path: root/iptables/nft-shared.c
diff options
authorPhil Sutter <>2018-08-28 21:44:16 +0200
committerFlorian Westphal <>2018-08-29 17:29:35 +0200
commit3bb497c61d743ba811e7f501e54cc5071216e1f5 (patch)
tree672991d2f7422e57cec3e5ccaa0697bb84320393 /iptables/nft-shared.c
parent0800d9b46b377bc24f15af2c6ae22550b954b6e2 (diff)
xtables: Fix for deleting rules with comment
Comment match allocation in command_match() and nft_rule_to_iptables_command_state() were misaligned in that the latter set match_size to just what is required instead of what the match needs at maximum like the further. This led to failure when comparing them later and therefore a rule with a comment could not be deleted. For comments of a specific length, the udata buffer is padded by libnftnl so nftnl_rule_get_data() returns a length value which is larger than the string (including NULL-byte). The trailing data is supposed to be ignored, but compare_matches() can't not know about that detail and therefore returns a false-negative if trailing data contains junk. To overcome this, use strncpy() when populating match data in nft_rule_to_iptables_command_state(). While being at it, make sure comment match allocation in that function is identical to what command_match() does with regards to data allocation size. Also use xtables_calloc() which does the required error checking. Signed-off-by: Phil Sutter <> Signed-off-by: Florian Westphal <>
Diffstat (limited to 'iptables/nft-shared.c')
1 files changed, 6 insertions, 9 deletions
diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
index 4557f17d..c8414294 100644
--- a/iptables/nft-shared.c
+++ b/iptables/nft-shared.c
@@ -646,7 +646,7 @@ void nft_rule_to_iptables_command_state(const struct nftnl_rule *r,
if (nftnl_rule_is_set(r, NFTNL_RULE_USERDATA)) {
const void *data;
- uint32_t len;
+ uint32_t len, size;
struct xtables_match *match;
struct xt_entry_match *m;
@@ -656,15 +656,12 @@ void nft_rule_to_iptables_command_state(const struct nftnl_rule *r,
if (match == NULL)
- m = calloc(1, sizeof(struct xt_entry_match) +
- sizeof(struct xt_comment_info));
- if (m == NULL) {
- fprintf(stderr, "OOM");
- }
+ size = XT_ALIGN(sizeof(struct xt_entry_match)) + match->size;
+ m = xtables_calloc(1, size);
- memcpy(&m->data, get_comment(data, len), len);
- m->u.match_size = len + XT_ALIGN(sizeof(struct xt_entry_match));
+ strncpy((char *)m->data, get_comment(data, len),
+ match->size - 1);
+ m->u.match_size = size;
m->u.user.revision = 0;
strcpy(m->, match->name);