netfilter-devel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* iptables: zero dereference parsing bitwise operations
@ 2025-10-10 21:16 Remy D. Farley
  2025-10-11 13:58 ` Florian Westphal
  0 siblings, 1 reply; 8+ messages in thread
From: Remy D. Farley @ 2025-10-10 21:16 UTC (permalink / raw)
  To: netfilter-devel@vger.kernel.org

While messing around with manually encoding nftables expressions, I noticed
that iptables binary v1.8.11 segfaults with -L and -D <chain> options, if
there's a rule containing a bitwise operation of a type other than
mask-and-xor. As I understand, iptables and nft tools only generate rules with
mask-xor, though the kernel seems to happily accept other types as well.


For the reference:

> /**
>  * enum nft_bitwise_ops - nf_tables bitwise operations
>  *
>  * @NFT_BITWISE_MASK_XOR: mask-and-xor operation used to implement NOT, AND, OR
>  *                        and XOR boolean operations
>  * @NFT_BITWISE_LSHIFT: left-shift operation          \
>  * @NFT_BITWISE_RSHIFT: right-shift operation         |
>  * @NFT_BITWISE_AND: and operation                    | These all seem affected
>  * @NFT_BITWISE_OR: or operation                      |
>  * @NFT_BITWISE_XOR: xor operation                    /
>  */


Hooking up a debugger, it looks like nft_parse_bitwise() doesn't check type of
a bitwise operation, nor validate that it's attributes being used are present.


From iptables/nft-ruleparse.c:

> static void nft_parse_bitwise(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
> {
>   [...]
>
>   data = nftnl_expr_get(e, NFTNL_EXPR_BITWISE_XOR, &len); // <-- this attribute may not be present
> 
>   if (len > sizeof(dreg->bitwise.xor)) {
>     ctx->errmsg = "bitwise xor too large";
>     return;
>   }
> 
>   memcpy(dreg->bitwise.xor, data, len); // <-- zero dereference happens here
>
>   data = nftnl_expr_get(e, NFTNL_EXPR_BITWISE_MASK, &len);
>   
>   if (len > sizeof(dreg->bitwise.mask)) {
>   	ctx->errmsg = "bitwise mask too large";
>   	return;
>   }
>   
>   memcpy(dreg->bitwise.mask, data, len);
>   
>   dreg->bitwise.set = true;
>
> }


The bug can be reproduced with a rule created using newrule operation that
looks something like this:


> OpNewruleDoRequest {
>   Table: "filter",
>   Chain: "example-chain",
>   Expressions: ExprListAttrs {
>     Elem: ExprAttrs {
>       Name: "payload",
>       Data: Payload(
>         ExprPayloadAttrs {
>           Dreg: 1 [Reg1],
>           Base: 1 [NetworkHeader],
>           Offset: 12,
>           Len: 4,
>         },
>       ),
>     },
>     Elem: ExprAttrs {
>       Name: "bitwise",
>       Data: Bitwise(
>         ExprBitwiseAttrs {
>           Sreg: 1,
>           Dreg: 1,
>           Len: 4,
>           Op: 3 [And],
>           Data: DataAttrs {
>             Value: [ 255, 255, 255, 0 ],
>           },
>         },
>       ),
>     },
>     Elem: ExprAttrs {
>       Name: "cmp",
>       Data: Cmp(
>         ExprCmpAttrs {
>           Sreg: 1,
>           Op: 0 [Eq],
>           Data: DataAttrs {
>             Value: [ 1, 2, 3, 0 ],
>           },
>         },
>       ),
>     },
>     Elem: ExprAttrs {
>       Name: "immediate",
>       Data: Immediate(
>         ExprImmediateAttrs {
>           Dreg: 0,
>           Data: DataAttrs {
>             Verdict: VerdictAttrs {
>               Code: 1 [Accept],
>             },
>           },
>         },
>       ),
>     },
>   },
> },

^ permalink raw reply	[flat|nested] 8+ messages in thread
end of thread, other threads:[~2025-10-14 15:29 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-10-10 21:16 iptables: zero dereference parsing bitwise operations Remy D. Farley
2025-10-11 13:58 ` Florian Westphal
2025-10-11 20:15   ` Remy D. Farley
2025-10-12 16:46     ` Florian Westphal
2025-10-13  9:04     ` Fernando Fernandez Mancera
2025-10-13 11:43       ` Remy D. Farley
2025-10-14 15:14         ` Fernando Fernandez Mancera
2025-10-14 15:29           ` Florian Westphal

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).