netfilter: nft_payload: extend offset to 65535 bytes

Browse source

In some situations 255 bytes offset is not enough to match or manipulate
the desired packet field. Increase the offset limit to 65535 or U16_MAX.

In addition, the nla policy maximum value is not set anymore as it is
limited to s16. Instead, the maximum value is checked during the payload
expression initialization function.

Tested with the nft command line tool.

table ip filter {
	chain output {
		@nh,2040,8 set 0xff
		@nh,524280,8 set 0xff
		@nh,524280,8 0xff
		@nh,2040,8 0xff
	}
}

Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Florian Westphal <fw@strlen.de>

...

This commit is contained in:

Fernando Fernandez Mancera 2025-08-28 14:48:31 +02:00 • committed by Florian Westphal

parent f4f9e05904

commit 077dc4a275

2 changed files with 12 additions and 8 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

include/net/netfilter/nf_tables_core.h

View file

18

net/netfilter/nft_payload.c

View file