Re: iptables: zero dereference parsing bitwise operations

[Florian Westphal <fw@strlen.de>]

Fernando Fernandez Mancera <fmancera@suse.de> wrote:
> > 
> >> Hi Remy, could you share the full output of:
> >>
> >> 'nft --debug=netlink list ruleset'
> >>
> >> This will allow me to understand what is the generated bytecode and an
> >> easy way to reproduce this with libnftnl. I am happy to investigate/fix
> >> this on the nft/libnftnl/kernel side :)
> > 
> > 
> > Hi Fernando,
> > 
> > Not sure if it worth investigating, but here you go.
> > 
> > 
> 
> I have reproduced this and confirmed that the right source register is 
> being set (NFT_REG_1) and that libnftnl is reporting it correctly. The 
> problem is on nft command line tool side.. I do not think it is worth 
> going deeper as it is probably related to nftables not being able to 
> delinearize this rule as it is not supported by nft itself.

What the rule is doing is supported, but nft will transform it to use
xor/and, as that will work on all nf_tables versions rather than only
kernels that support NFT_BITWISE_OR.

I think it would be possible to extend netlink_delinerize.c to support
it but its technically not needed.

nft can also not be expected to ever be able to make sense of a ruleset
generated by something else, there is just too much variance to always
be able to map this back to nft grammar.