diff options
author | Phil Sutter <phil@nwl.cc> | 2018-08-28 21:44:16 +0200 |
---|---|---|
committer | Florian Westphal <fw@strlen.de> | 2018-08-29 17:29:35 +0200 |
commit | 3bb497c61d743ba811e7f501e54cc5071216e1f5 (patch) | |
tree | 672991d2f7422e57cec3e5ccaa0697bb84320393 | |
parent | 0800d9b46b377bc24f15af2c6ae22550b954b6e2 (diff) |
xtables: Fix for deleting rules with comment
Comment match allocation in command_match() and
nft_rule_to_iptables_command_state() were misaligned in that the latter
set match_size to just what is required instead of what the match needs
at maximum like the further. This led to failure when comparing them
later and therefore a rule with a comment could not be deleted.
For comments of a specific length, the udata buffer is padded by
libnftnl so nftnl_rule_get_data() returns a length value which is larger
than the string (including NULL-byte). The trailing data is supposed to
be ignored, but compare_matches() can't not know about that detail and
therefore returns a false-negative if trailing data contains junk. To
overcome this, use strncpy() when populating match data in
nft_rule_to_iptables_command_state(). While being at it, make sure
comment match allocation in that function is identical to what
command_match() does with regards to data allocation size. Also use
xtables_calloc() which does the required error checking.
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Florian Westphal <fw@strlen.de>
-rw-r--r-- | iptables/nft-shared.c | 15 | ||||
-rwxr-xr-x | iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0 | 15 |
2 files changed, 21 insertions, 9 deletions
diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c index 4557f17d..c8414294 100644 --- a/iptables/nft-shared.c +++ b/iptables/nft-shared.c @@ -646,7 +646,7 @@ void nft_rule_to_iptables_command_state(const struct nftnl_rule *r, if (nftnl_rule_is_set(r, NFTNL_RULE_USERDATA)) { const void *data; - uint32_t len; + uint32_t len, size; struct xtables_match *match; struct xt_entry_match *m; @@ -656,15 +656,12 @@ void nft_rule_to_iptables_command_state(const struct nftnl_rule *r, if (match == NULL) return; - m = calloc(1, sizeof(struct xt_entry_match) + - sizeof(struct xt_comment_info)); - if (m == NULL) { - fprintf(stderr, "OOM"); - exit(EXIT_FAILURE); - } + size = XT_ALIGN(sizeof(struct xt_entry_match)) + match->size; + m = xtables_calloc(1, size); - memcpy(&m->data, get_comment(data, len), len); - m->u.match_size = len + XT_ALIGN(sizeof(struct xt_entry_match)); + strncpy((char *)m->data, get_comment(data, len), + match->size - 1); + m->u.match_size = size; m->u.user.revision = 0; strcpy(m->u.user.name, match->name); diff --git a/iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0 b/iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0 new file mode 100755 index 00000000..67af9fd8 --- /dev/null +++ b/iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0 @@ -0,0 +1,15 @@ +#!/bin/bash + +set -e + +[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } + +comment1="foo bar" +comment2="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" + +for ipt in iptables ip6tables; do + for comment in "$comment1" "$comment2"; do + $XT_MULTI $ipt -A INPUT -m comment --comment "$comment" -j ACCEPT + $XT_MULTI $ipt -D INPUT -m comment --comment "$comment" -j ACCEPT + done +done |