Re: [nft PATCH] erec: Sanitize erec location indesc

[Pablo Neira Ayuso <pablo@netfilter.org>]

[-- Attachment #1: Type: text/plain, Size: 1676 bytes --]

Hi Phil,

On Wed, Feb 03, 2021 at 11:45:07AM +0100, Phil Sutter wrote:
> Hi Pablo,
> 
> On Wed, Feb 03, 2021 at 01:38:32AM +0100, Pablo Neira Ayuso wrote:
> > On Tue, Jan 26, 2021 at 06:55:02PM +0100, Phil Sutter wrote:
> > > erec_print() unconditionally dereferences erec->locations->indesc, so
> > > make sure it is valid when either creating an erec or adding a location.
> > 
> > I guess your're trigger a bug where erec is indesc is NULL, thing is
> > that indesc should be always set on. Is there a reproducer for this bug?
> 
> Yes, exactly. I hit it when trying to clean up the netdev family reject
> support, while just "hacking around". You can trigger it with the
> following change:
> 
> | --- a/src/evaluate.c
> | +++ b/src/evaluate.c
> | @@ -2718,7 +2718,7 @@ static int stmt_evaluate_reject_bridge(struct eval_ctx *ctx, struct stmt *stmt,
> |         const struct proto_desc *desc;
> |  
> |         desc = ctx->pctx.protocol[PROTO_BASE_LL_HDR].desc;
> | -       if (desc != &proto_eth && desc != &proto_vlan && desc != &proto_netdev)
> | +       if (desc != &proto_eth && desc != &proto_vlan)
> |                 return stmt_binary_error(ctx,
> |                                          &ctx->pctx.protocol[PROTO_BASE_LL_HDR],
> |                                          stmt, "unsupported link layer protocol");

I'm attaching fix.

Looks like call to stmt_binary_error() parameters are not in the right
order, &ctx->pctx.protocol[PROTO_BASE_LL_HDR] has indesc.

Probably add a bugtrap to erec to check that indesc is always set on
accordingly instead?

> and this ruleset:
> 
> | table netdev t {
> | 	chain c {
> | 		reject
> | 	}
> | }
> 
> Cheers, Phil

[-- Attachment #2: x.patch --]
[-- Type: text/x-diff, Size: 651 bytes --]

diff --git a/src/evaluate.c b/src/evaluate.c
index 030bbde4ab2c..771b71c83d01 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -2729,9 +2729,9 @@ static int stmt_evaluate_reject_bridge(struct eval_ctx *ctx, struct stmt *stmt,
 
 	desc = ctx->pctx.protocol[PROTO_BASE_LL_HDR].desc;
 	if (desc != &proto_eth && desc != &proto_vlan && desc != &proto_netdev)
-		return stmt_binary_error(ctx,
+		return stmt_binary_error(ctx, stmt,
 					 &ctx->pctx.protocol[PROTO_BASE_LL_HDR],
-					 stmt, "unsupported link layer protocol");
+					 "unsupported link layer protocol");
 
 	desc = ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc;
 	if (desc != NULL &&