Re: [nft PATCH] erec: Sanitize erec location indesc

[Pablo Neira Ayuso <pablo@netfilter.org>]

[-- Attachment #1: Type: text/plain, Size: 1829 bytes --]

On Tue, Feb 09, 2021 at 02:15:11PM +0100, Pablo Neira Ayuso wrote:
> Hi Phil,
> 
> On Wed, Feb 03, 2021 at 11:45:07AM +0100, Phil Sutter wrote:
> > Hi Pablo,
> > 
> > On Wed, Feb 03, 2021 at 01:38:32AM +0100, Pablo Neira Ayuso wrote:
> > > On Tue, Jan 26, 2021 at 06:55:02PM +0100, Phil Sutter wrote:
> > > > erec_print() unconditionally dereferences erec->locations->indesc, so
> > > > make sure it is valid when either creating an erec or adding a location.
> > > 
> > > I guess your're trigger a bug where erec is indesc is NULL, thing is
> > > that indesc should be always set on. Is there a reproducer for this bug?
> > 
> > Yes, exactly. I hit it when trying to clean up the netdev family reject
> > support, while just "hacking around". You can trigger it with the
> > following change:
> > 
> > | --- a/src/evaluate.c
> > | +++ b/src/evaluate.c
> > | @@ -2718,7 +2718,7 @@ static int stmt_evaluate_reject_bridge(struct eval_ctx *ctx, struct stmt *stmt,
> > |         const struct proto_desc *desc;
> > |  
> > |         desc = ctx->pctx.protocol[PROTO_BASE_LL_HDR].desc;
> > | -       if (desc != &proto_eth && desc != &proto_vlan && desc != &proto_netdev)
> > | +       if (desc != &proto_eth && desc != &proto_vlan)
> > |                 return stmt_binary_error(ctx,
> > |                                          &ctx->pctx.protocol[PROTO_BASE_LL_HDR],
> > |                                          stmt, "unsupported link layer protocol");
> 
> I'm attaching fix.
> 
> Looks like call to stmt_binary_error() parameters are not in the right
> order, &ctx->pctx.protocol[PROTO_BASE_LL_HDR] has indesc.

New patch fix, just do not use ctx->pctx.protocol[PROTO_BASE_LL_HDR]
since it's an internal generated dependency, it is not visible from
the rule, so stmt_binary_error() cannot really help with the error
printing.

[-- Attachment #2: x.patch --]
[-- Type: text/x-diff, Size: 684 bytes --]

diff --git a/src/evaluate.c b/src/evaluate.c
index 030bbde4ab2c..782a5bca98bb 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -2729,9 +2729,8 @@ static int stmt_evaluate_reject_bridge(struct eval_ctx *ctx, struct stmt *stmt,
 
 	desc = ctx->pctx.protocol[PROTO_BASE_LL_HDR].desc;
 	if (desc != &proto_eth && desc != &proto_vlan && desc != &proto_netdev)
-		return stmt_binary_error(ctx,
-					 &ctx->pctx.protocol[PROTO_BASE_LL_HDR],
-					 stmt, "unsupported link layer protocol");
+		return __stmt_binary_error(ctx, &stmt->location, NULL,
+					   "cannot reject from this link layer protocol");
 
 	desc = ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc;
 	if (desc != NULL &&