iptables: backport "nft: track each register individually" from 1.9
authorRodrigo B. de Sousa Martins <rodrigo.sousa.577@gmail.com>
Wed, 25 Sep 2024 18:35:20 +0000 (15:35 -0300)
committerHauke Mehrtens <hauke@hauke-m.de>
Sat, 19 Oct 2024 17:42:37 +0000 (19:42 +0200)
commit44b1993f766e66c13e09d7c09a3c8f85655a446e
tree14f1494430fb107ce6afa26a04f375b203609321
parent4cca92af3735fe9e33d82b36bb7c2d4d4ea9971d
iptables: backport "nft: track each register individually" from 1.9

From the upstream repo:

Instead of assuming only one register is used, track all 16 regs
individually.

This avoids need for the 'PREV_PAYLOAD' hack and also avoids the need to
clear out old flags:

When we see that register 'x' will be written to, that register state is
reset automatically.

Existing dissector decodes
ip saddr 1.2.3.4 meta l4proto tcp
... as
-s 6.0.0.0 -p tcp

iptables-nft -s 1.2.3.4 -p tcp is decoded correctly because the expressions
are ordered like:

meta l4proto tcp ip saddr 1.2.3.4
                                                                                                                                                                                                                   |
... and 'meta l4proto' did clear the PAYLOAD flag.

The simpler fix is:
ctx->flags &= ~NFT_XT_CTX_PAYLOAD;

in nft_parse_cmp(), but that breaks dissection of '1-42', because
the second compare ('cmp lte 42') will not find the
payload expression anymore.

This commit fixes #11169 and openwrt/packages#22727, and potentially anyone that uses iptables-nft legacy support.

Signed-off-by: Rodrigo B. de Sousa Martins <rodrigo.sousa.577@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16504
[Added patch header]
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
package/network/utils/iptables/Makefile
package/network/utils/iptables/patches/104-nft-track-each-register-individually.patch [new file with mode: 0644]