From: Son Dinh <dinhtrason@gmail.com>
To: netfilter-devel@vger.kernel.org, fw@netfilter.org
Cc: pablo@netfilter.org, Son Dinh <dinhtrason@gmail.com>
Subject: [nft PATCH v3] dynset: avoid errouneous assert with ipv6 concat data
Date: Tue, 9 Apr 2024 16:23:31 +1000 [thread overview]
Message-ID: <20240409062331.3285-1-dinhtrason@gmail.com> (raw)
In-Reply-To: <CA+Xkr6hrT0QvYn3V2S7=drzCLYky-ebe3J_9k8uf-KjSV=kdFw@mail.gmail.com>
Fix assert bug of map dynset having ipv6 concat data
nft add rule ip6 table-test chain-1 update @map-X { ip6 saddr : 1000::1 . 5001 }
nft: src/netlink_linearize.c:873: netlink_gen_expr: Assertion `dreg < ctx->reg_low' failed.
Aborted (core dumped)
The current code allocates upto 4 registers for map dynset data, but ipv6 concat
data of a dynset requires more than 4 registers, resulting in the assert in
netlink_gen_expr when generating netlink info for the dynset data.
Signed-off-by: Son Dinh <dinhtrason@gmail.com>
---
src/netlink_linearize.c | 6 ++---
tests/py/ip/sets.t | 2 ++
tests/py/ip/sets.t.json | 37 ++++++++++++++++++++++++++++++
tests/py/ip/sets.t.payload.inet | 11 +++++++++
tests/py/ip/sets.t.payload.ip | 8 +++++++
tests/py/ip/sets.t.payload.netdev | 10 ++++++++
tests/py/ip6/sets.t | 3 +++
tests/py/ip6/sets.t.json | 37 ++++++++++++++++++++++++++++++
tests/py/ip6/sets.t.payload.inet | 11 +++++++++
tests/py/ip6/sets.t.payload.ip6 | 8 +++++++
tests/py/ip6/sets.t.payload.netdev | 10 ++++++++
tests/py/nft-test.py | 4 ++++
12 files changed, 144 insertions(+), 3 deletions(-)
diff --git src/netlink_linearize.c src/netlink_linearize.c
index 6204d8fd..de9e975f 100644
--- src/netlink_linearize.c
+++ src/netlink_linearize.c
@@ -1592,11 +1592,11 @@ static void netlink_gen_map_stmt(struct netlink_linearize_ctx *ctx,
sreg_key = get_register(ctx, stmt->map.key->key);
netlink_gen_expr(ctx, stmt->map.key->key, sreg_key);
- sreg_data = get_register(ctx, stmt->map.data);
- netlink_gen_expr(ctx, stmt->map.data, sreg_data);
+ sreg_data = get_register(ctx, stmt->map.data->key);
+ netlink_gen_expr(ctx, stmt->map.data->key, sreg_data);
release_register(ctx, stmt->map.key->key);
- release_register(ctx, stmt->map.data);
+ release_register(ctx, stmt->map.data->key);
nle = alloc_nft_expr("dynset");
netlink_put_register(nle, NFTNL_EXPR_DYNSET_SREG_KEY, sreg_key);
diff --git tests/py/ip/sets.t tests/py/ip/sets.t
index 46d9686b..828a1f1f 100644
--- tests/py/ip/sets.t
+++ tests/py/ip/sets.t
@@ -66,3 +66,5 @@ ip saddr @set6 drop;ok
ip saddr vmap { 1.1.1.1 : drop, * : accept };ok
meta mark set ip saddr map { 1.1.1.1 : 0x00000001, * : 0x00000002 };ok
+!map2 type ipv4_addr . ipv4_addr . inet_service : ipv4_addr . inet_service;ok
+add @map2 { ip saddr . ip daddr . th dport : 10.0.0.1 . 80 };ok
\ No newline at end of file
diff --git tests/py/ip/sets.t.json tests/py/ip/sets.t.json
index 44ca1528..f2637d93 100644
--- tests/py/ip/sets.t.json
+++ tests/py/ip/sets.t.json
@@ -303,3 +303,40 @@
}
]
+# add @map2 { ip saddr . ip daddr . th dport : 10.0.0.1 . 80 }
+[
+ {
+ "map": {
+ "data": {
+ "concat": [
+ "10.0.0.1",
+ 80
+ ]
+ },
+ "elem": {
+ "concat": [
+ {
+ "payload": {
+ "field": "saddr",
+ "protocol": "ip"
+ }
+ },
+ {
+ "payload": {
+ "field": "daddr",
+ "protocol": "ip"
+ }
+ },
+ {
+ "payload": {
+ "field": "dport",
+ "protocol": "th"
+ }
+ }
+ ]
+ },
+ "map": "@map2",
+ "op": "add"
+ }
+ }
+]
diff --git tests/py/ip/sets.t.payload.inet tests/py/ip/sets.t.payload.inet
index fd6517a5..cc04b43d 100644
--- tests/py/ip/sets.t.payload.inet
+++ tests/py/ip/sets.t.payload.inet
@@ -104,3 +104,14 @@ inet
[ payload load 4b @ network header + 12 => reg 1 ]
[ lookup reg 1 set __map%d dreg 1 ]
[ meta set mark with reg 1 ]
+
+# add @map2 { ip saddr . ip daddr . th dport : 10.0.0.1 . 80 }
+inet test-inet input
+ [ meta load nfproto => reg 1 ]
+ [ cmp eq reg 1 0x00000002 ]
+ [ payload load 4b @ network header + 12 => reg 1 ]
+ [ payload load 4b @ network header + 16 => reg 9 ]
+ [ payload load 2b @ transport header + 2 => reg 10 ]
+ [ immediate reg 11 0x0100000a ]
+ [ immediate reg 2 0x00005000 ]
+ [ dynset add reg_key 1 set map2 sreg_data 11 ]
diff --git tests/py/ip/sets.t.payload.ip tests/py/ip/sets.t.payload.ip
index d9cc32b6..f9ee1f98 100644
--- tests/py/ip/sets.t.payload.ip
+++ tests/py/ip/sets.t.payload.ip
@@ -81,3 +81,11 @@ ip test-ip4 input
[ meta load mark => reg 10 ]
[ dynset add reg_key 1 set map1 sreg_data 10 ]
+# add @map2 { ip saddr . ip daddr . th dport : 10.0.0.1 . 80 }
+ip test-ip4 input
+ [ payload load 4b @ network header + 12 => reg 1 ]
+ [ payload load 4b @ network header + 16 => reg 9 ]
+ [ payload load 2b @ transport header + 2 => reg 10 ]
+ [ immediate reg 11 0x0100000a ]
+ [ immediate reg 2 0x00005000 ]
+ [ dynset add reg_key 1 set map2 sreg_data 11 ]
diff --git tests/py/ip/sets.t.payload.netdev tests/py/ip/sets.t.payload.netdev
index d41b9e8b..3d0dc79a 100644
--- tests/py/ip/sets.t.payload.netdev
+++ tests/py/ip/sets.t.payload.netdev
@@ -105,3 +105,13 @@ netdev test-netdev ingress
[ meta load mark => reg 10 ]
[ dynset add reg_key 1 set map1 sreg_data 10 ]
+# add @map2 { ip saddr . ip daddr . th dport : 10.0.0.1 . 80 }
+netdev test-netdev ingress
+ [ meta load protocol => reg 1 ]
+ [ cmp eq reg 1 0x00000008 ]
+ [ payload load 4b @ network header + 12 => reg 1 ]
+ [ payload load 4b @ network header + 16 => reg 9 ]
+ [ payload load 2b @ transport header + 2 => reg 10 ]
+ [ immediate reg 11 0x0100000a ]
+ [ immediate reg 2 0x00005000 ]
+ [ dynset add reg_key 1 set map2 sreg_data 11 ]
diff --git tests/py/ip6/sets.t tests/py/ip6/sets.t
index 17fd62f5..cc26bd22 100644
--- tests/py/ip6/sets.t
+++ tests/py/ip6/sets.t
@@ -46,3 +46,6 @@ add @set5 { ip6 saddr . ip6 daddr };ok
add @map1 { ip6 saddr . ip6 daddr : meta mark };ok
delete @set5 { ip6 saddr . ip6 daddr };ok
+
+!map2 type ipv6_addr . ipv6_addr . inet_service : ipv6_addr . inet_service;ok
+add @map2 { ip6 saddr . ip6 daddr . th dport : 1234::1 . 80 };ok
\ No newline at end of file
diff --git tests/py/ip6/sets.t.json tests/py/ip6/sets.t.json
index 2029d2b5..99236099 100644
--- tests/py/ip6/sets.t.json
+++ tests/py/ip6/sets.t.json
@@ -148,3 +148,40 @@
}
]
+# add @map2 { ip6 saddr . ip6 daddr . th dport : 1234::1 . 80 }
+[
+ {
+ "map": {
+ "data": {
+ "concat": [
+ "1234::1",
+ 80
+ ]
+ },
+ "elem": {
+ "concat": [
+ {
+ "payload": {
+ "field": "saddr",
+ "protocol": "ip6"
+ }
+ },
+ {
+ "payload": {
+ "field": "daddr",
+ "protocol": "ip6"
+ }
+ },
+ {
+ "payload": {
+ "field": "dport",
+ "protocol": "th"
+ }
+ }
+ ]
+ },
+ "map": "@map2",
+ "op": "add"
+ }
+ }
+]
diff --git tests/py/ip6/sets.t.payload.inet tests/py/ip6/sets.t.payload.inet
index 2bbd5573..2dbb818a 100644
--- tests/py/ip6/sets.t.payload.inet
+++ tests/py/ip6/sets.t.payload.inet
@@ -47,3 +47,14 @@ inet test-inet input
[ payload load 16b @ network header + 8 => reg 1 ]
[ payload load 16b @ network header + 24 => reg 2 ]
[ dynset delete reg_key 1 set set5 ]
+
+# add @map2 { ip6 saddr . ip6 daddr . th dport : 1234::1 . 80 }
+inet test-inet input
+ [ meta load nfproto => reg 1 ]
+ [ cmp eq reg 1 0x0000000a ]
+ [ payload load 16b @ network header + 8 => reg 1 ]
+ [ payload load 16b @ network header + 24 => reg 2 ]
+ [ payload load 2b @ transport header + 2 => reg 3 ]
+ [ immediate reg 17 0x00003412 0x00000000 0x00000000 0x01000000 ]
+ [ immediate reg 21 0x00005000 ]
+ [ dynset add reg_key 1 set map2 sreg_data 17 ]
diff --git tests/py/ip6/sets.t.payload.ip6 tests/py/ip6/sets.t.payload.ip6
index c59f7b5c..7234b989 100644
--- tests/py/ip6/sets.t.payload.ip6
+++ tests/py/ip6/sets.t.payload.ip6
@@ -36,3 +36,11 @@ ip6 test-ip6 input
[ meta load mark => reg 3 ]
[ dynset add reg_key 1 set map1 sreg_data 3 ]
+# add @map2 { ip6 saddr . ip6 daddr . th dport : 1234::1 . 80 }
+ip6 test-ip6 input
+ [ payload load 16b @ network header + 8 => reg 1 ]
+ [ payload load 16b @ network header + 24 => reg 2 ]
+ [ payload load 2b @ transport header + 2 => reg 3 ]
+ [ immediate reg 17 0x00003412 0x00000000 0x00000000 0x01000000 ]
+ [ immediate reg 21 0x00005000 ]
+ [ dynset add reg_key 1 set map2 sreg_data 17 ]
diff --git tests/py/ip6/sets.t.payload.netdev tests/py/ip6/sets.t.payload.netdev
index 1866d26b..2ad0f434 100644
--- tests/py/ip6/sets.t.payload.netdev
+++ tests/py/ip6/sets.t.payload.netdev
@@ -48,3 +48,13 @@ netdev test-netdev ingress
[ meta load mark => reg 3 ]
[ dynset add reg_key 1 set map1 sreg_data 3 ]
+# add @map2 { ip6 saddr . ip6 daddr . th dport : 1234::1 . 80 }
+netdev test-netdev ingress
+ [ meta load protocol => reg 1 ]
+ [ cmp eq reg 1 0x0000dd86 ]
+ [ payload load 16b @ network header + 8 => reg 1 ]
+ [ payload load 16b @ network header + 24 => reg 2 ]
+ [ payload load 2b @ transport header + 2 => reg 3 ]
+ [ immediate reg 17 0x00003412 0x00000000 0x00000000 0x01000000 ]
+ [ immediate reg 21 0x00005000 ]
+ [ dynset add reg_key 1 set map2 sreg_data 17 ]
diff --git tests/py/nft-test.py tests/py/nft-test.py
index a7d27c25..eafa258e 100755
--- tests/py/nft-test.py
+++ tests/py/nft-test.py
@@ -1162,6 +1162,10 @@ def set_process(set_line, filename, lineno):
set_data = tokens[i+1]
i += 2
+ while len(tokens) > i and tokens[i] == ".":
+ set_data += " . " + tokens[i+1]
+ i += 2
+
if parse_typeof and tokens[i] == "mark":
set_data += " " + tokens[i]
i += 1;
--
2.44.0.windows.1
prev parent reply other threads:[~2024-04-09 6:24 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-07 12:47 [nft PATCH] dynset: avoid errouneous assert with ipv6 concat data Son Dinh
2024-04-07 17:17 ` Florian Westphal
2024-04-08 4:32 ` Son Tra Dinh
2024-04-09 3:02 ` [nft PATCH v2] " Son Dinh
2024-04-09 6:23 ` Son Dinh [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240409062331.3285-1-dinhtrason@gmail.com \
--to=dinhtrason@gmail.com \
--cc=fw@netfilter.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).