From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail.netfilter.org (mail.netfilter.org [217.70.190.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8CB8B3CE495; Sun, 27 Sep 2026 22:34:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.70.190.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790548497; cv=none; b=nIENsTOnW09fPv2sB3ginGi59wEPFS3ghSOhN4BhbYhJp6346SzH60dgxVOW9VBYlO3UTmW+4qew48zvMjLKI5Oy+rw98l9muIvNtbGkR/opGlUqbgKz6HQC/aTtJR6K+dccaR8OyRQow7A80VR77MbFP0CtMQFw8yX0KGriByI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790548497; c=relaxed/simple; bh=8yUOP4MHPaZjh1o+fymB4lilWgDd9qez7c07r68i8Ww=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Ea+m6Th5/8DyWgnBk/a8EPaqG7tSX093T4BeYZcs1pYTdupt4LhhcUsc6c8cSPQzpNZUvm4XGaI4fTeMM6uOxvBQw8so019kpvX8JLh0gY6JztrxxYYMtJ6XYj4CzpAwqLtafvhZgySds5mjUbJ9zTnmWkN02y+FhPtY122AsXY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=netfilter.org; spf=pass smtp.mailfrom=netfilter.org; dkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org header.b=IEDPlkpq; arc=none smtp.client-ip=217.70.190.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=netfilter.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=netfilter.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org header.b="IEDPlkpq" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=netfilter.org; s=2025; t=1790548493; bh=T7kWMpw/KWhgSv7pN6WXS7EDEL0By4VhveIiNgA1jR8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IEDPlkpqwNINgVEJxjWqP1roISUtB930DbkMS0ty+CZv4XJCMoCtoN0AQzn18MDnc QZUc+w3+BFlISlKWgTmFqMTYSKv6KjyReDVFvZ8Oag41mtvEyE+emvNzfiNnZFPB52 64vreHcujwRsNww62jN5dseY+9zaPHFG888aFOk51+6aT1AKov1C+wKdpR64CyycN2 vUYDNLCn1pKI2tcT3Pf41xWhQNPkLAuC/UzMPMTcM5Dac4OYYBtZL58f9Dlwr+xALB p8tx6BbeEjVsqM+u1X53wpsMJgDmUPUNPvNPbfgvxvce6ei/aRTd7q0Ep4llPC5ac2 JFaDf8DfnWd9Q== Received: from localhost.localdomain (mail-agni [217.70.190.124]) by mail.netfilter.org (Postfix) with ESMTPSA id 2C1456008F; Mon, 28 Sep 2026 00:34:53 +0200 (CEST) From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Cc: davem@davemloft.net, netdev@vger.kernel.org, kuba@kernel.org, pabeni@redhat.com, edumazet@google.com, horms@kernel.org, fw@strlen.de, ja@ssi.bg Subject: [PATCH net-next 10/11] netfilter: ctnetlink: fix inverted IPv6 address match in dump filter Date: Mon, 28 Sep 2026 00:34:35 +0200 Message-ID: <20260927223436.269024-11-pablo@netfilter.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260927223436.269024-1-pablo@netfilter.org> References: <20260927223436.269024-1-pablo@netfilter.org> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Piotr Kubik ctnetlink_filter_match_tuple() rejects an entry when !ipv6_addr_cmp(filter, entry) is true. ipv6_addr_cmp() is a memcmp() and returns 0 for equal addresses, so the condition is true exactly when the addresses match: a CTA_FILTER dump with an IPv6 CTA_IP_SRC or CTA_IP_DST skips every entry that matches the requested address and returns all the others. The IPv4 branch compares with != and behaves correctly. Observed with libnetfilter_conntrack NFCT_FILTER_DUMP_TUPLE: a dump filtered on src 2001:db8::10 returned only the unrelated entries, and a dump filtered on ::1 returned every entry except the ::1 ones. conntrack-tools does not use the tuple filter for -L, which is why this went unnoticed. Use ipv6_addr_equal() so the IPv6 branch mirrors the IPv4 one. Fixes: cb8aa9a3affb ("netfilter: ctnetlink: add kernel side filtering for dump") Cc: stable@vger.kernel.org Signed-off-by: Piotr Kubik Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_conntrack_netlink.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index 4e5d7c701436..e8477f792c95 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -1098,13 +1098,13 @@ static int ctnetlink_filter_match_tuple(struct nf_conntrack_tuple *filter_tuple, break; case NFPROTO_IPV6: if ((flags & CTA_FILTER_FLAG(CTA_IP_SRC)) && - !ipv6_addr_cmp(&filter_tuple->src.u3.in6, - &ct_tuple->src.u3.in6)) + !ipv6_addr_equal(&filter_tuple->src.u3.in6, + &ct_tuple->src.u3.in6)) return 0; if ((flags & CTA_FILTER_FLAG(CTA_IP_DST)) && - !ipv6_addr_cmp(&filter_tuple->dst.u3.in6, - &ct_tuple->dst.u3.in6)) + !ipv6_addr_equal(&filter_tuple->dst.u3.in6, + &ct_tuple->dst.u3.in6)) return 0; break; } -- 2.47.3