Re: Kernel oops with netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE

[Matthias Maier]

Hi Pablo,

Thanks a lot for the quick reponse!


On Sun, Jun 25, 2023, at 18:05 CDT, Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote:

> [...]
>
> Could you give a try to these two fixes on top?
>
> 26b5a5712eb8 netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain
> 4bedf9eee016 netfilter: nf_tables: fix chain binding transaction logic

These two patches alone were not enough, I had to apply the third patch
you mentioned:

> https://patchwork.ozlabs.org/project/netfilter-devel/patch/20230625224219.64876-1-pablo@xxxxxxxxxxxxx/

With all three patches I do not run into the oops any more.


Nevertheless, please find below a (somehwat minimal) reproducer. Loading
this ruleset into nft_tables via  $ nft -f reproducer.ruleset  previously
oopsed the kernel.

Best,
Matthias



define guarded_ports = {ssh}

table inet portknock {
        set clients_ipv4 {
                type ipv4_addr
                flags timeout
        }

        set candidates_ipv4 {
                type ipv4_addr . inet_service
                flags timeout
        }

        chain input {
                type filter hook input priority -10; policy accept;

                tcp dport 10001 add @candidates_ipv4 {ip  saddr . 10002 timeout 1s}
                tcp dport 10002 ip  saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 {ip  saddr . 10003 timeout 1s}
                tcp dport 10003 ip  saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 {ip  saddr . 10004 timeout 1s}
                tcp dport 10004 ip  saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 {ip  saddr . 10005 timeout 1s}
                tcp dport 10005 ip  saddr . tcp dport @candidates_ipv4 add @clients_ipv4 {ip  saddr timeout 600s} log prefix "Successful portknock: "

                tcp dport $guarded_ports ip  saddr @clients_ipv4 counter accept
                tcp dport $guarded_ports ct state established,related counter accept

                tcp dport $guarded_ports reject with tcp reset
        }
}