netdev - Re: "AVX2-based lookup implementation" has broken ebtables --among-src

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20211117131248.GJ6326@breakpoint.cc>
Date:   Wed, 17 Nov 2021 14:12:48 +0100
From:   Florian Westphal <fw@...len.de>
To:     Florian Westphal <fw@...len.de>
Cc:     Stefano Brivio <sbrivio@...hat.com>,
        Nikita Yushchenko <nikita.yushchenko@...tuozzo.com>,
        Netdev <netdev@...r.kernel.org>, netfilter-devel@...r.kernel.org
Subject: Re: "AVX2-based lookup implementation" has broken ebtables
 --among-src

Florian Westphal <fw@...len.de> wrote:
> Might be a bug in ebtables.  This is what nft monitor shows:
> 
> add chain bridge filter INPUT { type filter hook input priority filter;
> 	policy accept; }
> 	add rule bridge filter INPUT ether saddr . ip saddr {
> 08:00:27:40:f7:09 .
> 	   192.168.56.10-0x1297286e2b2 [..]

nft monitor calls interval_map_decompose() even though it should not
in this case.  After fix this shows:

add rule bridge filter INPUT ether saddr . ip saddr { 08:00:27:40:f7:09 . 192.168.56.10, 08:00:27:40:f7:09 . 192.168.56.10 } counter

... instead, which looks correct (even though
the concat range is technically not required in this case).