nft: Special casing for among match in compare_matches()

When other extensions may have "garbage" appended to their data which
should not be considered for match comparison, among match is the
opposite in that it extends its data beyond the value in 'size' field.
Add special casing to cover for this, avoiding false-positive rule
comparison.

Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support")
Signed-off-by: Phil Sutter <phil@nwl.cc>

diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
index 12860fbf6d5750844bccacab2a58cf057a1f1116..0cd082b5396d0d9fd04cd1c950c4b1ad9b69f825 100644 (file)
--- a/iptables/nft-shared.c
+++ b/iptables/nft-shared.c
@@ -381,6 +381,7 @@ bool compare_matches(struct xtables_rule_match *mt1,
        for (mp1 = mt1, mp2 = mt2; mp1 && mp2; mp1 = mp1->next, mp2 = mp2->next) {
                struct xt_entry_match *m1 = mp1->match->m;
                struct xt_entry_match *m2 = mp2->match->m;
+               size_t cmplen = mp1->match->userspacesize;
 
                if (strcmp(m1->u.user.name, m2->u.user.name) != 0) {
                        DEBUGP("mismatching match name\n");
@@ -392,8 +393,10 @@ bool compare_matches(struct xtables_rule_match *mt1,
                        return false;
                }
 
-               if (memcmp(m1->data, m2->data,
-                          mp1->match->userspacesize) != 0) {
+               if (!strcmp(m1->u.user.name, "among"))
+                       cmplen = m1->u.match_size - sizeof(*m1);
+
+               if (memcmp(m1->data, m2->data, cmplen) != 0) {
                        DEBUGP("mismatch match data\n");
                        return false;
                }