From 59a33d08ab3a75b2ae370b6816942793f49fa8db Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Tue, 5 Dec 2023 12:56:08 +0100
Subject: parser: tcpopt: fix tcp option parsing with NUM + length field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

tcp option 254 length ge 4

... will segfault.
The crash bug is that tcpopt_expr_alloc() can return NULL if we cannot
find a suitable template for the requested kind + field combination,
so add the needed error handling in the bison parser.

However, we can handle this.  NOP and EOL have templates, all other
options (known or unknown) must also have a length field.

So also add a fallback template to handle both kind and length, even
if only a numeric option is given that nft doesn't recognize.

Don't bother with output, above will be printed via raw syntax, i.e.
tcp option @254,8,8 >= 4.

Fixes: 24d8da308342 ("tcpopt: allow to check for presence of any tcp option")
Reported-by: Maciej Żenczykowski <zenczykowski@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
---
 .../testcases/packetpath/dumps/tcp_options.nodump  |  0
 tests/shell/testcases/packetpath/tcp_options       | 55 ++++++++++++++++++++++
 2 files changed, 55 insertions(+)
 create mode 100644 tests/shell/testcases/packetpath/dumps/tcp_options.nodump
 create mode 100755 tests/shell/testcases/packetpath/tcp_options

(limited to 'tests/shell/testcases/packetpath')

diff --git a/tests/shell/testcases/packetpath/dumps/tcp_options.nodump b/tests/shell/testcases/packetpath/dumps/tcp_options.nodump
new file mode 100644
index 00000000..e69de29b
diff --git a/tests/shell/testcases/packetpath/tcp_options b/tests/shell/testcases/packetpath/tcp_options
new file mode 100755
index 00000000..1c9ee532
--- /dev/null
+++ b/tests/shell/testcases/packetpath/tcp_options
@@ -0,0 +1,55 @@
+#!/bin/bash
+
+have_socat="no"
+socat -h > /dev/null && have_socat="yes"
+
+ip link set lo up
+
+$NFT -f /dev/stdin <<EOF
+table inet t {
+	counter nomatchc {}
+	counter sackpermc {}
+	counter maxsegc {}
+	counter nopc {}
+
+	chain c {
+		type filter hook output priority 0;
+		tcp dport != 22345 accept
+		tcp flags syn / fin,syn,rst,ack tcp option 254  length ge 4 counter name nomatchc drop
+		tcp flags syn / fin,syn,rst,ack tcp option fastopen length ge 2 reset tcp option fastopen counter name nomatchc
+		tcp flags syn / fin,syn,rst,ack tcp option sack-perm missing counter name nomatchc
+		tcp flags syn / fin,syn,rst,ack tcp option sack-perm exists counter name sackpermc
+		tcp flags syn / fin,syn,rst,ack tcp option maxseg size gt 1400 counter name maxsegc
+		tcp flags syn / fin,syn,rst,ack tcp option nop missing counter name nomatchc
+		tcp flags syn / fin,syn,rst,ack tcp option nop exists counter name nopc
+		tcp flags syn / fin,syn,rst,ack drop
+	}
+}
+EOF
+
+if [ $? -ne 0 ]; then
+	exit 1
+fi
+
+if [ $have_socat != "yes" ]; then
+	echo "Ran partial test, socat not available (skipped)"
+	exit 77
+fi
+
+# This will fail (drop in output -> connect fails with eperm)
+socat -u STDIN TCP:127.0.0.1:22345,connect-timeout=1 < /dev/null > /dev/null
+
+# can't validate via dump file, syn rexmit can cause counters to be > 1 in rare cases.
+
+$NFT list counter inet t nomatchc
+
+# nomatchc must be 0.
+$NFT list counter inet t nomatchc | grep -q "packets 0" || exit 1
+
+# these counters must not be 0.
+for nz in sackpermc maxsegc nopc; do
+	$NFT list counter inet t $nz
+	$NFT list counter inet t $nz | grep -q "packets 0" && exit 1
+done
+
+exit 0
-- 
cgit v1.2.3