Commit c828414a authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: nft_compat: suppress comment match 



No need to have the datapath call the always-true comment match stub.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 7890cbea

net/netfilter/nft_compat.c

+9 −0
Original line number Diff line number Diff line
@@ -731,6 +731,14 @@ static const struct nfnetlink_subsystem nfnl_compat_subsys = { 


static struct nft_expr_type nft_match_type;



static bool nft_match_reduce(struct nft_regs_track *track,

			     const struct nft_expr *expr)

{

	const struct xt_match *match = expr->ops->data;



	return strcmp(match->name, "comment") == 0;

}



static const struct nft_expr_ops *

nft_match_select_ops(const struct nft_ctx *ctx,

		     const struct nlattr * const tb[])
@@ -773,6 +781,7 @@ nft_match_select_ops(const struct nft_ctx *ctx, 
	ops->dump = nft_match_dump;

	ops->validate = nft_match_validate;

	ops->data = match;

	ops->reduce = nft_match_reduce;



	matchsize = NFT_EXPR_SIZE(XT_ALIGN(match->matchsize));

	if (matchsize > NFT_MATCH_LARGE_THRESH) {