From 0a9ad3152c4e4678c94502441f5b002fef4fbff2 Mon Sep 17 00:00:00 2001

From: Pablo Neira Ayuso <pablo@netfilter.org>

Date: Mon, 1 Oct 2018 14:51:24 +0200

Subject: [PATCH] segtree: bogus range via get set element on existing elements

 table ip x {

        set y {

                type inet_service

                flags interval

                elements = { 10, 20-30, 40, 50-60 }

        }

 }

 # nft get element x y { 20-40 }

 table ip x {

        set y {

                type inet_service

                flags interval

                elements = { 20-40 }

        }

 }

20 and 40 exist in the tree, but they are part of different ranges.

This patch adds a new get_set_decompose() function to validate that the

left and the right side of the range.

Reported-by: Phil Sutter <phil@nwl.cc>

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

(cherry picked from commit 95629758a5ec36313d839f8545fef0dc220408d8)

Signed-off-by: Phil Sutter <psutter@redhat.com>

---

 include/expression.h |  2 +-

 src/netlink.c        |  5 +++--

 src/segtree.c        | 48 ++++++++++++++++++++++++++++++++++++++++++--

 3 files changed, 50 insertions(+), 5 deletions(-)

diff --git a/include/expression.h b/include/expression.h

index 2bb51e531ecbe..885e9c43bb77f 100644

--- a/include/expression.h

+++ b/include/expression.h

@@ -442,7 +442,7 @@ extern void interval_map_decompose(struct expr *set);

 extern struct expr *get_set_intervals(const struct set *set,

 				      const struct expr *init);

 struct table;

-extern void get_set_decompose(struct table *table, struct set *set);

+extern int get_set_decompose(struct table *table, struct set *set);

 extern struct expr *mapping_expr_alloc(const struct location *loc,

 				       struct expr *from, struct expr *to);

diff --git a/src/netlink.c b/src/netlink.c

index 864947b4d2f07..ca5e9b4a0f8a6 100644

--- a/src/netlink.c

+++ b/src/netlink.c

@@ -1353,8 +1353,9 @@ int netlink_get_setelem(struct netlink_ctx *ctx, const struct handle *h,

 	nftnl_set_free(nls_out);

 	ctx->set = NULL;

-	if (set->flags & NFT_SET_INTERVAL)

-		get_set_decompose(table, set);

+	if (set->flags & NFT_SET_INTERVAL &&

+	    get_set_decompose(table, set) < 0)

+		return -1;

 	return 0;

 }

diff --git a/src/segtree.c b/src/segtree.c

index 8a8aa71e8a6e2..288b01f420a48 100644

--- a/src/segtree.c

+++ b/src/segtree.c

@@ -641,6 +641,42 @@ struct expr *get_set_intervals(const struct set *set, const struct expr *init)

 	return new_init;

 }

+static struct expr *get_set_interval_find(const struct table *table,

+					  const char *set_name,

+					  struct expr *left,

+					  struct expr *right)

+{

+	struct expr *range = NULL;

+	struct set *set;

+	mpz_t low, high;

+	struct expr *i;

+

+	set = set_lookup(table, set_name);

+	mpz_init2(low, set->key->len);

+	mpz_init2(high, set->key->len);

+

+	list_for_each_entry(i, &set->init->expressions, list) {

+		switch (i->key->ops->type) {

+		case EXPR_RANGE:

+			range_expr_value_low(low, i);

+			range_expr_value_high(high, i);

+			if (mpz_cmp(left->key->value, low) >= 0 &&

+			    mpz_cmp(right->key->value, high) <= 0)

+				range = range_expr_alloc(&internal_location,

+							 expr_clone(left->key),

+							 expr_clone(right->key));

+			break;

+		default:

+			break;

+		}

+	}

+

+	mpz_clear(low);

+	mpz_clear(high);

+

+	return range;

+}

+

 static struct expr *get_set_interval_end(const struct table *table,

 					 const char *set_name,

 					 struct expr *left)

@@ -675,7 +711,7 @@ static struct expr *get_set_interval_end(const struct table *table,

 	return left;

 }

-void get_set_decompose(struct table *table, struct set *set)

+int get_set_decompose(struct table *table, struct set *set)

 {

 	struct expr *i, *next, *new;

 	struct expr *left = NULL;

@@ -688,7 +724,13 @@ void get_set_decompose(struct table *table, struct set *set)

 			list_del(&left->list);

 			list_del(&i->list);

 			mpz_sub_ui(i->key->value, i->key->value, 1);

-			new = range_expr_alloc(&internal_location, left, i);

+			new = get_set_interval_find(table, set->handle.set.name,

+						    left, i);

+			if (!new) {

+				errno = ENOENT;

+				return -1;

+			}

+

 			compound_expr_add(new_init, new);

 			left = NULL;

 		} else {

@@ -707,6 +749,8 @@ void get_set_decompose(struct table *table, struct set *set)

 	}

 	set->init = new_init;

+

+	return 0;

 }

 static bool range_is_prefix(const mpz_t range)

-- 

2.21.0