search for: payload_expr_pctx_update

...Estimated Hours: 0.0 There is a problem when we invert a protocol: * We add the following rule, and It does not show any error. $ sudo nft add rule ip test input ip protocol != icmp * We list the table test, and It shows this problem: $ sudo nft -nn list table ip test nft: src/payload.c:76: payload_expr_pctx_update: Assertion `expr->op == OP_EQ' failed. Also, we can reproduce it in the following cases: - ah with nexthdr: * We add the following rule, and It does not show any error. $ sudo nft add rule ip test input ah nexthdr != esp * We list the table test, It shows the following problem: $ sudo nf...

...p protocol 89 accept gives this output Segmentation fault (core dumped) using gdb... (gdb) run add rule ip filter input ip protocol 89 accept Starting program: /usr/sbin/nft add rule ip filter input ip protocol 89 accept Program received signal SIGSEGV, Segmentation fault. 0x0000000000411cb9 in payload_expr_pctx_update () (gdb) bt #0 0x0000000000411cb9 in payload_expr_pctx_update () #1 0x000000000040f5d6 in expr_evaluate () #2 0x000000000040dd8c in stmt_evaluate () #3 0x0000000000410eec in rule_evaluate () #4 0x000000000042d332 in nft_parse () #5 0x0000000000406b4d in nft_run () #6 0x000000000040676d in ma...

...to indicate that the issue may be with commit 20b1131c07acd2fc71803be592430f0e06c4090e. I've included the GDB session output below. Starting program: /sbin/nft add rule ip filter INPUT ip protocol igmp counter accept Program received signal SIGSEGV, Segmentation fault. 0x0000000000417136 in payload_expr_pctx_update (ctx=0x7fffffffe748, expr=0x6767f0) at payload.c:88 88 assert(desc->base <= PROTO_BASE_MAX); #0 0x0000000000417136 in payload_expr_pctx_update (ctx=0x7fffffffe748, expr=0x6767f0) at payload.c:88 #1 0x0000000000413453 in expr_evaluate_relational (ctx=0x7fffffffe708, expr=0x6768c8) at...

https://bugzilla.netfilter.org/show_bug.cgi?id=1072 Bug ID: 1072 Summary: coredump when parsing ip protocol with number > 6 Product: nftables Version: unspecified Hardware: x86_64 OS: All Status: NEW Severity: major Priority: P5 Component: nft Assignee: pablo at

...gister(), release previous on _set() meta: set base field on clones tests: regression: fix "Listing is broken" instead of output mismatch tests: regression: any/ct: remove wrong output scanner: don't bug on too large values payload: fix endianess issue in payload_expr_pctx_update() src: generate set members using integer_type in the appropriate byteorder netlink_delinearize: fix listing of set members in host byteorder using integer_type netlink: fix listing of range set elements in host byteorder rule: fix segmentation faults on kernels without nfta...