Re: iptables: zero dereference parsing bitwise operations

[Fernando Fernandez Mancera <fmancera@suse.de>]

On 10/11/25 10:15 PM, Remy D. Farley wrote:
> On Saturday, October 11th, 2025 at 13:58, Florian Westphal <fw@strlen.de> wrote:
> 
>> Remy D. Farley one-d-wide@protonmail.com wrote:
>>
>>> While messing around with manually encoding nftables expressions, I noticed
>>> that iptables binary v1.8.11 segfaults with -L and -D <chain> options, if
>>> there's a rule containing a bitwise operation of a type other than
>>> mask-and-xor. As I understand, iptables and nft tools only generate rules with
>>> mask-xor, though the kernel seems to happily accept other types as well.
>>
>>
>> No, nftables supports this, but iptables does not.
> 
> 
> Hmm, when I run `nft list ruleset` it terminates successfully, but it does
> report some errors at the end if the rule from the example is present.
> 
>> netlink: Error: Invalid source register 0
>> netlink: Error: Bitwise expression has no right-hand expression
>> netlink: Error: Relational expression has no left hand side
> 
> But I'm not completely sure whether it's not me incorrectly encoding the rule.
> 

Hi Remy, could you share the full output of:

'nft --debug=netlink list ruleset'

This will allow me to understand what is the generated bytecode and an 
easy way to reproduce this with libnftnl. I am happy to investigate/fix 
this on the nft/libnftnl/kernel side :)

> For some context, that's how it renders the rule:
> 
>>     chain example-chain {
>>         accept
>>     }
> 
> 
>> iptables should not segfault, however. Care to make a patch?
> 
> 
> Sure. I think it's fine for now to just check for the operation type and
> error with something like "unsupported bitwise operation", like seems to be the
> case with nft tool, since this issue appears to be extremely uncommon, if it
> hasn't been spotted before.
>