[Bug 1303] New: nft improperly merges intervals

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1303

            Bug ID: 1303
           Summary: nft improperly merges intervals
           Product: nftables
           Version: unspecified
          Hardware: x86_64
                OS: All
            Status: NEW
          Severity: critical
          Priority: P5
         Component: nft
          Assignee: pablo at netfilter.org
          Reporter: trever at middleearth.sapphiresunday.org

Please consider the following rules:

        oifname "ppp0" ip saddr { 10.0.0.0/23, 10.1.1.0/24 } counter packets 76
bytes 4704 masquerade
        oifname "ppp0" ip saddr 10.1.1.0/25 counter packets 0 bytes 0
masquerade
        oifname "ppp0" ip saddr 10.0.1.0/24 counter packets 0 bytes 0
masquerade
        oifname "ppp0" ip saddr 10.0.0.0/24 counter packets 0 bytes 0
masquerade
        oifname "ppp0" ip saddr 10.1.1.128/25 counter packets 0 bytes 0
masquerade

The second and last are properly merged in the first (which should have four
entries without merging). Combining the third and fourth into a /23 is NOT
correct. If this was a block rule, it would lead to improperly denying things,
if it was an accept it is a huge security hole. Masquerade... there are reasons
it is likely a security hole as well.

I assume this is a user space and not kernel problem, but it is just as likely
the other.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20181124/71d90ea9/attachment.html>