|
 |
b144b7 |
From 74a62264d4615ae7f76454e7ca406c46a62c7999 Mon Sep 17 00:00:00 2001
|
|
|
6ef880 |
From: Phil Sutter <phil@nwl.cc>
|
|
|
6ef880 |
Date: Mon, 28 Sep 2020 18:57:18 +0200
|
|
|
6ef880 |
Subject: [PATCH] nft: Fix for broken address mask match detection
|
|
|
6ef880 |
|
|
|
6ef880 |
Trying to decide whether a bitwise expression is needed to match parts
|
|
|
6ef880 |
of a source or destination address only, add_addr() checks if all bytes
|
|
|
6ef880 |
in 'mask' are 0xff or not. The check is apparently broken though as each
|
|
|
6ef880 |
byte in 'mask' is cast to a signed char before comparing against 0xff,
|
|
|
6ef880 |
therefore the bitwise is always added:
|
|
|
6ef880 |
|
|
|
6ef880 |
| # ./bad/iptables-nft -A foo -s 10.0.0.1 -j ACCEPT
|
|
|
6ef880 |
| # ./good/iptables-nft -A foo -s 10.0.0.2 -j ACCEPT
|
|
|
6ef880 |
| # nft --debug=netlink list chain ip filter foo
|
|
|
6ef880 |
| ip filter foo 5
|
|
|
6ef880 |
| [ payload load 4b @ network header + 12 => reg 1 ]
|
|
|
6ef880 |
| [ bitwise reg 1 = (reg=1 & 0xffffffff ) ^ 0x00000000 ]
|
|
|
6ef880 |
| [ cmp eq reg 1 0x0100000a ]
|
|
|
6ef880 |
| [ counter pkts 0 bytes 0 ]
|
|
|
6ef880 |
| [ immediate reg 0 accept ]
|
|
|
6ef880 |
|
|
|
|
6ef880 |
| ip filter foo 6 5
|
|
|
6ef880 |
| [ payload load 4b @ network header + 12 => reg 1 ]
|
|
|
6ef880 |
| [ cmp eq reg 1 0x0200000a ]
|
|
|
6ef880 |
| [ counter pkts 0 bytes 0 ]
|
|
|
6ef880 |
| [ immediate reg 0 accept ]
|
|
|
6ef880 |
|
|
|
|
6ef880 |
| table ip filter {
|
|
|
6ef880 |
| chain foo {
|
|
|
6ef880 |
| ip saddr 10.0.0.1 counter packets 0 bytes 0 accept
|
|
|
6ef880 |
| ip saddr 10.0.0.2 counter packets 0 bytes 0 accept
|
|
|
6ef880 |
| }
|
|
|
6ef880 |
| }
|
|
|
6ef880 |
|
|
|
6ef880 |
Fix the cast, safe an extra op and gain 100% performance in ideal cases.
|
|
|
6ef880 |
|
|
|
6ef880 |
Fixes: 56859380eb328 ("xtables-compat: avoid unneeded bitwise ops")
|
|
|
6ef880 |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
6ef880 |
(cherry picked from commit 72ed608bf1ea550ac13b5b880afc7ad3ffa0afd0)
|
|
|
6ef880 |
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
|
6ef880 |
---
|
|
|
6ef880 |
iptables/nft-shared.c | 2 +-
|
|
|
6ef880 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
6ef880 |
|
|
|
6ef880 |
diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
|
|
|
6ef880 |
index 78e422781723f..f60f5df97fb86 100644
|
|
|
6ef880 |
--- a/iptables/nft-shared.c
|
|
|
6ef880 |
+++ b/iptables/nft-shared.c
|
|
|
6ef880 |
@@ -165,7 +165,7 @@ void add_outiface(struct nftnl_rule *r, char *iface, uint32_t op)
|
|
|
6ef880 |
void add_addr(struct nftnl_rule *r, int offset,
|
|
|
6ef880 |
void *data, void *mask, size_t len, uint32_t op)
|
|
|
6ef880 |
{
|
|
|
6ef880 |
- const char *m = mask;
|
|
|
6ef880 |
+ const unsigned char *m = mask;
|
|
|
6ef880 |
int i;
|
|
|
6ef880 |
|
|
|
6ef880 |
add_payload(r, offset, len, NFT_PAYLOAD_NETWORK_HEADER);
|
|
|
6ef880 |
--
|
|
|
6ef880 |
2.28.0
|
|
|
6ef880 |
|