[PATCH nft] netlink_linearize: fix wrong comparison in netlink_gen_flagcmp()

[PATCH nft] netlink_linearize: fix wrong comparison in netlink_gen_flagcmp()

[Pablo Neira Ayuso]

 nft add rule filter input ct state established,related counter drop

is not matching here due to a wrong comparison in the rule:

 ip filter input 20 19
   [ ct load state => reg 1 ]
   [ bitwise reg 1 = (reg=1 & 0x00000006 ) ^ 0x00000000 ]
   [ cmp neq reg 1 0x00000006 ] <----- this has to be zero
   [ counter pkts 0 bytes 0 ]
   [ immediate reg 0 drop ]

There's a line that generates the value from the right-hand
expression which was not in the original code. This bug was
introduced in aae836a ("src: use libnftables").

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/netlink_linearize.c |    1 -
 1 file changed, 1 deletion(-)

diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c
index 332383a..3e9a078 100644
--- a/src/netlink_linearize.c
+++ b/src/netlink_linearize.c
@@ -285,7 +285,6 @@ static void netlink_gen_flagcmp(struct netlink_linearize_ctx *ctx,
 	netlink_gen_raw_data(zero, expr->right->byteorder, len, &nld);
 	nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_SREG, sreg);
 	nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_OP, NFT_CMP_NEQ);
-	netlink_gen_data(expr->right, &nld);
 	nft_rule_expr_set(nle, NFT_EXPR_CMP_DATA, nld.value, nld.len);
 	nft_rule_add_expr(ctx->nlr, nle);
 
-- 
1.7.10.4

Re: [PATCH nft] netlink_linearize: fix wrong comparison in netlink_gen_flagcmp()

[Patrick McHardy]

On Sun, Feb 16, 2014 at 11:42:02PM +0100, Pablo Neira Ayuso wrote:
>  nft add rule filter input ct state established,related counter drop
> 
> is not matching here due to a wrong comparison in the rule:
> 
>  ip filter input 20 19
>    [ ct load state => reg 1 ]
>    [ bitwise reg 1 = (reg=1 & 0x00000006 ) ^ 0x00000000 ]
>    [ cmp neq reg 1 0x00000006 ] <----- this has to be zero
>    [ counter pkts 0 bytes 0 ]
>    [ immediate reg 0 drop ]
> 
> There's a line that generates the value from the right-hand
> expression which was not in the original code. This bug was
> introduced in aae836a ("src: use libnftables").

I already pushed that patch two or three hours ago.

Re: [PATCH nft] netlink_linearize: fix wrong comparison in netlink_gen_flagcmp()

[Pablo Neira Ayuso]

On Sun, Feb 16, 2014 at 10:43:32PM +0000, Patrick McHardy wrote:
> On Sun, Feb 16, 2014 at 11:42:02PM +0100, Pablo Neira Ayuso wrote:
> >  nft add rule filter input ct state established,related counter drop
> > 
> > is not matching here due to a wrong comparison in the rule:
> > 
> >  ip filter input 20 19
> >    [ ct load state => reg 1 ]
> >    [ bitwise reg 1 = (reg=1 & 0x00000006 ) ^ 0x00000000 ]
> >    [ cmp neq reg 1 0x00000006 ] <----- this has to be zero
> >    [ counter pkts 0 bytes 0 ]
> >    [ immediate reg 0 drop ]
> > 
> > There's a line that generates the value from the right-hand
> > expression which was not in the original code. This bug was
> > introduced in aae836a ("src: use libnftables").
> 
> I already pushed that patch two or three hours ago.

Thanks Patrick. I noticed this when testing state established,related.
Please, send your patches to nf-devel next time, I would have noticed
and saved that time.

Re: [PATCH nft] netlink_linearize: fix wrong comparison in netlink_gen_flagcmp()

[Patrick McHardy]

On Mon, Feb 17, 2014 at 11:16:44AM +0100, Pablo Neira Ayuso wrote:
> On Sun, Feb 16, 2014 at 10:43:32PM +0000, Patrick McHardy wrote:
> > On Sun, Feb 16, 2014 at 11:42:02PM +0100, Pablo Neira Ayuso wrote:
> > >  nft add rule filter input ct state established,related counter drop
> > > 
> > > is not matching here due to a wrong comparison in the rule:
> > > 
> > >  ip filter input 20 19
> > >    [ ct load state => reg 1 ]
> > >    [ bitwise reg 1 = (reg=1 & 0x00000006 ) ^ 0x00000000 ]
> > >    [ cmp neq reg 1 0x00000006 ] <----- this has to be zero
> > >    [ counter pkts 0 bytes 0 ]
> > >    [ immediate reg 0 drop ]
> > > 
> > > There's a line that generates the value from the right-hand
> > > expression which was not in the original code. This bug was
> > > introduced in aae836a ("src: use libnftables").
> > 
> > I already pushed that patch two or three hours ago.
> 
> Thanks Patrick. I noticed this when testing state established,related.
> Please, send your patches to nf-devel next time, I would have noticed
> and saved that time.

I actually did, but it was burried inside a thread with Florian. Some
related patches coming up soon ...