nft-arp: fix is_same_interfaces arguments

PATCH Applied Giuseppe Longo 2 participants 2 messages Mar 7, 2014 netfilter

lore

Share & tools

lore

Giuseppe Longo

author

2014-03-07 10:42 UTC #0 lore raw

PATCH 1/1 nft-arp: fix is_same_interfaces arguments

Wrong arguments are passed to is_same_interfaces that causes sometimes to delete a wrong rule. See the example below:

arptables-compat -A INPUT -i eth0 -j ACCEPT arptables-compat -A INPUT -i eth1 -j ACCEPT arptables-compat -A INPUT -i eth2 -j ACCEPT

arptables-compat -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
-j ACCEPT -i eth0
-j ACCEPT -i eth1
-j ACCEPT -i eth2

arptables-compat -D INPUT -i eth2 -j ACCEPT

arptables-compat -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
-j ACCEPT -i eth1
-j ACCEPT -i eth2

Signed-off-by Giuseppe Longo <[email protected]>

---
 iptables/nft-arp.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

iptables/nft-arp.c +8 -8

index a494ee6..1af7202 100644
@@ -631,14 +631,14 @@ static bool nft_arp_is_same(const void *data_a,
 		return false;
 	}
 
-	return is_same_interfaces(a->arp.src_devaddr.addr,
-				  a->arp.tgt_devaddr.addr,
-				  (unsigned char*)a->arp.src_devaddr.mask,
-				  (unsigned char*)a->arp.tgt_devaddr.mask,
-				  b->arp.src_devaddr.addr,
-				  a->arp.tgt_devaddr.addr,
-				  (unsigned char*)b->arp.src_devaddr.mask,
-				  (unsigned char*)b->arp.tgt_devaddr.mask);
+	return is_same_interfaces(a->arp.iniface,
+				  a->arp.outiface,
+				  (unsigned char *)a->arp.iniface_mask,
+				  (unsigned char *)a->arp.outiface_mask,
+				  b->arp.iniface,
+				  b->arp.outiface,
+				  (unsigned char *)b->arp.iniface_mask,
+				  (unsigned char *)b->arp.outiface_mask);
 }
 
 static bool nft_arp_rule_find(struct nft_family_ops *ops, struct nft_rule *r,

Signature · 1 line

1.8.3.2

Pablo Neira Ayuso

maintainer Applied

2014-03-07 17:32 UTC #1 lore raw

Quoted 20 lines · Giuseppe Longo

Wrong arguments are passed to is_same_interfaces that causes sometimes to delete a wrong rule. See the example below:
arptables-compat -A INPUT -i eth0 -j ACCEPT arptables-compat -A INPUT -i eth1 -j ACCEPT arptables-compat -A INPUT -i eth2 -j ACCEPT
arptables-compat -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
(quoted diff) +0 -3
-j ACCEPT -i eth0
-j ACCEPT -i eth1
-j ACCEPT -i eth2
arptables-compat -D INPUT -i eth2 -j ACCEPT
arptables-compat -L
Chain INPUT (policy ACCEPT)
target prot opt source destination

Review

Quoted 2 lines

(quoted diff) +0 -2

-j ACCEPT -i eth1
-j ACCEPT -i eth2

Applied, thanks.