|
 |
3a00e5 |
From 5462c9908a3b2ba94fc4cf5c6cd0d5ed296093c5 Mon Sep 17 00:00:00 2001
|
|
|
3a00e5 |
From: Phil Sutter <phil@nwl.cc>
|
|
|
3a00e5 |
Date: Fri, 19 Feb 2021 16:54:57 +0100
|
|
|
3a00e5 |
Subject: [PATCH] nft: Fix bitwise expression avoidance detection
|
|
|
3a00e5 |
|
|
|
3a00e5 |
Byte-boundary prefix detection was too sloppy: Any data following the
|
|
|
3a00e5 |
first zero-byte was ignored. Add a follow-up loop making sure there are
|
|
|
3a00e5 |
no stray bits in the designated host part.
|
|
|
3a00e5 |
|
|
|
3a00e5 |
Fixes: 323259001d617 ("nft: Optimize class-based IP prefix matches")
|
|
|
3a00e5 |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
3a00e5 |
(cherry picked from commit 330f5df03ad589b46865ceedf2a54cf10a4225ba)
|
|
|
3a00e5 |
---
|
|
|
3a00e5 |
iptables/nft-shared.c | 4 +++-
|
|
|
3a00e5 |
.../testcases/ip6tables/0004-address-masks_0 | 24 +++++++++++++++++++
|
|
|
3a00e5 |
2 files changed, 27 insertions(+), 1 deletion(-)
|
|
|
3a00e5 |
create mode 100755 iptables/tests/shell/testcases/ip6tables/0004-address-masks_0
|
|
|
3a00e5 |
|
|
|
3a00e5 |
diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
|
|
|
3a00e5 |
index 10553ab26823b..c1664b50f9383 100644
|
|
|
3a00e5 |
--- a/iptables/nft-shared.c
|
|
|
3a00e5 |
+++ b/iptables/nft-shared.c
|
|
|
3a00e5 |
@@ -166,7 +166,7 @@ void add_addr(struct nftnl_rule *r, enum nft_payload_bases base, int offset,
|
|
|
3a00e5 |
{
|
|
|
3a00e5 |
const unsigned char *m = mask;
|
|
|
3a00e5 |
bool bitwise = false;
|
|
|
3a00e5 |
- int i;
|
|
|
3a00e5 |
+ int i, j;
|
|
|
3a00e5 |
|
|
|
3a00e5 |
for (i = 0; i < len; i++) {
|
|
|
3a00e5 |
if (m[i] != 0xff) {
|
|
|
3a00e5 |
@@ -174,6 +174,8 @@ void add_addr(struct nftnl_rule *r, enum nft_payload_bases base, int offset,
|
|
|
3a00e5 |
break;
|
|
|
3a00e5 |
}
|
|
|
3a00e5 |
}
|
|
|
3a00e5 |
+ for (j = i + 1; !bitwise && j < len; j++)
|
|
|
3a00e5 |
+ bitwise = !!m[j];
|
|
|
3a00e5 |
|
|
|
3a00e5 |
if (!bitwise)
|
|
|
3a00e5 |
len = i;
|
|
|
3a00e5 |
diff --git a/iptables/tests/shell/testcases/ip6tables/0004-address-masks_0 b/iptables/tests/shell/testcases/ip6tables/0004-address-masks_0
|
|
|
3a00e5 |
new file mode 100755
|
|
|
3a00e5 |
index 0000000000000..7eb42f08da975
|
|
|
3a00e5 |
--- /dev/null
|
|
|
3a00e5 |
+++ b/iptables/tests/shell/testcases/ip6tables/0004-address-masks_0
|
|
|
3a00e5 |
@@ -0,0 +1,24 @@
|
|
|
3a00e5 |
+#!/bin/bash
|
|
|
3a00e5 |
+
|
|
|
3a00e5 |
+set -e
|
|
|
3a00e5 |
+
|
|
|
3a00e5 |
+$XT_MULTI ip6tables-restore <
|
|
|
3a00e5 |
+*filter
|
|
|
3a00e5 |
+-A FORWARD -s feed:babe::/ffff::0
|
|
|
3a00e5 |
+-A FORWARD -s feed:babe::/ffff:ff00::0
|
|
|
3a00e5 |
+-A FORWARD -s feed:babe::/ffff:fff0::0
|
|
|
3a00e5 |
+-A FORWARD -s feed:babe::/ffff:ffff::0
|
|
|
3a00e5 |
+-A FORWARD -s feed:babe::/0:ffff::0
|
|
|
3a00e5 |
+-A FORWARD -s feed:c0ff::babe:f00/ffff::ffff:0
|
|
|
3a00e5 |
+COMMIT
|
|
|
3a00e5 |
+EOF
|
|
|
3a00e5 |
+
|
|
|
3a00e5 |
+EXPECT='-P FORWARD ACCEPT
|
|
|
3a00e5 |
+-A FORWARD -s feed::/16
|
|
|
3a00e5 |
+-A FORWARD -s feed:ba00::/24
|
|
|
3a00e5 |
+-A FORWARD -s feed:bab0::/28
|
|
|
3a00e5 |
+-A FORWARD -s feed:babe::/32
|
|
|
3a00e5 |
+-A FORWARD -s 0:babe::/0:ffff::
|
|
|
3a00e5 |
+-A FORWARD -s feed::babe:0/ffff::ffff:0'
|
|
|
3a00e5 |
+
|
|
|
3a00e5 |
+diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -S FORWARD)
|
|
|
3a00e5 |
--
|
|
|
3a00e5 |
2.31.1
|
|
|
3a00e5 |
|