From: Florian Westphal <fw@strlen.de>
To: <netfilter-devel@vger.kernel.org>
Cc: Florian Westphal <fw@strlen.de>
Subject: [PATCH nft v2 0/8] really handle stacked l2 headers
Date: Mon, 1 Aug 2022 15:56:25 +0200 [thread overview]
Message-ID: <20220801135633.5317-1-fw@strlen.de> (raw)
v2:
- fix a UAF during rule listing. When OP_AND gets culled,
'expr' is free'd as well ahead of time because they alias one
another in the set key case (there is no compare/relational op).
- add and handle plain 'vlan id' in a set key.
in v1, this would be shown with the '& 0xfff' included, because
v1 only removed OP_AND in concatenations.
Eric Garver reported a number of issues when matching vlan headers:
In: update @macset { ether saddr . vlan id timeout 5s }
Out: update @macset { @ll,48,48 . @ll,112,16 & 0xfff timeout 5s }
This is because of amnesia in nft during expression decoding:
When we encounter 'vlan id', the L2 protocl (ethernet) is replaced by
vlan, so we attempt to match @ll,48,48 vs. the vlan header and come up
empty.
The vlan decode fails because we can't handle '& 0xfff' in this
instance, so we can locate the right offset but the payload expression
length doesn't match the template length (16 vs 12 bits).
The main patch is patch 3, which adds a stack of l2 protocols to track
instead of only keeping the cumulative size.
The latter is ok for serialization (we have the expression tree, so its
enough to add the size of the 'previous' l2 headers to payload
expressions that match the new 'top' l2 header.
But for deserialization, we need to be able to search all protocols base
headers seen.
The remaining patches improve handling of 'integer base type'
expressions and add test cases.
Florian Westphal (8):
netlink_delinearize: allow postprocessing on concatenated elements
netlink_delinearize: postprocess binary ands in concatenations
proto: track full stack of seen l2 protocols, not just cumulative
offset
debug: dump the l2 protocol stack
tests: add a test case for ether and vlan listing
netlink_delinearize: also postprocess OP_AND in set element context
evaluate: search stacked header list for matching payload dep
src: allow anon set concatenation with ether and vlan
include/netlink.h | 8 ++
include/proto.h | 3 +-
src/evaluate.c | 36 +++++--
src/expression.c | 17 +++-
src/netlink.c | 10 +-
src/netlink_delinearize.c | 59 ++++++++---
src/payload.c | 67 ++++++++++---
src/proto.c | 8 +-
tests/py/bridge/vlan.t | 5 +
tests/py/bridge/vlan.t.json | 97 +++++++++++++++++++
tests/py/bridge/vlan.t.payload | 28 ++++++
tests/py/bridge/vlan.t.payload.netdev | 34 +++++++
.../testcases/sets/0070stacked_l2_headers | 6 ++
.../sets/dumps/0070stacked_l2_headers.nft | 28 ++++++
14 files changed, 368 insertions(+), 38 deletions(-)
create mode 100755 tests/shell/testcases/sets/0070stacked_l2_headers
create mode 100644 tests/shell/testcases/sets/dumps/0070stacked_l2_headers.nft
--
2.35.1
next reply other threads:[~2022-08-01 13:56 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-01 13:56 Florian Westphal [this message]
2022-08-01 13:56 ` [PATCH nft v2 1/8] netlink_delinearize: allow postprocessing on concatenated elements Florian Westphal
2022-08-01 13:56 ` [PATCH nft v2 2/8] netlink_delinearize: postprocess binary ands in concatenations Florian Westphal
2022-08-01 13:56 ` [PATCH nft v2 3/8] proto: track full stack of seen l2 protocols, not just cumulative offset Florian Westphal
2022-08-01 13:56 ` [PATCH nft v2 4/8] debug: dump the l2 protocol stack Florian Westphal
2022-08-01 13:56 ` [PATCH nft v2 5/8] tests: add a test case for ether and vlan listing Florian Westphal
2022-08-01 13:56 ` [PATCH nft v2 6/8] netlink_delinearize: also postprocess OP_AND in set element context Florian Westphal
2022-08-01 13:56 ` [PATCH nft v2 7/8] evaluate: search stacked header list for matching payload dep Florian Westphal
2022-08-01 13:56 ` [PATCH nft v2 8/8] src: allow anon set concatenation with ether and vlan Florian Westphal
2022-08-04 11:01 ` [PATCH nft v2 0/8] really handle stacked l2 headers Pablo Neira Ayuso
2022-08-04 11:07 ` Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220801135633.5317-1-fw@strlen.de \
--to=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.