[Bug 1763] New: Segfault when resetting rules with meta l4proto { tcp, udp }

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1763

            Bug ID: 1763
           Summary: Segfault when resetting rules with meta l4proto { tcp,
                    udp }
           Product: nftables
           Version: 1.0.x
          Hardware: x86_64
                OS: Ubuntu
            Status: NEW
          Severity: minor
          Priority: P5
         Component: nft
          Assignee: pablo at netfilter.org
          Reporter: sly at covertlabs.org

Running into a segfault on version 1.0.9 when rules are listed after `nft reset
rules` with a `meta l4proto { tcp, udp } ...` rule added but listing the same
rule works fine. It seems to have problems with the `{ tcp, udp }` set.

# nft create table testsegfault
# nft add chain testsegfault dns-nat-pre "{ type nat hook prerouting priority
0; }"
# nft add rule testsegfault dns-nat-pre meta l4proto { tcp, udp } th dport 53
ip saddr 10.24.0.0/24 ip daddr != 10.25.0.1 counter dnat to 10.25.0.1
# nft list ruleset
table ip testsegfault {
        chain dns-nat-pre {
                type nat hook prerouting priority filter; policy accept;
                meta l4proto { tcp, udp } th dport 53 ip saddr 10.24.0.0/24 ip
daddr != 10.25.0.1 counter packets 0 bytes 0 dnat to 10.25.0.1
        }
}
# nft reset rules
table ip testsegfault {
        chain dns-nat-pre {
                type nat hook prerouting priority filter; policy accept;
                meta l4proto Segmentation fault (core dumped)



I also tried a simplified version of the above rule to ensure it wasn't
something further in the rule causing issues and ran into the same segfault.

# nft create table testsegfault
# nft add chain testsegfault dns-nat-pre "{ type nat hook prerouting priority
0; }"
# nft add rule testsegfault dns-nat-pre meta l4proto { tcp, udp } th dport 53
counter dnat to 10.25.0.1
# nft list ruleset
table ip testsegfault {
        chain dns-nat-pre {
                type nat hook prerouting priority filter; policy accept;
                meta l4proto { tcp, udp } th dport 53 counter packets 0 bytes 0
dnat to 10.25.0.1
        }
}
# nft reset rules
table ip testsegfault {
        chain dns-nat-pre {
                type nat hook prerouting priority filter; policy accept;
                meta l4proto Segmentation fault (core dumped)



This is on an AWS Ubuntu 24.04 EC2 instance.

# uname -rvp
6.8.0-1012-aws #13-Ubuntu SMP Mon Jul 15 13:40:27 UTC 2024 x86_64

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20240802/a08c44e3/attachment.html>