[iptables PATCH 1/2] nft: Special casing for among match in compare_matches()

[iptables PATCH 1/2] nft: Special casing for among match in compare_matches()

[Phil Sutter]

When other extensions may have "garbage" appended to their data which
should not be considered for match comparison, among match is the
opposite in that it extends its data beyond the value in 'size' field.
Add special casing to cover for this, avoiding false-positive rule
comparison.

Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 iptables/nft-shared.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
index 12860fbf6d575..0cd082b5396d0 100644
--- a/iptables/nft-shared.c
+++ b/iptables/nft-shared.c
@@ -381,6 +381,7 @@ bool compare_matches(struct xtables_rule_match *mt1,
 	for (mp1 = mt1, mp2 = mt2; mp1 && mp2; mp1 = mp1->next, mp2 = mp2->next) {
 		struct xt_entry_match *m1 = mp1->match->m;
 		struct xt_entry_match *m2 = mp2->match->m;
+		size_t cmplen = mp1->match->userspacesize;
 
 		if (strcmp(m1->u.user.name, m2->u.user.name) != 0) {
 			DEBUGP("mismatching match name\n");
@@ -392,8 +393,10 @@ bool compare_matches(struct xtables_rule_match *mt1,
 			return false;
 		}
 
-		if (memcmp(m1->data, m2->data,
-			   mp1->match->userspacesize) != 0) {
+		if (!strcmp(m1->u.user.name, "among"))
+			cmplen = m1->u.match_size - sizeof(*m1);
+
+		if (memcmp(m1->data, m2->data, cmplen) != 0) {
 			DEBUGP("mismatch match data\n");
 			return false;
 		}
-- 
2.40.0

[iptables PATCH 2/2] nft: More verbose extension comparison debugging

[Phil Sutter]

Dump extension data if it differs.

Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 iptables/nft-shared.c | 2 ++
 iptables/xshared.h    | 7 +++++++
 2 files changed, 9 insertions(+)

diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
index 0cd082b5396d0..34ca9d16569d0 100644
--- a/iptables/nft-shared.c
+++ b/iptables/nft-shared.c
@@ -398,6 +398,8 @@ bool compare_matches(struct xtables_rule_match *mt1,
 
 		if (memcmp(m1->data, m2->data, cmplen) != 0) {
 			DEBUGP("mismatch match data\n");
+			DEBUG_HEXDUMP("m1->data", m1->data, cmplen);
+			DEBUG_HEXDUMP("m2->data", m2->data, cmplen);
 			return false;
 		}
 	}
diff --git a/iptables/xshared.h b/iptables/xshared.h
index 0ed9f3c29c600..a200e0d620ad3 100644
--- a/iptables/xshared.h
+++ b/iptables/xshared.h
@@ -12,8 +12,15 @@
 
 #ifdef DEBUG
 #define DEBUGP(x, args...) fprintf(stderr, x, ## args)
+#define DEBUG_HEXDUMP(pfx, data, len)					\
+	for (int __i = 0; __i < (len); __i++) {				\
+		if (__i % 16 == 0)					\
+			printf("%s%s: ", __i ? "\n" : "", (pfx));	\
+		printf("%02x ", ((const unsigned char *)data)[__i]);	\
+	} printf("\n")
 #else
 #define DEBUGP(x, args...)
+#define DEBUG_HEXDUMP(pfx, data, len)
 #endif
 
 enum {
-- 
2.40.0

Re: [iptables PATCH 1/2] nft: Special casing for among match in compare_matches()

[Phil Sutter]

On Fri, Jul 21, 2023 at 10:14:24PM +0200, Phil Sutter wrote:
> When other extensions may have "garbage" appended to their data which
> should not be considered for match comparison, among match is the
> opposite in that it extends its data beyond the value in 'size' field.
> Add special casing to cover for this, avoiding false-positive rule
> comparison.
> 
> Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support")
> Signed-off-by: Phil Sutter <phil@nwl.cc>

Series applied.