Re: [PATCH iptables] extensions: libebt_stp: fix range checking

[Phil Sutter <phil@nwl.cc>]

On Wed, Jan 24, 2024 at 03:37:57PM +0100, Florian Westphal wrote:
> Phil Sutter <phil@nwl.cc> wrote:
> > On Tue, Jan 23, 2024 at 05:49:33PM +0100, Florian Westphal wrote:
> > > This has to either consider ->nvals > 1 or check the values
> > > post-no-range-fixup:
> > > 
> > > ./iptables-test.py  extensions/libebt_stp.t
> > > extensions/libebt_stp.t: ERROR: line 12 (cannot load: ebtables -A INPUT --stp-root-cost 1)
> > > 
> > > (it tests 0 < 1 and fails, but test should be 1 < 1).
> > > 
> > > Fixes: dc6efcfeac38 ("extensions: libebt_stp: Use guided option parser")
> > > Signed-off-by: Florian Westphal <fw@strlen.de>
> > > ---
> > >  extensions/libebt_stp.c | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > 
> > > diff --git a/extensions/libebt_stp.c b/extensions/libebt_stp.c
> > > index 81054b26c1f0..371fa04c870f 100644
> > > --- a/extensions/libebt_stp.c
> > > +++ b/extensions/libebt_stp.c
> > > @@ -142,7 +142,7 @@ static void brstp_parse(struct xt_option_call *cb)
> > >  #define RANGE_ASSIGN(name, fname, val) {				    \
> > >  		stpinfo->config.fname##l = val[0];			    \
> > >  		stpinfo->config.fname##u = cb->nvals > 1 ? val[1] : val[0]; \
> > > -		if (val[1] < val[0])					    \
> > > +		if (stpinfo->config.fname##u < stpinfo->config.fname##l)    \
> > >  			xtables_error(PARAMETER_PROBLEM,		    \
> > >  				      "Bad --stp-" name " range");	    \
> > >  }
> > 
> > This is odd: xtopt_parse_mint() assigns UINT32_MAX to val[1] for
> > XTTYPE_UINT32RC if no upper end is given. Also, extensions/libebt_stp.t
> > passes for me. What's missing on my end?
> 
> No fukcing clue. did git clean -d -f -x and it works now without the
> patch.

My first guess was outdated libxtables, but xtopt_parse_mint() is
basically unchanged since 2011 at least.

> I hate my life.

While you correctly hate the game instead of its player, you probably
hate the wrong game: The code above indeed is confusing. Maybe one
should move that monotonicity check into libxtables which should
simplify it quite a bit. I'll have a look. :)

Thanks, Phil