Re: [PATCH next] iptables: on revision mismatch, do not call print/save

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, Apr 21, 2017 at 4:15 PM, Jozsef Kadlecsik
<kadlec@xxxxxxxxxxxxxxxxx> wrote:
> Hi,
>
> On Thu, 8 Dec 2016, Willem de Bruijn wrote:
>
>> From: Willem de Bruijn <willemb@xxxxxxxxxx>
>>
>> Between revisions, the layout of xtables data may change completely.
>> Do not interpret the data in a revision M with a module of revision N.
>>
>> Signed-off-by: Willem de Bruijn <willemb@xxxxxxxxxx>
>> ---
>>  iptables/ip6tables.c | 18 ++++++++++++++----
>>  iptables/iptables.c  | 18 ++++++++++++++----
>>  2 files changed, 28 insertions(+), 8 deletions(-)
>
> The patch breaks backward/forward compatibility in a match/target.
>
> When the list of the revisions of a given match/target of iptables is not
> exactly the same as for the kernel counter part (when the kernel module
> supports less revisions than iptables), then in spite of the supported
> match/target, " [unsupported revision]" is printed instead of the
> arguments. See https://bugzilla.netfilter.org/show_bug.cgi?id=1147.

Thanks for the report.

> Please consider reverting the patch. Or we should not stop in
> xtables_find_match/xtables_find_target at revision checking when the
> revision does not match, until all possibilities is not exhausted.

This seems like the better solution to me. The patch fixes a real issue
where garbage is printed by misinterpreting struct fields. Iptables should
try to lookup the matching revision for a match or target, instead of
returning the first one. I'll take a look.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux