conntrack: fix autogenerated BPF code for IPv6 filtering

BPF code generated for IPv6 filtering was wrong.

Assuming you want to allow all traffic except ::1, the filter that
libnetfilter_conntrack generates for the IPv6 address part looks like:

[...]
(0032) code=          BPF_LD|BPF_W|BPF_IND      jt=00 jf=00 k=00000004
(0033) code=         BPF_ALU|BPF_AND|BPF_K      jt=00 jf=00 k=ffffffff
(0034) code=         BPF_JMP|BPF_JEQ|BPF_K      jt=00 jf=0a k=00000000
(0035) code=          BPF_LD|BPF_W|BPF_IND      jt=00 jf=00 k=00000008   [0]
(0036) code=         BPF_ALU|BPF_AND|BPF_K      jt=00 jf=00 k=ffffffff   [1]
(0037) code=         BPF_JMP|BPF_JEQ|BPF_K      jt=00 jf=07 k=00000000   [2]
(0038) code=          BPF_LD|BPF_W|BPF_IND      jt=00 jf=00 k=0000000c   [3]
(0039) code=         BPF_ALU|BPF_AND|BPF_K      jt=00 jf=00 k=ffffffff   [4]
(003a) code=         BPF_JMP|BPF_JEQ|BPF_K      jt=00 jf=04 k=00000000   [5]
(003b) code=          BPF_LD|BPF_W|BPF_IND      jt=00 jf=00 k=00000010   [6]
(003c) code=         BPF_ALU|BPF_AND|BPF_K      jt=00 jf=00 k=ffffffff   [7]
(003d) code=         BPF_JMP|BPF_JEQ|BPF_K      jt=01 jf=00 k=00000001   [8]
(003e) code=                BPF_JMP|BPF_JA      jt=00 jf=00 k=00000001   [9]
(003f) code=                 BPF_RET|BPF_K      jt=00 jf=00 k=00000000   [A]

Line 32 loads the first 4 bytes for the 32 bytes IPv6 address, then
line 33 performs the binary AND with the first 4 bytes of the mask.
Line 34 evaluated false for the case 2::1 that Eric reported (since 0x2
is not 0x0). Thus, jumping to line 3f that returns reject. However,
2::1 should be allowed.

This false-jump case depends on the logic we're using, for the negative
logic case, the jump offset is 9 to accept it. In the positive case
(ie. accept this event message if matching happens), it has to be 10 (A),
to reject it.

Reported-by: Eric Leblond <eric@regit.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

0 files changed, 0 insertions, 0 deletions