v2:
- fix a UAF during rule listing. When OP_AND gets culled,
'expr' is free'd as well ahead of time because they alias one
another in the set key case (there is no compare/relational op).
- add and handle plain 'vlan id' in a set key.
in v1, this would be shown with the '& 0xfff' included, because
v1 only removed OP_AND in concatenations.
Eric Garver reported a number of issues when matching vlan headers:
In: update @macset { ether saddr . vlan id timeout 5s }
Out: update @macset { @ll,48,48 . @ll,112,16 & 0xfff timeout 5s }
This is because of amnesia in nft during expression decoding:
When we encounter 'vlan id', the L2 protocl (ethernet) is replaced by
vlan, so we attempt to match @ll,48,48 vs. the vlan header and come up
empty.
The vlan decode fails because we can't handle '& 0xfff' in this
instance, so we can locate the right offset but the payload expression
length doesn't match the template length (16 vs 12 bits).
The main patch is patch 3, which adds a stack of l2 protocols to track
instead of only keeping the cumulative size.
The latter is ok for serialization (we have the expression tree, so its
enough to add the size of the 'previous' l2 headers to payload
expressions that match the new 'top' l2 header.
But for deserialization, we need to be able to search all protocols base
headers seen.
The remaining patches improve handling of 'integer base type'
expressions and add test cases.
Florian Westphal (8):
netlink_delinearize: allow postprocessing on concatenated elements
netlink_delinearize: postprocess binary ands in concatenations
proto: track full stack of seen l2 protocols, not just cumulative
offset
debug: dump the l2 protocol stack
tests: add a test case for ether and vlan listing
netlink_delinearize: also postprocess OP_AND in set element context
evaluate: search stacked header list for matching payload dep
src: allow anon set concatenation with ether and vlan
include/netlink.h | 8 ++
include/proto.h | 3 +-
src/evaluate.c | 36 +++++--
src/expression.c | 17 +++-
src/netlink.c | 10 +-
src/netlink_delinearize.c | 59 ++++++++---
src/payload.c | 67 ++++++++++---
src/proto.c | 8 +-
tests/py/bridge/vlan.t | 5 +
tests/py/bridge/vlan.t.json | 97 +++++++++++++++++++
tests/py/bridge/vlan.t.payload | 28 ++++++
tests/py/bridge/vlan.t.payload.netdev | 34 +++++++
.../testcases/sets/0070stacked_l2_headers | 6 ++
.../sets/dumps/0070stacked_l2_headers.nft | 28 ++++++
14 files changed, 368 insertions(+), 38 deletions(-)
create mode 100755 tests/shell/testcases/sets/0070stacked_l2_headers
create mode 100644 tests/shell/testcases/sets/dumps/0070stacked_l2_headers.nft
--
2.35.1
