I'm going through older commits in nftables that I didn't review at the
time and I'm wondering about this one:
commit a320531e78f1bcb12b24da048f34592771392a9a
Author: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Date: Wed Jul 24 15:14:22 2013 +0200
datatype: fix crash if wrong integer type is passed
Eric Leblond reported that this command:
nft add rule ip6 filter input position 4 meta protocol icmpv6 accept
crashes nft. The problem is that 'icmpv6' is wrong there, as
meta protocol is expecting an ethernet protocol, that can be
expressed as an hexadecimal.
Now this command displays the following error:
<cmdline>:1:52-57: Error: This is not a valid Ethernet protocol
add rule ip6 filter input position 4 meta protocol icmpv6 accept
^^^^^^
We have generic type checks so I don't want to add special ones (with
different error messages) for special cases.
Additionally I don't see the error, reverting that patch and executing
the mentioned rule produces:
<cmdline>:1:52-57: Error: datatype mismatch, expected Ethernet protocol, expression has type Internet protocol
add rule ip6 filter input position 4 meta protocol icmpv6 accept
~~~~~~~~~~~~~ ^^^^^^
Looking at the bugzilla entry, the bug report states:
BUG: invalid input descriptor type 538976288
nft: src/erec.c:100: erec_print: Assertion `0' failed.
Abandon
So the problem wasn't related to data types at all but simply due to
some bug in error reporting. I'll queue up a revert in my tree.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
