                         },
                         {
                           "concat": [
                             "10.1.1.52",
-                            80
+                            443
                           ]
                         }
                       ],
                         {
                           "concat": [
                             "enp2s0",
-                            "72.2.3.66",
-                            443
+                            "72.2.3.70",
+                            80
                           ]
                         },
                         {
                           "concat": [
                             "10.1.1.52",
-                            443
+                            80
                           ]
                         }
                       ]
index a1a1135482b950cdfbff06941e1f5e703b6ea631..1e08d5a5a12299cca662cd6b4cd313cc511233c0 100644 (file)
@@ -1,7 +1,7 @@
 table inet nat {
        chain prerouting {
                oif "lo" accept
-               dnat ip to iifname . ip daddr . tcp dport map { "enp2s0" . 72.2.3.70 . 80 : 10.1.1.52 . 80, "enp2s0" . 72.2.3.66 . 53122 : 10.1.1.10 . 22, "enp2s0" . 72.2.3.66 . 443 : 10.1.1.52 . 443 }
+               dnat ip to iifname . ip daddr . tcp dport map { "enp2s0" . 72.2.3.66 . 443 : 10.1.1.52 . 443, "enp2s0" . 72.2.3.66 . 53122 : 10.1.1.10 . 22, "enp2s0" . 72.2.3.70 . 80 : 10.1.1.52 . 80 }
        }
 
        chain postrouting {
index 46ed0677d203e453edf4ccd1a8a89c9d853eb827..8f468e019657cfa36a148da3682f664c85035021 100644 (file)
                   {
                     "concat": [
                       "tcp",
-                      "172.30.238.117",
-                      8080
+                      "172.30.33.71",
+                      3306
                     ]
                   },
                   {
                     "concat": [
                       "tcp",
-                      "172.30.33.71",
-                      3306
+                      "172.30.238.117",
+                      8080
                     ]
                   },
                   {
                   {
                     "concat": [
                       "tcp",
-                      "aaaa::3",
-                      8080
+                      "aaaa::2",
+                      3306
                     ]
                   },
                   {
                     "concat": [
                       "tcp",
-                      "aaaa::2",
-                      3306
+                      "aaaa::3",
+                      8080
                     ]
                   },
                   {
index c29ad6d5648b67d7748d32ff07ef3b7ddcdae927..1727d024866d7fbd2bf54e2e9b86571fa9368cb5 100644 (file)
@@ -1,13 +1,13 @@
 table ip x {
        chain y {
                ip daddr 172.30.33.70 tcp dport 3306 counter packets 0 bytes 0 drop
-               meta l4proto . ip daddr . tcp dport { tcp . 172.30.238.117 . 8080, tcp . 172.30.33.71 . 3306, tcp . 172.30.254.251 . 3306 } counter packets 0 bytes 0 reject
+               meta l4proto . ip daddr . tcp dport { tcp . 172.30.33.71 . 3306, tcp . 172.30.238.117 . 8080, tcp . 172.30.254.251 . 3306 } counter packets 0 bytes 0 reject
                ip daddr 172.30.254.252 tcp dport 3306 counter packets 0 bytes 0 reject with tcp reset
        }
 }
 table ip6 x {
        chain y {
-               meta l4proto . ip6 daddr . tcp dport { tcp . aaaa::3 . 8080, tcp . aaaa::2 . 3306, tcp . aaaa::4 . 3306 } counter packets 0 bytes 0 reject
+               meta l4proto . ip6 daddr . tcp dport { tcp . aaaa::2 . 3306, tcp . aaaa::3 . 8080, tcp . aaaa::4 . 3306 } counter packets 0 bytes 0 reject
                ip6 daddr aaaa::5 tcp dport 3306 counter packets 0 bytes 0 reject with tcp reset
        }
 }
index 46e740a8f5b5a6cbc3a336ae98872bc65a263364..b70ee97b35ebd40385a5915f244684260af317e1 100644 (file)
                   },
                   {
                     "concat": [
-                      138,
-                      "new"
+                      137,
+                      "untracked"
                     ]
                   },
                   {
                     "concat": [
-                      137,
-                      "untracked"
+                      138,
+                      "new"
                     ]
                   },
                   {
                 "set": [
                   {
                     "concat": [
-                      51820,
-                      "foo"
+                      67,
+                      "bar"
                     ]
                   },
                   {
                   },
                   {
                     "concat": [
-                      67,
-                      "bar"
+                      51820,
+                      "foo"
                     ]
                   }
                 ]
                 "set": [
                   {
                     "concat": [
-                      100,
-                      "foo"
+                      67,
+                      "bar"
                     ]
                   },
                   {
                     "concat": [
-                      51820,
+                      100,
                       "foo"
                     ]
                   },
                   },
                   {
                     "concat": [
-                      67,
-                      "bar"
+                      51820,
+                      "foo"
                     ]
                   }
                 ]
                 "set": [
                   {
                     "concat": [
-                      100,
-                      "foo"
+                      67,
+                      "bar"
                     ]
                   },
                   {
                     "concat": [
-                      51820,
+                      100,
                       "foo"
                     ]
                   },
                   {
                     "concat": [
-                      514,
-                      "bar"
+                      100,
+                      "test"
                     ]
                   },
                   {
                     "concat": [
-                      67,
+                      514,
                       "bar"
                     ]
                   },
                   {
                     "concat": [
-                      100,
-                      "test"
+                      51820,
+                      "foo"
                     ]
                   },
                   {
index d00ac417ca759b1bd94715bc46bbf9c7db522104..6150258512061d06d5b4cac203b8e05f94063935 100644 (file)
@@ -2,18 +2,18 @@ table ip x {
        chain y {
                iifname . ip saddr . ip daddr { "eth1" . 1.1.1.1 . 2.2.2.3, "eth1" . 1.1.1.2 . 2.2.2.4, "eth1" . 1.1.1.2 . 2.2.3.0/24, "eth1" . 1.1.1.2 . 2.2.4.0-2.2.4.10, "eth2" . 1.1.1.3 . 2.2.2.5 } accept
                ip protocol . th dport { tcp . 22, udp . 67 }
-               udp dport . ct state { 137 . new, 138 . new, 137 . untracked, 138 . untracked } accept
+               udp dport . ct state { 137 . new, 137 . untracked, 138 . new, 138 . untracked } accept
        }
 
        chain c1 {
-               udp dport . iifname { 51820 . "foo", 514 . "bar", 67 . "bar" } accept
+               udp dport . iifname { 67 . "bar", 514 . "bar", 51820 . "foo" } accept
        }
 
        chain c2 {
-               udp dport . iifname { 100 . "foo", 51820 . "foo", 514 . "bar", 67 . "bar" } accept
+               udp dport . iifname { 67 . "bar", 100 . "foo", 514 . "bar", 51820 . "foo" } accept
        }
 
        chain c3 {
-               udp dport . iifname { 100 . "foo", 51820 . "foo", 514 . "bar", 67 . "bar", 100 . "test", 51820 . "test" } accept
+               udp dport . iifname { 67 . "bar", 100 . "foo", 100 . "test", 514 . "bar", 51820 . "foo", 51820 . "test" } accept
        }
 }
index 5dfa40a821ebe2087390845f4a28f1d7f89468f5..5259e5647cf088bd01e8eec9d13f36b8b9b7c38e 100644 (file)
@@ -60,7 +60,7 @@
                     {
                       "concat": [
                         "broadcast",
-                        547
+                        67
                       ]
                     },
                     {
@@ -71,7 +71,7 @@
                     {
                       "concat": [
                         "broadcast",
-                        67
+                        547
                       ]
                     },
                     {
index 780aa09adbe6596b304d3f3634a4e6f8b77920c7..81abb99464e0a33ff6bbabce6604f31d54a8f7b5 100644 (file)
@@ -1,6 +1,6 @@
 table ip x {
        chain x {
-               meta pkttype . udp dport vmap { broadcast . 547 : accept, broadcast . 67 : accept, multicast . 1900 : drop }
+               meta pkttype . udp dport vmap { broadcast . 67 : accept, broadcast . 547 : accept, multicast . 1900 : drop }
        }
 
        chain y {
index 6f9832a96188fb11c1bd0af91725a0446cb13d93..e75d8a960e7d0fc590bcd427c12dfc2e4e36df92 100644 (file)
@@ -12,8 +12,8 @@ table inet t {
                type inet_service . ifname
                elements = { 22 . "eth0",
                             80 . "eth0",
-                            81 . "eth0",
-                            80 . "eth1" }
+                            80 . "eth1",
+                            81 . "eth0" }
        }
 
        set nv {
index 1c3b559d48d43c446c257c4d813738bb9d8d7803..cf1c1cc9d479e676f6976d2ad8248fa2db00c8c0 100644 (file)
         "elem": [
           {
             "concat": [
-              "192.168.0.113",
+              "192.168.0.12",
               "tcp",
-              22
+              53
             ]
           },
           {
             "concat": [
               "192.168.0.12",
               "tcp",
-              53
+              80
             ]
           },
           {
           },
           {
             "concat": [
-              "192.168.0.12",
+              "192.168.0.13",
               "tcp",
               80
             ]
           },
           {
             "concat": [
-              "192.168.0.13",
+              "192.168.0.113",
               "tcp",
-              80
+              22
             ]
           }
         ]
index 68b1f7bec4d8475afc1573a5fafb515eca3a7b55..0e85f7c20eba085b57eee4c0434ff6a579dea92d 100644 (file)
@@ -1,11 +1,11 @@
 table inet filter {
        set myset {
                type ipv4_addr . inet_proto . inet_service
-               elements = { 192.168.0.113 . tcp . 22,
-                            192.168.0.12 . tcp . 53,
-                            192.168.0.12 . udp . 53,
+               elements = { 192.168.0.12 . tcp . 53,
                             192.168.0.12 . tcp . 80,
-                            192.168.0.13 . tcp . 80 }
+                            192.168.0.12 . udp . 53,
+                            192.168.0.13 . tcp . 80,
+                            192.168.0.113 . tcp . 22 }
        }
 
        chain forward {
index 34aaab601cda310d3620d8fc876f2fbcc520456d..1ceddfc4cded7d8a4393917e389816e677fdb2ce 100644 (file)
@@ -67,8 +67,8 @@ table inet t {
 
        set s14 {
                typeof tcp option mptcp subtype . ip daddr
-               elements = { remove-addr . 10.1.1.1,
-                            mp-join . 10.1.1.2 }
+               elements = { mp-join . 10.1.1.2,
+                            remove-addr . 10.1.1.1 }
        }
 
        chain c1 {
index 28e39b4d2cb3097c1c037cd88ed92893bec83cb0..8850e9acea698635cbd88b56548b394b8b98815c 100755 (executable)
@@ -223,8 +223,8 @@ $INPUT_VERSION_SET
 
        set s14 {
                typeof tcp option mptcp subtype . ip daddr
-               elements = { remove-addr . 10.1.1.1,
-                            mp-join . 10.1.1.2 }
+               elements = { mp-join . 10.1.1.2,
+                            remove-addr . 10.1.1.1 }
        }
 $INPUT_OSF_CHAIN
        chain c2 {