netfilter buglog - Aug 2024 - [Bug 1763] New: Segfault when resetting rules with meta l4proto { tcp, udp }

https://bugzilla.netfilter.org/show_bug.cgi?id=1763

            Bug ID: 1763
           Summary: Segfault when resetting rules with meta l4proto { tcp,
                    udp }
           Product: nftables
           Version: 1.0.x
          Hardware: x86_64
                OS: Ubuntu
            Status: NEW
          Severity: minor
          Priority: P5
         Component: nft
          Assignee: pablo at netfilter.org
          Reporter: sly at covertlabs.org

Running into a segfault on version 1.0.9 when rules are listed after `nft reset
rules` with a `meta l4proto { tcp, udp } ...` rule added but listing the same
rule works fine. It seems to have problems with the `{ tcp, udp }` set.

# nft create table testsegfault
# nft add chain testsegfault dns-nat-pre "{ type nat hook prerouting
priority
0; }"
# nft add rule testsegfault dns-nat-pre meta l4proto { tcp, udp } th dport 53
ip saddr 10.24.0.0/24 ip daddr != 10.25.0.1 counter dnat to 10.25.0.1
# nft list ruleset
table ip testsegfault {
        chain dns-nat-pre {
                type nat hook prerouting priority filter; policy accept;
                meta l4proto { tcp, udp } th dport 53 ip saddr 10.24.0.0/24 ip
daddr != 10.25.0.1 counter packets 0 bytes 0 dnat to 10.25.0.1
        }
}
# nft reset rules
table ip testsegfault {
        chain dns-nat-pre {
                type nat hook prerouting priority filter; policy accept;
                meta l4proto Segmentation fault (core dumped)



I also tried a simplified version of the above rule to ensure it wasn't
something further in the rule causing issues and ran into the same segfault.

# nft create table testsegfault
# nft add chain testsegfault dns-nat-pre "{ type nat hook prerouting
priority
0; }"
# nft add rule testsegfault dns-nat-pre meta l4proto { tcp, udp } th dport 53
counter dnat to 10.25.0.1
# nft list ruleset
table ip testsegfault {
        chain dns-nat-pre {
                type nat hook prerouting priority filter; policy accept;
                meta l4proto { tcp, udp } th dport 53 counter packets 0 bytes 0
dnat to 10.25.0.1
        }
}
# nft reset rules
table ip testsegfault {
        chain dns-nat-pre {
                type nat hook prerouting priority filter; policy accept;
                meta l4proto Segmentation fault (core dumped)



This is on an AWS Ubuntu 24.04 EC2 instance.

# uname -rvp
6.8.0-1012-aws #13-Ubuntu SMP Mon Jul 15 13:40:27 UTC 2024 x86_64

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20240802/a08c44e3/attachment.html>

https://bugzilla.netfilter.org/show_bug.cgi?id=1763

--- Comment #1 from Pablo Neira Ayuso <pablo at netfilter.org> ---
It does not crash here with 1.1.0 but listing looks incomplete.

# nft reset rules                            t
table ip testsegfault {
        chain dns-nat-pre {
                type nat hook prerouting priority filter; policy accept;
        }
}

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20240805/f118c21a/attachment.html>

https://bugzilla.netfilter.org/show_bug.cgi?id=1763

--- Comment #2 from sly at covertlabs.org ---
After looking into this some more, I see `expr_print` is losing reference to
the set when it attempts `ops->print(expr, octx)`.

(gdb) r list ruleset
table ip testsegfault {
        chain dns-nat-pre {
                type nat hook prerouting priority filter; policy accept;
                meta l4proto 
Breakpoint 1, expr_print (expr=0x555555560040, 
    octx=0x55555555c2e8)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:101

(gdb) bt
#0  expr_print (expr=0x555555560040, 
    octx=0x55555555c2e8)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:101
#1  0x00007ffff7ef5150 in expr_print (
    octx=0x55555555c2e8, expr=0x5555555611c0)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:105
#2  binop_arg_print (op=<optimized out>, 
    arg=0x5555555611c0, octx=0x55555555c2e8)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:645
#3  0x00007ffff7ee6002 in rule_print (
    rule=0x555555560e80, octx=0x55555555c2e8)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/rule.c:491



(gdb) r reset rules
table ip testsegfault {
        chain dns-nat-pre {
                type nat hook prerouting priority filter; policy accept;
                meta l4proto 
Breakpoint 1, expr_print (expr=0x0, 
    octx=0x55555555c2e8)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:101

(gdb) bt
#0  expr_print (expr=0x0, octx=0x55555555c2e8)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:101
#1  0x00007ffff7ef5150 in expr_print (
    octx=0x55555555c2e8, expr=0x55555555e020)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:105
#2  binop_arg_print (op=<optimized out>, 
    arg=0x55555555e020, octx=0x55555555c2e8)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:645
#3  0x00007ffff7ee6002 in rule_print (
    rule=0x55555555dce0, octx=0x55555555c2e8)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/rule.c:491



I also noticed that `nft list ruleset` shows `etype = EXPR_SET` while `nft
reset rules` shows `etype = EXPR_SET_REF` before the reference is lost.

(gdb) r list ruleset
table ip testsegfault {
        chain dns-nat-pre {
                type nat hook prerouting priority filter; policy accept;
                meta l4proto 
Breakpoint 1, expr_print (expr=0x555555560040, 
    octx=0x55555555c2e8)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:101

(gdb) p expr->etype
$2 = EXPR_SET



(gdb) r reset rules
table ip testsegfault {
        chain dns-nat-pre {
                type nat hook prerouting priority filter; policy accept;
                meta l4proto 
Breakpoint 1, expr_print (expr=0x0, 
    octx=0x55555555c2e8)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:101

(gdb) f 1
#1  0x00007ffff7ef5150 in expr_print (
    octx=0x55555555c2e8, expr=0x55555555e020)
    at /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c:105
105     in /build/nftables-BBbmPI/nftables-1.0.9/src/expression.c

(gdb) p expr->etype
$3 = EXPR_SET_REF



I have yet to find time to discover why this is only being detected as a set
reference when resetting though. Just started getting familiar with the
codebase.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20240806/e803e42a/attachment.html>

https://bugzilla.netfilter.org/show_bug.cgi?id=1763

--- Comment #3 from Pablo Neira Ayuso <pablo at netfilter.org> ---
https://patchwork.ozlabs.org/project/netfilter-devel/patch/20240815153519.1589974-1-pablo
at netfilter.org/

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20240815/1f5417a9/attachment.html>

https://bugzilla.netfilter.org/show_bug.cgi?id=1763

Pablo Neira Ayuso <pablo at netfilter.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #4 from Pablo Neira Ayuso <pablo at netfilter.org> ---
This triggered a larger series:

7886acd7f6f4 tests: shell: cover anonymous set with reset command
dbff26bfba83 cache: consolidate reset command
ebd06f85a325 cache: only dump rules for the given table
969ce17b66f8 cache: add filtering support for objects
68c8fb5f7c98 cache: accumulate flags in batch
29cb49d0ca92 cache: reset filter for each command

fix will be included in next nftables release v1.1.1

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20240910/6c9092c4/attachment.html>