list vmap counter errot

list vmap counter errot

[Martin Zatloukal]

hi. i am trying nftables for our igw and i ran into a problem.



add map ip filter forwport { type ipv4_addr . inet_proto . 
inet_service: verdict; flags interval; counter;  }

add rule ip filter FORWARD iifname $INET_IFACE ip daddr . ip protocol  . 
th dport vmap @forwport counter

if I enter

nft list ruleset

then cli send : Unauthorized Memory Access (SIGSEGV)


dmesg

[ 1056.857354] nft[1069]: segfault at 10 ip 00007f44edde176d sp 
00007ffc2cdb8fa0 error 4 in libnftables.so.1.1.0[7f44eddd8000+62000]

[ 1056.857362] Code: 89 68 10 48 89 50 38 48 83 c4 08 5b 5d c3 66 66 2e 
0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 85 ff 74 23 55 48 8b 47 10 48 89 
fd <48> 8b 40 10 48 85 c0 74 02 ff d0 48 89 ef 5d e9 2f a4 02 00 0f 1f

if map not use flags counter,is listing ok

debian 11

libnftables1_1.0.0-1_amd64.deb
nftables_1.0.0-1_amd64.deb

Re: list vmap counter errot

[Pablo Neira Ayuso]

Hi,

On Thu, Sep 16, 2021 at 10:38:03AM +0200, Martin Zatloukal wrote:
> 
> hi. i am trying nftables for our igw and i ran into a problem.
> 
> add map ip filter forwport { type ipv4_addr . inet_proto . inet_service:
> verdict; flags interval; counter;  }
> 
> add rule ip filter FORWARD iifname $INET_IFACE ip daddr . ip protocol  . th
> dport vmap @forwport counter
> 
> if I enter
> 
> nft list ruleset
> 
> then cli send : Unauthorized Memory Access (SIGSEGV)
> 
> 
> dmesg
> 
> [ 1056.857354] nft[1069]: segfault at 10 ip 00007f44edde176d sp
> 00007ffc2cdb8fa0 error 4 in libnftables.so.1.1.0[7f44eddd8000+62000]
> 
> [ 1056.857362] Code: 89 68 10 48 89 50 38 48 83 c4 08 5b 5d c3 66 66 2e 0f
> 1f 84 00 00 00 00 00 0f 1f 40 00 48 85 ff 74 23 55 48 8b 47 10 48 89 fd <48>
> 8b 40 10 48 85 c0 74 02 ff d0 48 89 ef 5d e9 2f a4 02 00 0f 1f
> 
> if map not use flags counter,is listing ok
> 
> debian 11
> 
> libnftables1_1.0.0-1_amd64.deb
> nftables_1.0.0-1_amd64.deb

I cannot reproduce this here, valgrind and ASAN outputs are perfectly
clean?

Could you post you ldd /usr/sbin/nft output? Could you run 'nft list
ruleset' inside valgrind?  Or there is any rule that is missing in
your setup to reproduce what you are observing?

Re: list vmap counter errot

[Pablo Neira Ayuso]

On Thu, Sep 16, 2021 at 01:05:03PM +0200, Martin Zatloukal wrote:
[...]
> root@igw-test:~# cat /etc/firewall/test
> 
> #!/sbin/nft -f
> 
> flush ruleset
> 
> add table ip filter
> add chain ip filter FORWARD { type filter hook forward priority 0; policy
> drop; }
> 
> add map ip filter forwport { type ipv4_addr . inet_proto . inet_service:
> verdict; flags interval; counter;  }
> add rule ip filter FORWARD iifname enp0s8 ip daddr . ip protocol  . th dport
> vmap @forwport counter
> 
> add element ip filter forwport { 10.133.89.138 . tcp . 8081: accept }

Thanks, this repro is useful. I managed to reproduce it.

Fix it here:

https://patchwork.ozlabs.org/project/netfilter-devel/patch/20210916115838.21724-1-pablo@netfilter.org/

Thanks for reporting.