Messages in this thread | | | From | Matthias Maier <> | Subject | Re: Kernel oops with netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE | Date | Mon, 26 Jun 2023 00:22:51 -0500 |
| |
Hi Pablo,
Thanks a lot for the quick reponse!
On Sun, Jun 25, 2023, at 18:05 CDT, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> [...] > > Could you give a try to these two fixes on top? > > 26b5a5712eb8 netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain > 4bedf9eee016 netfilter: nf_tables: fix chain binding transaction logic
These two patches alone were not enough, I had to apply the third patch you mentioned:
> https://patchwork.ozlabs.org/project/netfilter-devel/patch/20230625224219.64876-1-pablo@netfilter.org/
With all three patches I do not run into the oops any more.
Nevertheless, please find below a (somehwat minimal) reproducer. Loading this ruleset into nft_tables via $ nft -f reproducer.ruleset previously oopsed the kernel.
Best, Matthias
define guarded_ports = {ssh}
table inet portknock { set clients_ipv4 { type ipv4_addr flags timeout }
set candidates_ipv4 { type ipv4_addr . inet_service flags timeout }
chain input { type filter hook input priority -10; policy accept;
tcp dport 10001 add @candidates_ipv4 {ip saddr . 10002 timeout 1s} tcp dport 10002 ip saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 {ip saddr . 10003 timeout 1s} tcp dport 10003 ip saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 {ip saddr . 10004 timeout 1s} tcp dport 10004 ip saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 {ip saddr . 10005 timeout 1s} tcp dport 10005 ip saddr . tcp dport @candidates_ipv4 add @clients_ipv4 {ip saddr timeout 600s} log prefix "Successful portknock: "
tcp dport $guarded_ports ip saddr @clients_ipv4 counter accept tcp dport $guarded_ports ct state established,related counter accept
tcp dport $guarded_ports reject with tcp reset } }
| |