diff options
author | Florian Westphal <fw@strlen.de> | 2021-09-28 14:16:48 +0200 |
---|---|---|
committer | Florian Westphal <fw@strlen.de> | 2021-09-29 18:31:19 +0200 |
commit | 8a9762dbf15433b6dc361ec03cb3d6f0db652a85 (patch) | |
tree | 06a4b7a33437badf8f796115fad41ffa68cb96b9 /src/payload.c | |
parent | 0693edb9eb01fa5a479dcca7d30b06f52806d22a (diff) |
payload: don't adjust offsets of autogenerated dependency expressions
Pablo says:
user reports that this is broken:
nft --debug=netlink add rule bridge filter forward vlan id 100 vlan id set 200
[..]
[ payload load 2b @ link header + 14 => reg 1 ]
[..]
[ payload load 2b @ link header + 28 => reg 1 ]
[ bitwise reg 1 = ( reg 1 & 0x000000f0 ) ^ 0x0000c800 ]
[ payload write reg 1 => 2b @ link header + 14 csum_type 0 csum_off 0 csum_flags 0x0 ]
offset says 28, it is assuming q-in-q, in this case it is mangling the
existing header.
The problem here is that 'vlan id set 200' needs a read-modify-write
cycle because 'vlan id set' has to preserve bits located in the same byte area
as the vlan id.
The first 'payload load' at offset 14 is generated via 'vlan id 100',
this part is ok.
The second 'payload load' at offset 28 is the bogus one.
Its added as a dependency, but then adjusted because nft evaluation
considers this identical to 'vlan id 1 vlan id '2, where nft assumes
q-in-q.
To fix this, skip offset adjustments for raw expressions and mark the
dependency-generated payload instruction as such.
This is fine because raw payload operations assume that user specifies
base/offset/length manually.
Also add a test case for this.
Reported-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'src/payload.c')
-rw-r--r-- | src/payload.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/payload.c b/src/payload.c index 97b60713..c662900b 100644 --- a/src/payload.c +++ b/src/payload.c @@ -115,7 +115,9 @@ static void payload_expr_pctx_update(struct proto_ctx *ctx, assert(desc->base <= PROTO_BASE_MAX); if (desc->base == base->base) { assert(base->length > 0); - ctx->protocol[base->base].offset += base->length; + + if (!left->payload.is_raw) + ctx->protocol[base->base].offset += base->length; } proto_ctx_update(ctx, desc->base, loc, desc); } |