[PATCH nft] evaluate: disable ct set with ranges

[PATCH nft] evaluate: disable ct set with ranges

[Florian Westphal]

... this will cause an assertion in netlink linearization, catch this
at eval stage instead.

before:
BUG: unknown expression type range
nft: netlink_linearize.c:908: netlink_gen_expr: Assertion `0' failed.

after:
/unknown_expr_type_range_assert:3:31-40: Error: ct expression cannot be a range
ct mark set 0x001-3434
            ^^^^^^^^^^

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 src/evaluate.c                                       | 12 +++++++++++-
 .../bogons/nft-f/unknown_expr_type_range_assert      |  1 +
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/src/evaluate.c b/src/evaluate.c
index b6e602308163..6c6841679f1e 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -3331,7 +3331,17 @@ static int stmt_evaluate_ct(struct eval_ctx *ctx, struct stmt *stmt)
 		return stmt_error(ctx, stmt,
 				  "ct secmark must not be set to constant value");
 
-	return 0;
+	switch (stmt->meta.expr->etype) {
+	case EXPR_RANGE:
+		ret = expr_error(ctx->msgs, stmt->ct.expr,
+				 "ct expression cannot be a range");
+		break;
+	default:
+		break;
+
+	}
+
+	return ret;
 }
 
 static int reject_payload_gen_dependency_tcp(struct eval_ctx *ctx,
diff --git a/tests/shell/testcases/bogons/nft-f/unknown_expr_type_range_assert b/tests/shell/testcases/bogons/nft-f/unknown_expr_type_range_assert
index 234dd623167d..1a42d751e880 100644
--- a/tests/shell/testcases/bogons/nft-f/unknown_expr_type_range_assert
+++ b/tests/shell/testcases/bogons/nft-f/unknown_expr_type_range_assert
@@ -1,5 +1,6 @@
 table ip x {
         chain k {
                 meta mark set 0x001-3434
+                ct mark set 0x001-3434
         }
 }
-- 
2.41.0

Re: [PATCH nft] evaluate: disable ct set with ranges

[Florian Westphal]

Florian Westphal <fw@strlen.de> wrote:
> ... this will cause an assertion in netlink linearization, catch this
> at eval stage instead.
> 
> before:
> BUG: unknown expression type range
> nft: netlink_linearize.c:908: netlink_gen_expr: Assertion `0' failed.
> 
> after:
> /unknown_expr_type_range_assert:3:31-40: Error: ct expression cannot be a range
> ct mark set 0x001-3434
>             ^^^^^^^^^^

This isn't enough, we have a truckload of bugs like this.

e.g. 'tproxy to  1.1.1.10/0'.  This passes EXPR_RANGE check,
but we still hit the assertion because prefix is translated to a range
later on.

dup and fwd also have this issue, probably a lot more.

Re: [PATCH nft] evaluate: disable ct set with ranges

[Pablo Neira Ayuso]

Hi Florian,

On Thu, Jan 11, 2024 at 02:16:51PM +0100, Florian Westphal wrote:
> Florian Westphal <fw@strlen.de> wrote:
> > ... this will cause an assertion in netlink linearization, catch this
> > at eval stage instead.
> > 
> > before:
> > BUG: unknown expression type range
> > nft: netlink_linearize.c:908: netlink_gen_expr: Assertion `0' failed.
> > 
> > after:
> > /unknown_expr_type_range_assert:3:31-40: Error: ct expression cannot be a range
> > ct mark set 0x001-3434
> >             ^^^^^^^^^^
>
> This isn't enough, we have a truckload of bugs like this.
> 
> e.g. 'tproxy to  1.1.1.10/0'.  This passes EXPR_RANGE check,
> but we still hit the assertion because prefix is translated to a range
> later on.

I am going to take a look at this one.

> dup and fwd also have this issue, probably a lot more.

I believe we have to go the extra mile and sanitize this, to avoid
non-sensical transformations which leads to hit BUG.