From 330f5df03ad589b46865ceedf2a54cf10a4225ba Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 19 Feb 2021 16:54:57 +0100 Subject: nft: Fix bitwise expression avoidance detection Byte-boundary prefix detection was too sloppy: Any data following the first zero-byte was ignored. Add a follow-up loop making sure there are no stray bits in the designated host part. Fixes: 323259001d617 ("nft: Optimize class-based IP prefix matches") Signed-off-by: Phil Sutter --- iptables/nft-shared.c | 4 +++- .../shell/testcases/ip6tables/0004-address-masks_0 | 24 ++++++++++++++++++++++ 2 files changed, 27 insertions(+), 1 deletion(-) create mode 100755 iptables/tests/shell/testcases/ip6tables/0004-address-masks_0 diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c index 10553ab2..c1664b50 100644 --- a/iptables/nft-shared.c +++ b/iptables/nft-shared.c @@ -166,7 +166,7 @@ void add_addr(struct nftnl_rule *r, enum nft_payload_bases base, int offset, { const unsigned char *m = mask; bool bitwise = false; - int i; + int i, j; for (i = 0; i < len; i++) { if (m[i] != 0xff) { @@ -174,6 +174,8 @@ void add_addr(struct nftnl_rule *r, enum nft_payload_bases base, int offset, break; } } + for (j = i + 1; !bitwise && j < len; j++) + bitwise = !!m[j]; if (!bitwise) len = i; diff --git a/iptables/tests/shell/testcases/ip6tables/0004-address-masks_0 b/iptables/tests/shell/testcases/ip6tables/0004-address-masks_0 new file mode 100755 index 00000000..7eb42f08 --- /dev/null +++ b/iptables/tests/shell/testcases/ip6tables/0004-address-masks_0 @@ -0,0 +1,24 @@ +#!/bin/bash + +set -e + +$XT_MULTI ip6tables-restore <