The following configuration:
table inet filter {
chain input {
ct original ip daddr {1.2.3.4} accept
}
}
is triggering an infinite loop.
This problem also exists with concatenations and ct ip {s,d}addr. Until
we have a solution for this, let's just prevent infinite loops.
Now we hit this:
# nft list ruleset
nft: netlink_delinearize.c:124: netlink_parse_concat_expr: Assertion `consumed > 0' failed.
Abort
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
---
Just a band aid before releasing 0.8.2, ct ip {s,daddr} with inet family
needs a closer look, will be sending a RFC patch to discuss this asap.
src/netlink_delinearize.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index 2637f4baaec4..256552b5b46e 100644
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -108,6 +108,7 @@ static struct expr *netlink_parse_concat_expr(struct netlink_parse_ctx *ctx,
unsigned int len)
{
struct expr *concat, *expr;
+ unsigned int consumed;
concat = concat_expr_alloc(loc);
while (len > 0) {
@@ -119,7 +120,9 @@ static struct expr *netlink_parse_concat_expr(struct netlink_parse_ctx *ctx,
}
compound_expr_add(concat, expr);
- len -= netlink_padded_len(expr->len);
+ consumed = netlink_padded_len(expr->len);
+ assert(consumed > 0);
+ len -= consumed;
reg += netlink_register_space(expr->len);
}
return concat;
--
2.11.0
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
