From c0080feb0d034913409944d23873cce4bf9edf9e Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Mon, 12 Feb 2024 16:46:29 +0100 Subject: evaluate: permit use of host-endian constant values in set lookup keys AFL found following crash: table ip filter { map ipsec_in { typeof ipsec in reqid . iif : verdict flags interval } chain INPUT { type filter hook input priority filter; policy drop; ipsec in reqid . 100 @ipsec_in } } Which yields: nft: evaluate.c:1213: expr_evaluate_unary: Assertion `!expr_is_constant(arg)' failed. All existing test cases with constant values use big endian values, but "iif" expects host endian values. As raw values were not supported before, concat byteorder conversion doesn't handle constants. Fix this: 1. Add constant handling so that the number is converted in-place, without unary expression. 2. Add the inverse handling on delinearization for non-interval set types. When dissecting the concat data soup, watch for integer constants where the datatype indicates host endian integer. Last, extend an existing test case with the afl input to cover in/output. A new test case is added to test linearization, delinearization and matching. Based on original patch from Florian Westphal, patch subject and description wrote by him. Fixes: b422b07ab2f9 ("src: permit use of constant values in set lookup keys") Signed-off-by: Pablo Neira Ayuso --- src/netlink_delinearize.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src/netlink_delinearize.c') diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c index 27630a8a..1d30a78c 100644 --- a/src/netlink_delinearize.c +++ b/src/netlink_delinearize.c @@ -2722,10 +2722,11 @@ static struct expr *expr_postprocess_string(struct expr *expr) static void expr_postprocess_value(struct rule_pp_ctx *ctx, struct expr **exprp) { + bool interval = (ctx->set && ctx->set->flags & NFT_SET_INTERVAL); struct expr *expr = *exprp; // FIXME - if (expr->byteorder == BYTEORDER_HOST_ENDIAN) + if (expr->byteorder == BYTEORDER_HOST_ENDIAN && !interval) mpz_switch_byteorder(expr->value, expr->len / BITS_PER_BYTE); if (expr_basetype(expr)->type == TYPE_STRING) @@ -2869,7 +2870,9 @@ static void expr_postprocess(struct rule_pp_ctx *ctx, struct expr **exprp) datatype_set(expr->left, expr->right->dtype); } + ctx->set = expr->right->set; expr_postprocess(ctx, &expr->left); + ctx->set = NULL; break; default: expr_postprocess(ctx, &expr->left); -- cgit v1.2.3