Re: [RELEASE] ebtables version 2.0.8-rc3

Bart De Schuymer wrote:
> Op di, 19-12-2006 te 14:44 +0100, schreef Carl-Daniel Hailfinger:
>> Hi Bart,
>>
>> the -fPIC problem on x86_64 is still there:
> 
> <snip>
>> Explanation: uint64_t is unsigned long long on i386, but unsigned long
>> on x86_64.
> 
> Should be fixed in CVS, thanks.

Thanks!

>> The problems of creating rules on x86_64 is still there. However, it seems
>> that Al Viro has fixed something in this area:
>> http://www2.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=bb2ef25c2c62444b8fdb0346a23658a419803df9
> 
> That's unrelated, it fixes the checking for maliciously constructed
> ebtables tables.

Then normal ebtables userspace on x86_64 definitely counts as malicious.

I was referring to this part of the changelog:
> While we are at it, don't subtract unrelated pointers...

The problems with loading rules on x86_64 have disappeared after
applying the patch series from Al Viro.

However, the "among" match still reports problems:
# ebtables -t nat -A ebtables-experiment --among-dst 2:3:4:5:6:7=192.168.0.1,2:3:4:5:6:8=192.168.0.3,2:3:4:5:6:9=192.168.0.2 -j ACCEPT
old_size=56,new_size=1124, sizeof(ebt_entry_match)=40, msize=1084
wh_dst_ofs=16
The kernel doesn't support a certain ebtables extension, consider recompiling your kernel or insmod the extension.

dmesg says (debugging added by me):
ebtables: among: wrong size: 1084 against expected 1080, rounded to 1080, sizeof(ebt_among_info)=12, wh_size(dst)=1068, wh_size(src)=0, sizeof(ebt_entry_match)=40
kernel msg: ebtables bug: please report to author: match->check failed

The source of the problem is easy to spot:
In userspace, wh_dst_ofs==16 (because (**match).match_size==16 at
line 357 in extensions/ebt_among.c), but in kernelspace we check
wh_dst_ofs against sizeof(struct ebt_among_info)==12.

That is obviously going to fail. Always.

Regards,
Carl-Daniel
-- 
http://www.hailfinger.org/

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV