ruleparse: arp: Fix for all-zero mask on Big Endian

With 16bit mask values, the first two bytes of bitwise.mask in struct
nft_xt_ctx_reg are significant. Reading the first 32bit-sized field
works only on Little Endian, on Big Endian the mask appears in the upper
two bytes which are discarded when assigning to a 16bit variable.

Fixes: ab2d5f8c7bbee ("nft-arp: add missing mask support")
Signed-off-by: Phil Sutter <phil@nwl.cc>

diff --git a/iptables/nft-ruleparse-arp.c b/iptables/nft-ruleparse-arp.c
index b0671cb0dfe8fa9ceb37195777ea76d3e1c95ad8..632e7ac94727c45aeab553091dd3152321ca027a 100644 (file)
--- a/iptables/nft-ruleparse-arp.c
+++ b/iptables/nft-ruleparse-arp.c
@@ -90,7 +90,8 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
                if (inv)
                        fw->arp.invflags |= IPT_INV_ARPHRD;
                if (reg->bitwise.set)
-                       fw->arp.arhrd_mask = reg->bitwise.mask[0];
+                       memcpy(&fw->arp.arhrd_mask, reg->bitwise.mask,
+                              sizeof(fw->arp.arhrd_mask));
                break;
        case offsetof(struct arphdr, ar_pro):
                get_cmp_data(e, &ar_pro, sizeof(ar_pro), &inv);
@@ -99,7 +100,8 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
                if (inv)
                        fw->arp.invflags |= IPT_INV_PROTO;
                if (reg->bitwise.set)
-                       fw->arp.arpro_mask = reg->bitwise.mask[0];
+                       memcpy(&fw->arp.arpro_mask, reg->bitwise.mask,
+                              sizeof(fw->arp.arpro_mask));
                break;
        case offsetof(struct arphdr, ar_op):
                get_cmp_data(e, &ar_op, sizeof(ar_op), &inv);
@@ -108,7 +110,8 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
                if (inv)
                        fw->arp.invflags |= IPT_INV_ARPOP;
                if (reg->bitwise.set)
-                       fw->arp.arpop_mask = reg->bitwise.mask[0];
+                       memcpy(&fw->arp.arpop_mask, reg->bitwise.mask,
+                              sizeof(fw->arp.arpop_mask));
                break;
        case offsetof(struct arphdr, ar_hln):
                get_cmp_data(e, &ar_hln, sizeof(ar_hln), &inv);
@@ -117,7 +120,8 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
                if (inv)
                        fw->arp.invflags |= IPT_INV_ARPHLN;
                if (reg->bitwise.set)
-                       fw->arp.arhln_mask = reg->bitwise.mask[0];
+                       memcpy(&fw->arp.arhln_mask, reg->bitwise.mask,
+                              sizeof(fw->arp.arhln_mask));
                break;
        case offsetof(struct arphdr, ar_pln):
                get_cmp_data(e, &ar_pln, sizeof(ar_pln), &inv);