[PATCH 1/3] netlink: fix use after free in netlink_get_table()

[PATCH 1/3] netlink: fix use after free in netlink_get_table()

[Patrick McHardy]

Signed-off-by: Patrick McHardy <kaber@trash.net>
---
 src/netlink.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/netlink.c b/src/netlink.c
index 24dda67..f957295 100644
--- a/src/netlink.c
+++ b/src/netlink.c
@@ -953,19 +953,19 @@ int netlink_get_table(struct netlink_ctx *ctx, const struct handle *h,
 
 	nlt = alloc_nft_table(h);
 	err = mnl_nft_table_get(nf_sock, nlt, 0);
-	nft_table_free(nlt);
-
 	if (err < 0) {
 		netlink_io_error(ctx, loc,
 				 "Could not receive table from kernel: %s",
 				 strerror(errno));
-		return err;
+		goto out;
 	}
 
 	ntable = netlink_delinearize_table(ctx, nlt);
 	table->flags = ntable->flags;
 	xfree(ntable);
-	return 0;
+out:
+	nft_table_free(nlt);
+	return err;
 }
 
 int netlink_list_table(struct netlink_ctx *ctx, const struct handle *h,
-- 
2.1.0

[PATCH 2/3] netlink_delinarize: fix payload dependency killing of link layer dependencies

[Patrick McHardy]

payload_dependency_kill() does not properly handle dependencies for link
layer expressions. Since those dependencies are logically defined on an
even lower layer (device layer), we don't have a payload base for them,
meaning they will use PROTO_BASE_INVALID, which is skipped.

So instead of storing the payload base on which the dependency is defined,
we store the base of the layer for which the dependency applies, meaning
dependencies defined by the device layer will properly work.

This fixes killing the dependency of ether saddr, instead of

iiftype ether ether ether saddr ...

we now only display

ether saddr ...

Signed-off-by: Patrick McHardy <kaber@trash.net>
---
 src/netlink_delinearize.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index 387bb67..ec1a964 100644
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -753,7 +753,7 @@ struct rule_pp_ctx {
 static void payload_dependency_kill(struct rule_pp_ctx *ctx, struct expr *expr)
 {
 	if (ctx->pbase != PROTO_BASE_INVALID &&
-	    ctx->pbase == expr->payload.base - 1 &&
+	    ctx->pbase == expr->payload.base &&
 	    ctx->pdep != NULL) {
 		list_del(&ctx->pdep->list);
 		stmt_free(ctx->pdep);
@@ -766,7 +766,7 @@ static void payload_dependency_store(struct rule_pp_ctx *ctx,
 				     struct stmt *stmt,
 				     enum proto_bases base)
 {
-	ctx->pbase = base;
+	ctx->pbase = base + 1;
 	ctx->pdep  = stmt;
 }
 
-- 
2.1.0

[PATCH 3/3] parser: remove duplicated grammar for chain policy

[Patrick McHardy]

Signed-off-by: Patrick McHardy <kaber@trash.net>
---
 src/parser_bison.y | 19 +++++++------------
 1 file changed, 7 insertions(+), 12 deletions(-)

diff --git a/src/parser_bison.y b/src/parser_bison.y
index ea3ff52..b86381d 100644
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -409,7 +409,7 @@ static void location_update(struct location *loc, struct location *rhs, int n)
 %destructor { handle_free(&$$); } table_spec tables_spec chain_spec chain_identifier ruleid_spec ruleset_spec
 %type <handle>			set_spec set_identifier
 %destructor { handle_free(&$$); } set_spec set_identifier
-%type <val>			handle_spec family_spec family_spec_explicit position_spec
+%type <val>			handle_spec family_spec family_spec_explicit position_spec chain_policy
 
 %type <table>			table_block_alloc table_block
 %destructor { close_scope(state); table_free($$); }	table_block_alloc
@@ -1071,26 +1071,21 @@ hook_spec		:	TYPE		STRING		HOOK		STRING		PRIORITY	NUM
 			}
 			;
 
-policy_spec		:	POLICY		ACCEPT
+policy_spec		:	POLICY		chain_policy
 			{
 				if ($<chain>0->policy != -1) {
 					erec_queue(error(&@$, "you cannot set chain policy twice"),
 						   state->msgs);
 					YYERROR;
 				}
-				$<chain>0->policy	= NF_ACCEPT;
-			}
-			|	POLICY		DROP
-			{
-				if ($<chain>0->policy != -1) {
-					erec_queue(error(&@$, "you cannot set chain policy twice"),
-						   state->msgs);
-					YYERROR;
-				}
-				$<chain>0->policy	= NF_DROP;
+				$<chain>0->policy	= $2;
 			}
 			;
 
+chain_policy		:	ACCEPT		{ $$ = NF_ACCEPT; }
+			|	DROP		{ $$ = NF_DROP;   }
+			;
+
 identifier		:	STRING
 			;
 
-- 
2.1.0