On 27.4.2022 10.01, Pablo Neira Ayuso wrote:
On Wed, Apr 27, 2022 at 07:48:20AM +0200, Florian Westphal wrote:
Topi Miettinen <toiwoton@xxxxxxxxx> wrote:
On 26.4.2022 1.34, Florian Westphal wrote:
Topi Miettinen <toiwoton@xxxxxxxxx> wrote:
On 20.4.2022 21.54, Topi Miettinen wrote:
Add socket expressions for checking GID or UID of the originating
socket. These work also on input side, unlike meta skuid/skgid.
Unfortunately, there's a reproducible kernel BUG when closing a local
connection:
Apr 25 21:18:13 kernel:
==================================================================
Apr 25 21:18:13 kernel: BUG: KASAN: null-ptr-deref in
nf_sk_lookup_slow_v6+0x45b/0x590 [nf_socket_ipv6]
You can pass this to scripts/faddr2line to get the location of the null deref.
Didn't work,
?
You pass the object file and the nf_sk_lookup_slow_v6+0x45b/0x590 info.
I can't do it for you because I lack the object file and the exact
source code.
$ faddr2line nf_socket_ipv6.ko nf_sk_lookup_slow_v6+0x45b/0x590
bad symbol size: base: 0x0000000000000000 end: 0x0000000000000000
$ faddr2line nf_socket_ipv6.o nf_sk_lookup_slow_v6+0x45b/0x590
bad symbol size: base: 0x0000000000000000 end: 0x0000000000000000
$ faddr2line nf_socket_ipv6.mod nf_sk_lookup_slow_v6+0x45b/0x590
readelf: Error: nf_socket_ipv6.mod: Failed to read file header
size: nf_socket_ipv6.mod: file format not recognized
nm: nf_socket_ipv6.mod: file format not recognized
size: nf_socket_ipv6.mod: file format not recognized
nm: nf_socket_ipv6.mod: file format not recognized
no match for nf_sk_lookup_slow_v6+0x45b/0x590
$ faddr2line nf_socket_ipv6.mod.o nf_sk_lookup_slow_v6+0x45b/0x590
no match for nf_sk_lookup_slow_v6+0x45b/0x590
$ faddr2line vmlinux nf_sk_lookup_slow_v6+0x45b/0x590
no match for nf_sk_lookup_slow_v6+0x45b/0x590
net/ipv6/netfilter/nf_socket_ipv6.c:
static struct sock *
nf_socket_get_sock_v6(struct net *net, struct sk_buff *skb, int doff,
const u8 protocol,
const struct in6_addr *saddr, const struct in6_addr
*daddr,
const __be16 sport, const __be16 dport,
const struct net_device *in)
{
switch (protocol) {
case IPPROTO_TCP:
return inet6_lookup(net, &tcp_hashinfo, skb, doff,
saddr, sport, daddr, dport,
in->ifindex);
What does that rule look like? Seems like no input interface is
available, seems like a bug in existing code?
nft_socket_eval() assumes it always run from input path.
@Topi: How does you test ruleset look like?
Here's a reproducer:
#!/usr/sbin/nft -f
table inet mangle {
chain output {
type route hook output priority mangle; policy accept;
socket uid != 0 reject with icmpx type admin-prohibited
}
}
Start nc -6l 1 as root
Try 'telnet ::1 1' as root, press enter and close the connection. After
1-3 tries, system hangs and Caps Lock starts blinking.
-Topi
