[PATCH nft v2 0/8] really handle stacked l2 headers

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



v2:
- fix a UAF during rule listing.  When OP_AND gets culled,
  'expr' is free'd as well ahead of time because they alias one
  another in the set key case (there is no compare/relational op).
- add and handle plain 'vlan id' in a set key.
  in v1, this would be shown with the '& 0xfff' included, because
  v1 only removed OP_AND in concatenations.

Eric Garver reported a number of issues when matching vlan headers:

In:  update @macset { ether saddr . vlan id timeout 5s }
Out: update @macset { @ll,48,48 . @ll,112,16 & 0xfff timeout 5s }

This is because of amnesia in nft during expression decoding:
When we encounter 'vlan id', the L2 protocl (ethernet) is replaced by
vlan, so we attempt to match @ll,48,48 vs. the vlan header and come up
empty.

The vlan decode fails because we can't handle '& 0xfff' in this
instance, so we can locate the right offset but the payload expression
length doesn't match the template length (16 vs 12 bits).


The main patch is patch 3, which adds a stack of l2 protocols to track
instead of only keeping the cumulative size.

The latter is ok for serialization (we have the expression tree, so its
enough to add the size of the 'previous' l2 headers to payload
expressions that match the new 'top' l2 header.

But for deserialization, we need to be able to search all protocols base
headers seen.

The remaining patches improve handling of 'integer base type'
expressions and add test cases.

Florian Westphal (8):
  netlink_delinearize: allow postprocessing on concatenated elements
  netlink_delinearize: postprocess binary ands in concatenations
  proto: track full stack of seen l2 protocols, not just cumulative
    offset
  debug: dump the l2 protocol stack
  tests: add a test case for ether and vlan listing
  netlink_delinearize: also postprocess OP_AND in set element context
  evaluate: search stacked header list for matching payload dep
  src: allow anon set concatenation with ether and vlan

 include/netlink.h                             |  8 ++
 include/proto.h                               |  3 +-
 src/evaluate.c                                | 36 +++++--
 src/expression.c                              | 17 +++-
 src/netlink.c                                 | 10 +-
 src/netlink_delinearize.c                     | 59 ++++++++---
 src/payload.c                                 | 67 ++++++++++---
 src/proto.c                                   |  8 +-
 tests/py/bridge/vlan.t                        |  5 +
 tests/py/bridge/vlan.t.json                   | 97 +++++++++++++++++++
 tests/py/bridge/vlan.t.payload                | 28 ++++++
 tests/py/bridge/vlan.t.payload.netdev         | 34 +++++++
 .../testcases/sets/0070stacked_l2_headers     |  6 ++
 .../sets/dumps/0070stacked_l2_headers.nft     | 28 ++++++
 14 files changed, 368 insertions(+), 38 deletions(-)
 create mode 100755 tests/shell/testcases/sets/0070stacked_l2_headers
 create mode 100644 tests/shell/testcases/sets/dumps/0070stacked_l2_headers.nft

-- 
2.35.1




[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux