On Thu, May 29, 2014 at 1:41 PM, Daniel Borkmann [off-list ref] wrote:

On 05/29/2014 09:29 PM, Chema Gonzalez wrote:

quoted

The current probe_filter_length() (the function that calculates the
length of a test BPF filter) behavior is to declare the end of the
filter as soon as it finds {0, *, *, 0}. This is actually a valid
insn ("ld #0"), so any filter with includes "BPF_STMT(BPF_LD | BPF_IMM,
0)"
fails (its length is cut short).

We are changing probe_filter_length() so as to start from the end, and
declare the end of the filter as the first instruction which is not
{0, *, *, 0}. This solution produces a simpler patch than the
alternative of using an explicit end-of-filter mark. It is technically
incorrect if your filter ends up with "ld #0", but that should not
happen anyway.

We also add a new test (LD_IMM_0) that includes ld #0 (does not work
without this patch).

Signed-off-by: Chema Gonzalez <redacted>

Looks good to me, thanks a lot Chema!

Acked-by: Daniel Borkmann <redacted>

quoted

+       for (len = MAX_INSNS-1; len > 0; --len)
+               if (fp[len].code != 0 || fp[len].k != 0)
+                       break;

-       return len;
+       return len+1;

Nit: would be great to have a whitespace between MAX_INSNS-1 and len+1 but
that shouldn't matter that much, perhaps.

Done.

-Chema