Author: ae
Date: Fri Mar 3 20:22:42 2017
New Revision: 314614
URL: https://svnweb.freebsd.org/changeset/base/314614
Log:
Fix matching table entry value. Use real table value instead of its index
in valuestate array.
When opcode has size equal to ipfw_insn_u32, this means that it should
additionally match value specified in d[0] with table entry value.
ipfw_table_lookup() returns table value index, use TARG_VAL() macro to
convert it to its value. The actual 32-bit value stored in the tag field
of table_value structure, where all unspecified u32 values are kept.
PR: 217262
Reviewed by: melifaro
MFC after: 1 week
Sponsored by: Yandex LLC
Modified:
head/sys/netpfil/ipfw/ip_fw2.c
Modified: head/sys/netpfil/ipfw/ip_fw2.c
==============================================================================
--- head/sys/netpfil/ipfw/ip_fw2.c Fri Mar 3 20:15:22 2017
(r314613)
+++ head/sys/netpfil/ipfw/ip_fw2.c Fri Mar 3 20:22:42 2017
(r314614)
@@ -1511,8 +1511,8 @@ do {
\
if (!match)
break;
if (cmdlen == F_INSN_SIZE(ipfw_insn_u32))
- match =
- ((ipfw_insn_u32 *)cmd)->d[0] == v;
+ match = ((ipfw_insn_u32 *)cmd)->d[0] ==
+ TARG_VAL(chain, v, tag);
else
tablearg = v;
} else if (is_ipv6) {
@@ -1524,7 +1524,8 @@ do {
\
sizeof(struct in6_addr),
pkey, &v);
if (cmdlen ==
F_INSN_SIZE(ipfw_insn_u32))
- match = ((ipfw_insn_u32
*)cmd)->d[0] == v;
+ match = ((ipfw_insn_u32
*)cmd)->d[0] ==
+ TARG_VAL(chain, v, tag);
if (match)
tablearg = v;
}
@@ -1536,7 +1537,8 @@ do {
\
match =
ipfw_lookup_table_extended(chain,
cmd->arg1, 0, &args->f_id, &v);
if (cmdlen ==
F_INSN_SIZE(ipfw_insn_u32))
- match = ((ipfw_insn_u32
*)cmd)->d[0] == v;
+ match = ((ipfw_insn_u32
*)cmd)->d[0] ==
+ TARG_VAL(chain, v, tag);
if (match)
tablearg = v;
}
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
