From 3bb497c61d743ba811e7f501e54cc5071216e1f5 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 28 Aug 2018 21:44:16 +0200 Subject: xtables: Fix for deleting rules with comment Comment match allocation in command_match() and nft_rule_to_iptables_command_state() were misaligned in that the latter set match_size to just what is required instead of what the match needs at maximum like the further. This led to failure when comparing them later and therefore a rule with a comment could not be deleted. For comments of a specific length, the udata buffer is padded by libnftnl so nftnl_rule_get_data() returns a length value which is larger than the string (including NULL-byte). The trailing data is supposed to be ignored, but compare_matches() can't not know about that detail and therefore returns a false-negative if trailing data contains junk. To overcome this, use strncpy() when populating match data in nft_rule_to_iptables_command_state(). While being at it, make sure comment match allocation in that function is identical to what command_match() does with regards to data allocation size. Also use xtables_calloc() which does the required error checking. Signed-off-by: Phil Sutter Signed-off-by: Florian Westphal --- .../shell/testcases/nft-only/0003delete-with-comment_0 | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100755 iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0 (limited to 'iptables/tests/shell/testcases') diff --git a/iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0 b/iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0 new file mode 100755 index 00000000..67af9fd8 --- /dev/null +++ b/iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0 @@ -0,0 +1,15 @@ +#!/bin/bash + +set -e + +[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } + +comment1="foo bar" +comment2="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" + +for ipt in iptables ip6tables; do + for comment in "$comment1" "$comment2"; do + $XT_MULTI $ipt -A INPUT -m comment --comment "$comment" -j ACCEPT + $XT_MULTI $ipt -D INPUT -m comment --comment "$comment" -j ACCEPT + done +done -- cgit v1.2.3