* [PATCH nft] src/ct: provide fixed data lengh sizes for ip/ip6 keys
@ 2019-07-12 10:35 Florian Westphal
2019-07-12 10:42 ` Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: Florian Westphal @ 2019-07-12 10:35 UTC (permalink / raw)
To: netfilter-devel; +Cc: Florian Westphal
nft can load but not list this:
table inet filter {
chain input {
ct original ip daddr {1.2.3.4} accept
}
}
Problem is that the ct template length is 0, so we believe the right hand
side is a concatenation because left->len < set->key->len is true.
nft then calls abort() during concatenation parsing.
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1222
Signed-off-by: Florian Westphal <fw@strlen.de>
---
src/ct.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/src/ct.c b/src/ct.c
index 4f7807deea0f..14cc0e5e8a4e 100644
--- a/src/ct.c
+++ b/src/ct.c
@@ -292,13 +292,13 @@ const struct ct_template ct_templates[__NFT_CT_MAX] = {
[NFT_CT_EVENTMASK] = CT_TEMPLATE("event", &ct_event_type,
BYTEORDER_HOST_ENDIAN, 32),
[NFT_CT_SRC_IP] = CT_TEMPLATE("ip saddr", &ipaddr_type,
- BYTEORDER_BIG_ENDIAN, 0),
+ BYTEORDER_BIG_ENDIAN, 32),
[NFT_CT_DST_IP] = CT_TEMPLATE("ip daddr", &ipaddr_type,
- BYTEORDER_BIG_ENDIAN, 0),
+ BYTEORDER_BIG_ENDIAN, 32),
[NFT_CT_SRC_IP6] = CT_TEMPLATE("ip6 saddr", &ip6addr_type,
- BYTEORDER_BIG_ENDIAN, 0),
+ BYTEORDER_BIG_ENDIAN, 128),
[NFT_CT_DST_IP6] = CT_TEMPLATE("ip6 daddr", &ip6addr_type,
- BYTEORDER_BIG_ENDIAN, 0),
+ BYTEORDER_BIG_ENDIAN, 128),
};
static void ct_print(enum nft_ct_keys key, int8_t dir, uint8_t nfproto,
--
2.21.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH nft] src/ct: provide fixed data lengh sizes for ip/ip6 keys
2019-07-12 10:35 [PATCH nft] src/ct: provide fixed data lengh sizes for ip/ip6 keys Florian Westphal
@ 2019-07-12 10:42 ` Pablo Neira Ayuso
2019-07-12 14:49 ` Florian Westphal
0 siblings, 1 reply; 3+ messages in thread
From: Pablo Neira Ayuso @ 2019-07-12 10:42 UTC (permalink / raw)
To: Florian Westphal; +Cc: netfilter-devel
On Fri, Jul 12, 2019 at 12:35:03PM +0200, Florian Westphal wrote:
> nft can load but not list this:
>
> table inet filter {
> chain input {
> ct original ip daddr {1.2.3.4} accept
> }
> }
>
> Problem is that the ct template length is 0, so we believe the right hand
> side is a concatenation because left->len < set->key->len is true.
> nft then calls abort() during concatenation parsing.
>
> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1222
> Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Please, add new entry to tests/py before pushing this out.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH nft] src/ct: provide fixed data lengh sizes for ip/ip6 keys
2019-07-12 10:42 ` Pablo Neira Ayuso
@ 2019-07-12 14:49 ` Florian Westphal
0 siblings, 0 replies; 3+ messages in thread
From: Florian Westphal @ 2019-07-12 14:49 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: Florian Westphal, netfilter-devel
Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Fri, Jul 12, 2019 at 12:35:03PM +0200, Florian Westphal wrote:
> > nft can load but not list this:
> >
> > table inet filter {
> > chain input {
> > ct original ip daddr {1.2.3.4} accept
> > }
> > }
> >
> > Problem is that the ct template length is 0, so we believe the right hand
> > side is a concatenation because left->len < set->key->len is true.
> > nft then calls abort() during concatenation parsing.
> >
> > Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1222
> > Signed-off-by: Florian Westphal <fw@strlen.de>
>
> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
> Please, add new entry to tests/py before pushing this out.
Will do.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-07-12 14:49 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-07-12 10:35 [PATCH nft] src/ct: provide fixed data lengh sizes for ip/ip6 keys Florian Westphal
2019-07-12 10:42 ` Pablo Neira Ayuso
2019-07-12 14:49 ` Florian Westphal
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).