Re: iptables: zero dereference parsing bitwise operations

[Florian Westphal <fw@strlen.de>]

Remy D. Farley <one-d-wide@protonmail.com> wrote:
> > > While messing around with manually encoding nftables expressions, I noticed
> > > that iptables binary v1.8.11 segfaults with -L and -D <chain> options, if
> > > there's a rule containing a bitwise operation of a type other than
> > > mask-and-xor. As I understand, iptables and nft tools only generate rules with
> > > mask-xor, though the kernel seems to happily accept other types as well.
> > 
> > 
> > No, nftables supports this, but iptables does not.
> 
> 
> Hmm, when I run `nft list ruleset` it terminates successfully, but it does
> report some errors at the end if the rule from the example is present.

That just means nft dissector can't make sense of whatever your program
is doing.

> > netlink: Error: Invalid source register 0

Hmm, I am not sure why kernel accepted this in first place,
or maybe a different bug in libnftnl.

> Sure. I think it's fine for now to just check for the operation type and
> error with something like "unsupported bitwise operation", like seems to be the
> case with nft tool, since this issue appears to be extremely uncommon, if it
> hasn't been spotted before.

Yes.

You can also extend nft_is_expr_compatible() so it will exit right away.