Comment match allocation in command_match() and
nft_rule_to_iptables_command_state() were misaligned in that the latter
set match_size to just what is required instead of what the match needs
at maximum like the further. This led to failure when comparing them
later and therefore a rule with a comment could not be deleted.
For comments of a specific length, the udata buffer is padded by
libnftnl so nftnl_rule_get_data() returns a length value which is larger
than the string (including NULL-byte). The trailing data is supposed to
be ignored, but compare_matches() can't not know about that detail and
therefore returns a false-negative if trailing data contains junk. To
overcome this, use strncpy() when populating match data in
nft_rule_to_iptables_command_state(). While being at it, make sure
comment match allocation in that function is identical to what
command_match() does with regards to data allocation size. Also use
xtables_calloc() which does the required error checking.
Signed-off-by: Phil Sutter <phil@xxxxxx>
---
Changes since v1:
- Use /bin/bash in testcase.
Changes since v2:
- Fix for odd comment lengths.
---
iptables/nft-shared.c | 15 ++++++---------
.../testcases/nft-only/0003delete-with-comment_0 | 15 +++++++++++++++
2 files changed, 21 insertions(+), 9 deletions(-)
create mode 100755 iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0
diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
index 4557f17d43630..c8414294833c5 100644
--- a/iptables/nft-shared.c
+++ b/iptables/nft-shared.c
@@ -646,7 +646,7 @@ void nft_rule_to_iptables_command_state(const struct nftnl_rule *r,
if (nftnl_rule_is_set(r, NFTNL_RULE_USERDATA)) {
const void *data;
- uint32_t len;
+ uint32_t len, size;
struct xtables_match *match;
struct xt_entry_match *m;
@@ -656,15 +656,12 @@ void nft_rule_to_iptables_command_state(const struct nftnl_rule *r,
if (match == NULL)
return;
- m = calloc(1, sizeof(struct xt_entry_match) +
- sizeof(struct xt_comment_info));
- if (m == NULL) {
- fprintf(stderr, "OOM");
- exit(EXIT_FAILURE);
- }
+ size = XT_ALIGN(sizeof(struct xt_entry_match)) + match->size;
+ m = xtables_calloc(1, size);
- memcpy(&m->data, get_comment(data, len), len);
- m->u.match_size = len + XT_ALIGN(sizeof(struct xt_entry_match));
+ strncpy((char *)m->data, get_comment(data, len),
+ match->size - 1);
+ m->u.match_size = size;
m->u.user.revision = 0;
strcpy(m->u.user.name, match->name);
diff --git a/iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0 b/iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0
new file mode 100755
index 0000000000000..67af9fd897410
--- /dev/null
+++ b/iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+set -e
+
+[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
+
+comment1="foo bar"
+comment2="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+
+for ipt in iptables ip6tables; do
+ for comment in "$comment1" "$comment2"; do
+ $XT_MULTI $ipt -A INPUT -m comment --comment "$comment" -j ACCEPT
+ $XT_MULTI $ipt -D INPUT -m comment --comment "$comment" -j ACCEPT
+ done
+done
--
2.18.0
