diff mbox series

[nft] netlink_delinearize: add assertion to prevent infinite loop

Message ID 20180202123201.7091-1-pablo@netfilter.org
State Accepted
Delegated to: Pablo Neira
Headers show
Series [nft] netlink_delinearize: add assertion to prevent infinite loop | expand

Commit Message

Pablo Neira Ayuso Feb. 2, 2018, 12:32 p.m. UTC 
The following configuration:

 table inet filter {
	chain input {
		ct original ip daddr {1.2.3.4} accept
	}
 }

is triggering an infinite loop.

This problem also exists with concatenations and ct ip {s,d}addr. Until
we have a solution for this, let's just prevent infinite loops.

Now we hit this:

 # nft list ruleset
 nft: netlink_delinearize.c:124: netlink_parse_concat_expr: Assertion `consumed > 0' failed.
 Abort

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
Just a band aid before releasing 0.8.2, ct ip {s,daddr} with inet family
needs a closer look, will be sending a RFC patch to discuss this asap.

 src/netlink_delinearize.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index 2637f4baaec4..256552b5b46e 100644
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -108,6 +108,7 @@  static struct expr *netlink_parse_concat_expr(struct netlink_parse_ctx *ctx,
 					      unsigned int len)
 {
 	struct expr *concat, *expr;
+	unsigned int consumed;
 
 	concat = concat_expr_alloc(loc);
 	while (len > 0) {
@@ -119,7 +120,9 @@  static struct expr *netlink_parse_concat_expr(struct netlink_parse_ctx *ctx,
 		}
 		compound_expr_add(concat, expr);
 
-		len -= netlink_padded_len(expr->len);
+		consumed = netlink_padded_len(expr->len);
+		assert(consumed > 0);
+		len -= consumed;
 		reg += netlink_register_space(expr->len);
 	}
 	return concat;