* list vmap counter errot
@ 2021-09-16 8:38 Martin Zatloukal
2021-09-16 9:27 ` Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: Martin Zatloukal @ 2021-09-16 8:38 UTC (permalink / raw)
To: netfilter-devel
hi. i am trying nftables for our igw and i ran into a problem.
add map ip filter forwport { type ipv4_addr . inet_proto .
inet_service: verdict; flags interval; counter; }
add rule ip filter FORWARD iifname $INET_IFACE ip daddr . ip protocol .
th dport vmap @forwport counter
if I enter
nft list ruleset
then cli send : Unauthorized Memory Access (SIGSEGV)
dmesg
[ 1056.857354] nft[1069]: segfault at 10 ip 00007f44edde176d sp
00007ffc2cdb8fa0 error 4 in libnftables.so.1.1.0[7f44eddd8000+62000]
[ 1056.857362] Code: 89 68 10 48 89 50 38 48 83 c4 08 5b 5d c3 66 66 2e
0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 85 ff 74 23 55 48 8b 47 10 48 89
fd <48> 8b 40 10 48 85 c0 74 02 ff d0 48 89 ef 5d e9 2f a4 02 00 0f 1f
if map not use flags counter,is listing ok
debian 11
libnftables1_1.0.0-1_amd64.deb
nftables_1.0.0-1_amd64.deb
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: list vmap counter errot
2021-09-16 8:38 list vmap counter errot Martin Zatloukal
@ 2021-09-16 9:27 ` Pablo Neira Ayuso
[not found] ` <d02072df-d5e5-b76d-0003-0a6ef62f5d00@pvfree.net>
0 siblings, 1 reply; 3+ messages in thread
From: Pablo Neira Ayuso @ 2021-09-16 9:27 UTC (permalink / raw)
To: Martin Zatloukal; +Cc: netfilter-devel
Hi,
On Thu, Sep 16, 2021 at 10:38:03AM +0200, Martin Zatloukal wrote:
>
> hi. i am trying nftables for our igw and i ran into a problem.
>
> add map ip filter forwport { type ipv4_addr . inet_proto . inet_service:
> verdict; flags interval; counter; }
>
> add rule ip filter FORWARD iifname $INET_IFACE ip daddr . ip protocol . th
> dport vmap @forwport counter
>
> if I enter
>
> nft list ruleset
>
> then cli send : Unauthorized Memory Access (SIGSEGV)
>
>
> dmesg
>
> [ 1056.857354] nft[1069]: segfault at 10 ip 00007f44edde176d sp
> 00007ffc2cdb8fa0 error 4 in libnftables.so.1.1.0[7f44eddd8000+62000]
>
> [ 1056.857362] Code: 89 68 10 48 89 50 38 48 83 c4 08 5b 5d c3 66 66 2e 0f
> 1f 84 00 00 00 00 00 0f 1f 40 00 48 85 ff 74 23 55 48 8b 47 10 48 89 fd <48>
> 8b 40 10 48 85 c0 74 02 ff d0 48 89 ef 5d e9 2f a4 02 00 0f 1f
>
> if map not use flags counter,is listing ok
>
> debian 11
>
> libnftables1_1.0.0-1_amd64.deb
> nftables_1.0.0-1_amd64.deb
I cannot reproduce this here, valgrind and ASAN outputs are perfectly
clean?
Could you post you ldd /usr/sbin/nft output? Could you run 'nft list
ruleset' inside valgrind? Or there is any rule that is missing in
your setup to reproduce what you are observing?
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: list vmap counter errot
[not found] ` <20210916120027.GA21782@salvia>
@ 2021-09-16 12:01 ` Pablo Neira Ayuso
0 siblings, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2021-09-16 12:01 UTC (permalink / raw)
To: Martin Zatloukal; +Cc: netfilter-devel
On Thu, Sep 16, 2021 at 01:05:03PM +0200, Martin Zatloukal wrote:
[...]
> root@igw-test:~# cat /etc/firewall/test
>
> #!/sbin/nft -f
>
> flush ruleset
>
> add table ip filter
> add chain ip filter FORWARD { type filter hook forward priority 0; policy
> drop; }
>
> add map ip filter forwport { type ipv4_addr . inet_proto . inet_service:
> verdict; flags interval; counter; }
> add rule ip filter FORWARD iifname enp0s8 ip daddr . ip protocol . th dport
> vmap @forwport counter
>
> add element ip filter forwport { 10.133.89.138 . tcp . 8081: accept }
Thanks, this repro is useful. I managed to reproduce it.
Fix it here:
https://patchwork.ozlabs.org/project/netfilter-devel/patch/20210916115838.21724-1-pablo@netfilter.org/
Thanks for reporting.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-09-16 12:01 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-16 8:38 list vmap counter errot Martin Zatloukal
2021-09-16 9:27 ` Pablo Neira Ayuso
[not found] ` <d02072df-d5e5-b76d-0003-0a6ef62f5d00@pvfree.net>
[not found] ` <20210916120005.GB11941@salvia>
[not found] ` <20210916120027.GA21782@salvia>
2021-09-16 12:01 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).