Re: [PATCH 1/2] NFQUEUE: Fix bug with order of fanout and bypass

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Apr 14, 2016 at 08:55:58PM +0530, Shivani Bhardwaj wrote:
> NFQUEUE had a bug with the ordering of fanout and bypass options which
> was arising due to same and odd values for flags and bypass when used
> together. Because of this, during bitwise ANDing of flags and
> NFQ_FLAG_CPU_FANOUT, the value always evaluated to false (since
> NFQ_FLAG_CPU_FANOUT=0x02) and led to skipping of fanout option
> whenever it was used before bypass because then flags would be 1.
> 
> Before this patch,
> 
> $ sudo iptables -A FORWARD -j NFQUEUE -p TCP --sport 80 --queue-balance 0:3 --queue-cpu-fanout --queue-bypass
>
> Chain FORWARD (policy ACCEPT)
> target     prot opt source               destination
> NFQUEUE    tcp  --  anywhere             anywhere             tcp spt:http NFQUEUE balance 0:3 bypass
> 
> After this patch,
> 
> Chain FORWARD (policy ACCEPT)
> target     prot opt source               destination
> NFQUEUE    tcp  --  anywhere             anywhere             tcp spt:http NFQUEUE balance 0:3 bypass cpu-fanout
> 
> Closes bugzilla entry: http://bugzilla.netfilter.org/show_bug.cgi?id=939

Shivani, thanks for following up on this.

Would you also update extensions/libxt_NFQUEUE.t to add a test so we
make sure this regression doesn't happen ever again?

Thanks.