On 15 April 2016 at 15:09, Florian Westphal <fw@xxxxxxxxx> wrote: > add rule ip6 filter input ip6 saddr ::1/128 ip6 daddr ::1/128 fails, > we ask to compare a 32byte immediate which is not supported: > > [ payload load 32b @ network header + 8 => reg 1 ] > [ cmp eq reg 1 0x00000000 0x00000000 0x00000000 0x01000000 0x00000000 0x00000000 0x00000000 0x02000000 ] > > We would need to use two cmps in this case, i.e.: > > [ payload load 32b @ network header + 8 => reg 1 ] > [ cmp eq reg 1 0x00000000 0x00000000 0x00000000 0x01000000 ] > [ cmp eq reg 2 0x00000000 0x00000000 0x00000000 0x02000000 ] > > Seems however that this requires a bit more changes to how nft > handles register allocations, we'd also need to undo the constant merge. > > Lets disable merging for now so that we generate > > [ payload load 16b @ network header + 8 => reg 1 ] > [ cmp eq reg 1 0x00000000 0x00000000 0x00000000 0x01000000 ] > [ payload load 16b @ network header + 24 => reg 1 ] > [ cmp eq reg 1 0x00000000 0x00000000 0x00000000 0x02000000 ] > > ... if merge would bring us over the 128 bit register size. > > Closes: http://bugzilla.netfilter.org/show_bug.cgi?id=1032 > Signed-off-by: Florian Westphal <fw@xxxxxxxxx> > --- > include/payload.h | 2 +- > src/payload.c | 27 ++++++++++++++++++++------- > src/rule.c | 2 +- > tests/py/ip6/ip6.t | 1 + > tests/py/ip6/ip6.t.payload.inet | 9 +++++++++ > tests/py/ip6/ip6.t.payload.ip6 | 7 +++++++ > 6 files changed, 39 insertions(+), 9 deletions(-) > Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@xxxxxxxxx> -- Arturo Borrero González -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
