[Bug 1500] New: including list ruleset in a transaction leads to coredump

bugzilla-daemon at netfilter.org bugzilla-daemon at netfilter.org
Fri Feb 12 11:00:34 CET 2021


            Bug ID: 1500
           Summary: including list ruleset in a transaction leads to
           Product: nftables
           Version: unspecified
          Hardware: x86_64
                OS: Debian GNU/Linux
            Status: NEW
          Severity: normal
          Priority: P5
         Component: nft
          Assignee: pablo at netfilter.org
          Reporter: arturo at netfilter.org

Original bug report in the Debian bug tracker:

NOTE: to easily test a nft firewall in isolation, create a dummy netns:

    sudo ip netns add test
    sudo ip netns exec test  nft --file test.nft

This minimal ruleset causes a core dump:

    #!/usr/sbin/nft --file
    # This is like "flush ruleset" except only flushes THIS ruleset, not ALL
    # In particular, it leaves the dynamic sshguard/fail2ban deny lists
    add table A        # idempotent
    delete table A     # not idempotent
    table A {
        chain B {
            tcp dport {1,2}  accept
    list ruleset

Commenting out "list ruleset" prevents the core dump.
Having done so, a subsequent "nft list ruleset" works fine.

Putting "list ruleset" at the bottom of the ruleset routinely prints
wrong output (see below), but this is the first time I've seen it
disable the entire firewall!

On buster-backports (nftables 0.9.6-1~bpo10+1),
the same ruleset does NOT trigger a segfault.
Instead it prints this output:

    table ip A {

And a subsequent call to "nft list ruleset" prints this output:

    table ip A {
            chain B {
                    tcp dport { 1, 2 } accept

The core dump looks like this (sorry, I don't have -dbg set up):

    cyber at light:~$ sudo coredumpctl  info 9427
               PID: 9427 (nft)
               UID: 0 (root)
               GID: 0 (root)
            Signal: 11 (SEGV)
         Timestamp: Fri 2021-02-12 14:00:58 AEDT (4min 4s ago)
      Command Line: nft -f -
        Executable: /usr/sbin/nft
     Control Group: /user.slice/user-0.slice/session-15.scope
              Unit: session-15.scope
             Slice: user-0.slice
           Session: 15
         Owner UID: 0 (root)
           Boot ID: 9307dbd17f1e4dd99fda1b1eda36576e
        Machine ID: d18f6dfeb20d4f4ca40a61f4553e9c27
          Hostname: light
           Message: Process 9427 (nft) of user 0 dumped core.

                    Stack trace of thread 9427:
                    #0  0x00007fc038d1b85c n/a (libnftables.so.1 + 0x2485c)
                    #1  0x00007fc038d116d2 n/a (libnftables.so.1 + 0x1a6d2)
                    #2  0x00007fc038d13097 n/a (libnftables.so.1 + 0x1c097)
                    #3  0x00007fc038d13bf7 n/a (libnftables.so.1 + 0x1cbf7)
                    #4  0x00007fc038d451ef n/a (libnftables.so.1 + 0x4e1ef)
                    #5  0x00007fc038d45e18 nft_run_cmd_from_filename
(libnftables.so.1 + 0x4ee18)
                    #6  0x000055a94b6859f6 n/a (nft + 0x29f6)
                    #7  0x00007fc038b1fd0a __libc_start_main (libc.so.6 +
                    #8  0x000055a94b685a8a n/a (nft + 0x2a8a)

You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20210212/29e441bd/attachment.html>

More information about the netfilter-buglog mailing list