bin/55403: npfctl miscompiles IPv6 rules

[mlelstv%serpens.de@localhost]

>Number:         55403
>Category:       bin
>Synopsis:       npfctl miscompiles IPv6 rules
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Jun 20 15:35:00 +0000 2020
>Originator:     Michael van Elst
>Release:        NetBSD 9.99.64
>Organization:
	
>Environment:
	
	
System: NetBSD tazz 9.99.64 NetBSD 9.99.64 (GENERIC) #2: Sun May 31 21:57:01 UTC 2020 mlelstv@slowpoke:/scratch2/obj.amd64/scratch/netbsd-current/src/sys/arch/amd64/compile/GENERIC amd64
Architecture: x86_64
Machine: amd64
>Description:

The byte code generated from the configuration:


$primary_if = lo0
$list = { fe80::1, fe80::2 }
group "primary" on $primary_if {
  pass in final family inet6 proto tcp from $list
}

is mis-compiled to

(000) ld       M[0]
(001) jeq      #0x6             jt 2    jf 22
(002) ld       M[2]
(003) jeq      #0x6             jt 4    jf 22
(004) ld       [8]
(005) jeq      #0xfe800000      jt 21   jf 6
(006) ld       [12]
(007) jeq      #0x0             jt 21   jf 8
(008) ld       [16]
(009) jeq      #0x0             jt 21   jf 10
(010) ld       [20]
(011) jeq      #0x1             jt 21   jf 12
(012) ld       [8]
(013) jeq      #0xfe800000      jt 21   jf 14
(014) ld       [12]
(015) jeq      #0x0             jt 21   jf 16
(016) ld       [16]
(017) jeq      #0x0             jt 21   jf 18
(018) ld       [20]
(019) jeq      #0x2             jt 21   jf 20
(020) ret      #0
(021) ret      #-1
(022) ret      #0

The match succeeds when any single 32bit word of the address matches.

The same with just a single address compiles correctly.

$primary_if = lo0
$list = { fe80::1 }
group "primary" on $primary_if {
  pass in final family inet6 proto tcp from $list
}

is compiled to

(000) ld       M[0]
(001) jeq      #0x6             jt 2    jf 13
(002) ld       M[2]
(003) jeq      #0x6             jt 4    jf 13
(004) ld       [8]
(005) jeq      #0xfe800000      jt 6    jf 13
(006) ld       [12]
(007) jeq      #0x0             jt 8    jf 13
(008) ld       [16]
(009) jeq      #0x0             jt 10   jf 13
(010) ld       [20]
(011) jeq      #0x1             jt 12   jf 13
(012) ret      #-1
(013) ret      #0


The compiler generates code for an AND condition, i.e. 

match family
AND match protocol
AND match word1 of address
AND match word2 of address
AND match word3 of address
AND match word4 of address
-> success

When compiling a list of addresses the code is inverted
to produce an OR condition. For IPv4 that's fine. I.e.

    match word1 of address1
AND match word1 of address2

is inverted to

    NOT match word1 of address1
AND NOT match word1 of address2
-> failure

But for IPv6, each word match is treated individually as

    match word1 of address1
AND match word2 of address1
AND match word3 of address1
AND match word4 of address1
AND match word1 of address2
AND match word2 of address2
AND match word3 of address2
AND match word4 of address2
-> success

is inverted to

    NOT match word1 of address1
AND NOT match word2 of address1
AND NOT match word3 of address1
AND NOT match word4 of address1
AND NOT match word1 of address2
AND NOT match word2 of address2
AND NOT match word3 of address2
AND NOT match word4 of address2
-> failure

And that's obviously wrong.


>How-To-Repeat:

Build a rule that matches against a list of IPv6 addresses.


>Fix:

Split the rule into matches against single IPv6 addresses or use a table lookup.


>Unformatted: