Re: Raw Payload Expressions - out of bounds write?

Pablo Neira Ayuso <[email protected]>
Newsgroups gmane.comp.security.firewalls.netfilter.general
Message-ID <Z5jQgcbCXiLyPwV-@calendula>
On Tue, Jan 28, 2025 at 01:37:06AM +0100, Florian Westphal wrote:
> Sunny73Cr <[email protected]> wrote:
> > > Please elaborate as what is wrong here in listing 3.
> > 
> > Within the second line of the rule (@ih,80,16 set @ih,80,16 & 0x3f0 \)
> > 
> > The mask 0x3f0 equates to 1,008 in decimal.
> > (3 * 16**2) + (15 * 16**1) + (0 * 16^0) = 1,008
> > Here '**' indicates exponent.
> > 
> > 1,008 is far larger than the 34 bit range that I covered.
> 
> Sigh.  Why did you not say something like:
> 
> The mask is provided as '0x3f0' in the listing, but I had expected
> 0xfc0f, as only 6 bits should be cleared, but the mask KEEPS 6 bits.
> 
> It would have saved me a headache figuring out bug you refer to.
> I am not a mind reader :-/
> 
> Use --debug=netlink, it looks like its a display bug.
> 
> I'll have a look.

It looks like netlink_delinearize is missing code to compact the
expression.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.