On Mon, Jan 06, 2020 at 10:35:10PM +0000, Jeremy Sowden wrote:
> expr_evaluate_binop calls expr_set_context for shift expressions to set
> the context data-type to `integer`. This clobbers the byte-order of the
> context, resulting in unexpected conversions to NBO. For example:
>
> $ sudo nft flush ruleset
> $ sudo nft add table t
> $ sudo nft add chain t c '{ type filter hook output priority mangle; }'
> $ sudo nft add rule t c oif lo tcp dport ssh ct mark set '0x10 | 0xe'
> $ sudo nft add rule t c oif lo tcp dport ssh ct mark set '0xf << 1'
> $ sudo nft list table t
> table ip t {
> chain c {
> type filter hook output priority mangle; policy accept;
> oif "lo" tcp dport 22 ct mark set 0x0000001e
> oif "lo" tcp dport 22 ct mark set 0x1e000000
> }
> }
>
> Replace it with a call to __expr_set_context and set the byteorder to
> that of the left operand since this is the value being shifted.
Looks good, applied, thanks Jeremy.
