Skip to contentSkip to conversation

Raw payload matching beyond 2040 bits

DISCUSSION Julien Moutinho 3 participants 3 messages Aug 19, 2022 – Sep 7, 2022 netfilter

lore
Share & tools
lore

Julien Moutinho

author
#0 lore raw

Hi netfilter@,

Apparently matching beyond 2040 bits (255 bytes) starts again at 0 or something like that. Not sure whether this is intended or not,
but in this case a warning would be appreciated.

Thanks for your work,
Julien

# nft add rule inet nat prerouting udp dport 4242 @th,2040,128 0x12345678912345678912345678912345 log
# nft add rule inet nat prerouting udp dport 4242 @th,2048,128 0x12345678912345678912345678912345 log
# nft list ruleset | grep 4242
udp dport 4242 @th,2040,128 0x12345678912345678912345678912345 log
udp dport 4242 udp sport 4660 udp dport 22136 udp length 37155 udp checksum 17767 @th,64,64 0x8912345678912345 log
maintainer
#1 lore raw

Julien Moutinho <[email protected]> wrote:

[ moving to nf-devel ]

Quoted 5 lines

Hi netfilter@,

Apparently matching beyond 2040 bits (255 bytes) starts again at 0 or something like that. Not sure whether this is intended or not,
but in this case a warning would be appreciated.

This is a kernel bug, the offset is truncated to u8 (modulo 256).

maintainer
#2 lore raw
In reply to Julien Moutinho
Quoted 9 lines · Julien Moutinho

Hi netfilter@,

Apparently matching beyond 2040 bits (255 bytes) starts again at 0 or something like that. Not sure whether this is intended or not,
but in this case a warning would be appreciated.

Thanks for your work,
Julien

Quoted 7 lines
# nft add rule inet nat prerouting udp dport 4242 @th,2040,128 0x12345678912345678912345678912345 log
# nft add rule inet nat prerouting udp dport 4242 @th,2048,128 0x12345678912345678912345678912345 log
# nft list ruleset | grep 4242
udp dport 4242 @th,2040,128 0x12345678912345678912345678912345 log
udp dport 4242 udp sport 4660 udp dport 22136 udp length 37155 udp checksum 17767 @th,64,64 0x8912345678912345 log

Upstream kernel fix:

commit 94254f990c07e9ddf1634e0b727fab821c3b5bf9

Author: Pablo Neira Ayuso <[email protected]>
Date:   Sun Aug 21 11:47:04 2022 +0200

netfilter: nft_payload: report ERANGE for too long offset and length