[Bug 1390] iptables -m string not working with --algo bm and OUTPUT chain under 5.3.x

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1390

Jeremy Sowden <jeremy at azazel.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jeremy at azazel.net

--- Comment #3 from Jeremy Sowden <jeremy at azazel.net> ---
There are two possible reasons why BM might not match.  Both affect packets
which are stored by the kernel in multiple discontiguous blocks.  One of them
is a known limitation and is described in the kernel source:

 *   Note: Since Boyer-Moore (BM) performs searches for matchings from right 
 *   to left, it's still possible that a matching could be spread over 
 *   multiple blocks, in that case this algorithm won't find any coincidence.
 *   
 *   If you're willing to ensure that such thing won't ever happen, use the
 *   Knuth-Pratt-Morris (KMP) implementation instead. In conclusion, choose 
 *   the proper string search algorithm depending on your setting. 
 *
 *   Say you're using the textsearch infrastructure for filtering, NIDS or 
 *   any similar security focused purpose, then go KMP. Otherwise, if you 
 *   really care about performance, say you're classifying packets to apply
 *   Quality of Service (QoS) policies, and you don't mind about possible
 *   matchings spread over multiple fragments, then go BM.

The second is a kernel bug: the offset at which the implementation start
searching in each block is not reset when a new block is read, so for the
subsequent blocks matches at the beginning of the block are likely to be
missed.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20230610/f62b3f3e/attachment.html>