bugzilla-daemon at netfilter.org
2023-Jun-10 16:09 UTC
[Bug 1390] iptables -m string not working with --algo bm and OUTPUT chain under 5.3.x
https://bugzilla.netfilter.org/show_bug.cgi?id=1390 Jeremy Sowden <jeremy at azazel.net> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jeremy at azazel.net --- Comment #3 from Jeremy Sowden <jeremy at azazel.net> --- There are two possible reasons why BM might not match. Both affect packets which are stored by the kernel in multiple discontiguous blocks. One of them is a known limitation and is described in the kernel source: * Note: Since Boyer-Moore (BM) performs searches for matchings from right * to left, it's still possible that a matching could be spread over * multiple blocks, in that case this algorithm won't find any coincidence. * * If you're willing to ensure that such thing won't ever happen, use the * Knuth-Pratt-Morris (KMP) implementation instead. In conclusion, choose * the proper string search algorithm depending on your setting. * * Say you're using the textsearch infrastructure for filtering, NIDS or * any similar security focused purpose, then go KMP. Otherwise, if you * really care about performance, say you're classifying packets to apply * Quality of Service (QoS) policies, and you don't mind about possible * matchings spread over multiple fragments, then go BM. The second is a kernel bug: the offset at which the implementation start searching in each block is not reset when a new block is read, so for the subsequent blocks matches at the beginning of the block are likely to be missed. -- You are receiving this mail because: You are watching all bug changes. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20230610/f62b3f3e/attachment.html>