Re: [PATCH nft 1/2] evaluate: check XOR RHS operand is a constant value

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, Aug 05, 2025 at 09:40:14PM +0200, Florian Westphal wrote:
> Now that we support non-constant RHS side in binary operations,
> reject XOR with non-constant key: we cannot transfer the expression.
> 
> Fixes: 54bfc38c522b ("src: allow binop expressions with variable right-hand operands")
> Signed-off-by: Florian Westphal <fw@xxxxxxxxx>

Reviewed-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>

Maybe a tests/py for this to improve coverage is worth?

> ---
>  I suggest to defer this until after 1.1.4 is out.
> 
>  src/evaluate.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/src/evaluate.c b/src/evaluate.c
> index 81e88d11aecb..1d102f842df0 100644
> --- a/src/evaluate.c
> +++ b/src/evaluate.c
> @@ -2578,16 +2578,20 @@ static int binop_can_transfer(struct eval_ctx *ctx,
>  
>  	switch (left->op) {
>  	case OP_LSHIFT:
> +		assert(left->right->etype == EXPR_VALUE);
> +		assert(right->etype == EXPR_VALUE);
> +
>  		if (mpz_scan1(right->value, 0) < mpz_get_uint32(left->right->value))
>  			return expr_binary_error(ctx->msgs, right, left,
>  						 "Comparison is always false");
>  		return 1;
>  	case OP_RSHIFT:
> +		assert(left->right->etype == EXPR_VALUE);
>  		if (ctx->ectx.len < right->len + mpz_get_uint32(left->right->value))
>  			ctx->ectx.len += mpz_get_uint32(left->right->value);
>  		return 1;
>  	case OP_XOR:
> -		return 1;
> +		return expr_is_constant(left->right);
>  	default:
>  		return 0;
>  	}
> -- 
> 2.49.1
> 
> 




[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux