|
 |
8cce6c |
From be42a2a4a9382a445454eeb9db09aef52f699917 Mon Sep 17 00:00:00 2001
|
|
|
8cce6c |
From: Phil Sutter <phil@nwl.cc>
|
|
|
8cce6c |
Date: Fri, 1 Feb 2019 19:17:50 +0100
|
|
|
8cce6c |
Subject: [PATCH] xtables: Fix for crash when comparing rules with standard
|
|
|
8cce6c |
target
|
|
|
8cce6c |
|
|
|
8cce6c |
When parsing an nftnl_rule with a standard verdict,
|
|
|
8cce6c |
nft_rule_to_iptables_command_state() initialized cs->target but didn't
|
|
|
8cce6c |
care about cs->target->t. When later comparing that rule to another,
|
|
|
8cce6c |
compare_targets() crashed due to unconditional access to t's fields.
|
|
|
8cce6c |
|
|
|
8cce6c |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
8cce6c |
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
|
8cce6c |
(cherry picked from commit a880cc28358a32f96467e248266973b6ab83f080)
|
|
|
8cce6c |
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
|
8cce6c |
---
|
|
|
8cce6c |
iptables/nft-shared.c | 23 +++++++++++++++----
|
|
|
8cce6c |
.../testcases/iptables/0005-delete-rules_0 | 7 ++++++
|
|
|
8cce6c |
iptables/xtables.c | 4 +++-
|
|
|
8cce6c |
3 files changed, 29 insertions(+), 5 deletions(-)
|
|
|
8cce6c |
create mode 100755 iptables/tests/shell/testcases/iptables/0005-delete-rules_0
|
|
|
8cce6c |
|
|
|
8cce6c |
diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
|
|
|
8cce6c |
index 7b8ca5e4becaf..dfc1c803cb68d 100644
|
|
|
8cce6c |
--- a/iptables/nft-shared.c
|
|
|
8cce6c |
+++ b/iptables/nft-shared.c
|
|
|
8cce6c |
@@ -660,19 +660,34 @@ void nft_rule_to_iptables_command_state(const struct nftnl_rule *r,
|
|
|
8cce6c |
match->m = m;
|
|
|
8cce6c |
}
|
|
|
8cce6c |
|
|
|
8cce6c |
- if (cs->target != NULL)
|
|
|
8cce6c |
+ if (cs->target != NULL) {
|
|
|
8cce6c |
cs->jumpto = cs->target->name;
|
|
|
8cce6c |
- else if (cs->jumpto != NULL)
|
|
|
8cce6c |
+ } else if (cs->jumpto != NULL) {
|
|
|
8cce6c |
+ struct xt_entry_target *t;
|
|
|
8cce6c |
+ uint32_t size;
|
|
|
8cce6c |
+
|
|
|
8cce6c |
cs->target = xtables_find_target(cs->jumpto, XTF_TRY_LOAD);
|
|
|
8cce6c |
- else
|
|
|
8cce6c |
+ if (!cs->target)
|
|
|
8cce6c |
+ return;
|
|
|
8cce6c |
+
|
|
|
8cce6c |
+ size = XT_ALIGN(sizeof(struct xt_entry_target)) + cs->target->size;
|
|
|
8cce6c |
+ t = xtables_calloc(1, size);
|
|
|
8cce6c |
+ t->u.target_size = size;
|
|
|
8cce6c |
+ t->u.user.revision = cs->target->revision;
|
|
|
8cce6c |
+ strcpy(t->u.user.name, cs->jumpto);
|
|
|
8cce6c |
+ cs->target->t = t;
|
|
|
8cce6c |
+ } else {
|
|
|
8cce6c |
cs->jumpto = "";
|
|
|
8cce6c |
+ }
|
|
|
8cce6c |
}
|
|
|
8cce6c |
|
|
|
8cce6c |
void nft_clear_iptables_command_state(struct iptables_command_state *cs)
|
|
|
8cce6c |
{
|
|
|
8cce6c |
xtables_rule_matches_free(&cs->matches);
|
|
|
8cce6c |
- if (cs->target)
|
|
|
8cce6c |
+ if (cs->target) {
|
|
|
8cce6c |
free(cs->target->t);
|
|
|
8cce6c |
+ cs->target->t = NULL;
|
|
|
8cce6c |
+ }
|
|
|
8cce6c |
}
|
|
|
8cce6c |
|
|
|
8cce6c |
void print_header(unsigned int format, const char *chain, const char *pol,
|
|
|
8cce6c |
diff --git a/iptables/tests/shell/testcases/iptables/0005-delete-rules_0 b/iptables/tests/shell/testcases/iptables/0005-delete-rules_0
|
|
|
8cce6c |
new file mode 100755
|
|
|
8cce6c |
index 0000000000000..9312fd53c3437
|
|
|
8cce6c |
--- /dev/null
|
|
|
8cce6c |
+++ b/iptables/tests/shell/testcases/iptables/0005-delete-rules_0
|
|
|
8cce6c |
@@ -0,0 +1,7 @@
|
|
|
8cce6c |
+#!/bin/bash
|
|
|
8cce6c |
+
|
|
|
8cce6c |
+# test for crash when comparing rules with standard target
|
|
|
8cce6c |
+
|
|
|
8cce6c |
+$XT_MULTI iptables -A FORWARD -i eth23 -o eth42 -j DROP
|
|
|
8cce6c |
+$XT_MULTI iptables -D FORWARD -i eth23 -o eth42 -j REJECT
|
|
|
8cce6c |
+[[ $? -eq 1 ]] || exit 1
|
|
|
8cce6c |
diff --git a/iptables/xtables.c b/iptables/xtables.c
|
|
|
8cce6c |
index d0167e6396975..eaa9fedeb03bb 100644
|
|
|
8cce6c |
--- a/iptables/xtables.c
|
|
|
8cce6c |
+++ b/iptables/xtables.c
|
|
|
8cce6c |
@@ -1185,8 +1185,10 @@ int do_commandx(struct nft_handle *h, int argc, char *argv[], char **table,
|
|
|
8cce6c |
*table = p.table;
|
|
|
8cce6c |
|
|
|
8cce6c |
xtables_rule_matches_free(&cs.matches);
|
|
|
8cce6c |
- if (cs.target)
|
|
|
8cce6c |
+ if (cs.target) {
|
|
|
8cce6c |
free(cs.target->t);
|
|
|
8cce6c |
+ cs.target->t = NULL;
|
|
|
8cce6c |
+ }
|
|
|
8cce6c |
|
|
|
8cce6c |
if (h->family == AF_INET) {
|
|
|
8cce6c |
free(args.s.addr.v4);
|
|
|
8cce6c |
--
|
|
|
8cce6c |
2.20.1
|
|
|
8cce6c |
|