|
 |
4b2fc1 |
From 7fb6387b3c00346a429d291dd057e47c9354e263 Mon Sep 17 00:00:00 2001
|
|
|
4b2fc1 |
From: Timothy Redaelli <tredaelli@redhat.com>
|
|
|
4b2fc1 |
Date: Fri, 24 Feb 2017 11:58:57 +0100
|
|
|
4b2fc1 |
Subject: [PATCH] evaluate: reject: Have a generic fix for missing network
|
|
|
4b2fc1 |
context
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1360354
|
|
|
4b2fc1 |
Upstream Status: nftables commit 7241af3
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
commit 7241af302bbe56908fa87b17799048bfe884e35f
|
|
|
4b2fc1 |
Author: Phil Sutter <phil@nwl.cc>
|
|
|
4b2fc1 |
Date: Tue Aug 30 19:39:51 2016 +0200
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
evaluate: reject: Have a generic fix for missing network context
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
Commit 17b495957b29e ("evaluate: reject: fix crash if we have transport
|
|
|
4b2fc1 |
protocol conflict from inet") took care of a crash when using inet or
|
|
|
4b2fc1 |
bridge families, but since then netdev family has been added which also
|
|
|
4b2fc1 |
does not implicitly define the network context. Therefore the crash can
|
|
|
4b2fc1 |
be reproduced again using the following example:
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
nft add rule netdev filter e1000-ingress \
|
|
|
4b2fc1 |
meta l4proto udp reject with tcp reset
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
In order to fix this in a more generic way, have stmt_evaluate_reset()
|
|
|
4b2fc1 |
fall back to the generic proto_inet_service irrespective of the actual
|
|
|
4b2fc1 |
proto context.
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
4b2fc1 |
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
Signed-off-by: Timothy Redaelli <tredaelli@redhat.com>
|
|
|
4b2fc1 |
---
|
|
|
4b2fc1 |
src/evaluate.c | 4 +---
|
|
|
4b2fc1 |
1 file changed, 1 insertion(+), 3 deletions(-)
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
diff --git a/src/evaluate.c b/src/evaluate.c
|
|
|
4b2fc1 |
index 5e3c158..1b8d565 100644
|
|
|
4b2fc1 |
--- a/src/evaluate.c
|
|
|
4b2fc1 |
+++ b/src/evaluate.c
|
|
|
4b2fc1 |
@@ -2014,9 +2014,7 @@ static int stmt_evaluate_reset(struct eval_ctx *ctx, struct stmt *stmt)
|
|
|
4b2fc1 |
return 0;
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
base = pctx->protocol[PROTO_BASE_NETWORK_HDR].desc;
|
|
|
4b2fc1 |
- if (base == NULL &&
|
|
|
4b2fc1 |
- (ctx->pctx.family == NFPROTO_INET ||
|
|
|
4b2fc1 |
- ctx->pctx.family == NFPROTO_BRIDGE))
|
|
|
4b2fc1 |
+ if (base == NULL)
|
|
|
4b2fc1 |
base = &proto_inet_service;
|
|
|
4b2fc1 |
|
|
|
4b2fc1 |
protonum = proto_find_num(base, desc);
|
|
|
4b2fc1 |
--
|
|
|
4b2fc1 |
1.8.3.1
|
|
|
4b2fc1 |
|