[Bug 1676] New: nft check config causes segmentation fault when using variables for devices in the chain

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1676

            Bug ID: 1676
           Summary: nft check config causes segmentation fault when using
                    variables for devices in the chain
           Product: nftables
           Version: 1.0.x
          Hardware: x86_64
                OS: Debian GNU/Linux
            Status: NEW
          Severity: normal
          Priority: P5
         Component: nft
          Assignee: pablo at netfilter.org
          Reporter: jinesh at onelittlehope.com

Setup details:

  libnftables1:amd64           1.0.6-2
  libnftnl11:amd64             1.2.4-2
  nftables                     1.0.6-2

  Linux debianvm 6.1.0-7-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.20-2
(2023-04-08) x86_64 GNU/Linux

Reproduction steps:

1. Create a test.conf file containing:

---snip---
#!/usr/sbin/nft -f

define lan_interfaces = {eth0}
flush ruleset
table netdev filter {
  chain ingress {
    type filter hook ingress devices = $lan_interfaces priority -500; policy
accept;
  }
}
---snip---

2. Run nft -c -f test.conf

Expect no output as syntax is valid. Instead get a Segmentation fault.

Notes:

- I think the issue is that the lan_interfaces variable cannot have a single
element. It needs to have more than one element. e.g. define lan_interfaces =
{eth0,lo} works fine and no seg fault.

- I also found that define lan_interfaces = {{eth0}} doesn't generate a seg
fault.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20230425/f1f8af4d/attachment.html>