From 0459d27570aa074910308e3bb367fee6a687f594 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Fri, 9 Aug 2019 14:49:14 +0200 Subject: tests: shell: use-after-free from abort path Rule that fails to be added while holding a bound set triggers user-after-free from the abort path. Signed-off-by: Pablo Neira Ayuso --- tests/shell/testcases/transactions/0050rule_1 | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100755 tests/shell/testcases/transactions/0050rule_1 (limited to 'tests/shell/testcases/transactions') diff --git a/tests/shell/testcases/transactions/0050rule_1 b/tests/shell/testcases/transactions/0050rule_1 new file mode 100755 index 00000000..89e5f42f --- /dev/null +++ b/tests/shell/testcases/transactions/0050rule_1 @@ -0,0 +1,19 @@ +#!/bin/bash + +set -e + +RULESET="table inet filter { + flowtable ftable { + hook ingress priority 0; devices = { eno1, eno0, x }; + } + +chain forward { + type filter hook forward priority 0; policy drop; + + ip protocol { tcp, udp } ct mark and 1 == 1 counter flow add @ftable + ip6 nexthdr { tcp, udp } ct mark and 2 == 2 counter flow add @ftable + ct mark and 30 == 30 ct state established,related log prefix \"nftables accept: \" level info accept + } +}" + +$NFT -f - <<< "$RULESET" >/dev/null || exit 0 -- cgit v1.2.3