The following configuration:

 table inet filter {
        chain input {
                ct original ip daddr {1.2.3.4} accept
        }
 }

is triggering an infinite loop.

This problem also exists with concatenations and ct ip {s,d}addr. Until
we have a solution for this, let's just prevent infinite loops.

Now we hit this:

 # nft list ruleset
 nft: netlink_delinearize.c:124: netlink_parse_concat_expr: Assertion `consumed 
> 0' failed.
 Abort

Signed-off-by: Pablo Neira Ayuso <pa...@netfilter.org>
---
Just a band aid before releasing 0.8.2, ct ip {s,daddr} with inet family
needs a closer look, will be sending a RFC patch to discuss this asap.

 src/netlink_delinearize.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index 2637f4baaec4..256552b5b46e 100644
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -108,6 +108,7 @@ static struct expr *netlink_parse_concat_expr(struct 
netlink_parse_ctx *ctx,
                                              unsigned int len)
 {
        struct expr *concat, *expr;
+       unsigned int consumed;
 
        concat = concat_expr_alloc(loc);
        while (len > 0) {
@@ -119,7 +120,9 @@ static struct expr *netlink_parse_concat_expr(struct 
netlink_parse_ctx *ctx,
                }
                compound_expr_add(concat, expr);
 
-               len -= netlink_padded_len(expr->len);
+               consumed = netlink_padded_len(expr->len);
+               assert(consumed > 0);
+               len -= consumed;
                reg += netlink_register_space(expr->len);
        }
        return concat;
-- 
2.11.0

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to