From 5b37479b42b338d99d938c56d5d752145b0d9331 Mon Sep 17 00:00:00 2001 From: Sergei Trofimovich Date: Mon, 16 Sep 2019 08:33:20 +0100 Subject: nftables: don't crash in 'list ruleset' if policy is not set Minimal reproducer: ``` $ cat nft.ruleset # filters table inet filter { chain prerouting { type filter hook prerouting priority -50 } } # dump new state list ruleset $ nft -c -f ./nft.ruleset table inet filter { chain prerouting { Segmentation fault (core dumped) ``` The crash happens in `chain_print_declaration()`: ``` if (chain->flags & CHAIN_F_BASECHAIN) { mpz_export_data(&policy, chain->policy->value, BYTEORDER_HOST_ENDIAN, sizeof(int)); ``` Here `chain->policy` is `NULL` (as textual rule does not mention it). The change is not to print the policy if it's not set (similar to `chain_evaluate()` handling). CC: Florian Westphal CC: Pablo Neira Ayuso CC: netfilter-devel@vger.kernel.org Bug: https://bugzilla.netfilter.org/show_bug.cgi?id=1365 Signed-off-by: Sergei Trofimovich Acked-by: Fernando Fernandez Mancera Signed-off-by: Florian Westphal --- tests/shell/testcases/nft-f/0021list_ruleset_0 | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100755 tests/shell/testcases/nft-f/0021list_ruleset_0 (limited to 'tests/shell/testcases/nft-f/0021list_ruleset_0') diff --git a/tests/shell/testcases/nft-f/0021list_ruleset_0 b/tests/shell/testcases/nft-f/0021list_ruleset_0 new file mode 100755 index 00000000..37729b4f --- /dev/null +++ b/tests/shell/testcases/nft-f/0021list_ruleset_0 @@ -0,0 +1,15 @@ +#!/bin/bash + +# Tests use of variables in jump statements + +set -e + +RULESET="table filter { + chain prerouting { + type filter hook prerouting priority -50 + } +} +list ruleset +" + +exec $NFT -f - <<< "$RULESET" -- cgit v1.2.3