Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Matthias Maier <tamiko@43-1.org>
To:     Pablo Neira Ayuso <pablo@netfilter.org>
Cc:     linux-kernel@vger.kernel.org, stable@vger.kernel.org,
        netfilter-devel@vger.kernel.org
Subject: Re: Kernel oops with netfilter: nf_tables: incorrect error path
 handling with NFT_MSG_NEWRULE
In-Reply-To: <ZJjIRQevLKW+YJP6@calendula> (Pablo Neira Ayuso's message of
        "Mon, 26 Jun 2023 01:05:41 +0200")
References: <87cz1j5tof.fsf@43-1.org> <ZJjIRQevLKW+YJP6@calendula>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/28.2 (gnu/linux)
Date:   Mon, 26 Jun 2023 00:22:51 -0500
Message-ID: <87ttuuajbo.fsf@43-1.org>
MIME-Version: 1.0
Content-Type: text/plain
Precedence: bulk

Hi Pablo,

Thanks a lot for the quick reponse!


On Sun, Jun 25, 2023, at 18:05 CDT, Pablo Neira Ayuso <pablo@netfilter.org> wrote:

> [...]
>
> Could you give a try to these two fixes on top?
>
> 26b5a5712eb8 netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain
> 4bedf9eee016 netfilter: nf_tables: fix chain binding transaction logic

These two patches alone were not enough, I had to apply the third patch
you mentioned:

> https://patchwork.ozlabs.org/project/netfilter-devel/patch/20230625224219.64876-1-pablo@netfilter.org/

With all three patches I do not run into the oops any more.


Nevertheless, please find below a (somehwat minimal) reproducer. Loading
this ruleset into nft_tables via  $ nft -f reproducer.ruleset  previously
oopsed the kernel.

Best,
Matthias


define guarded_ports = {ssh}

table inet portknock {
        set clients_ipv4 {
                type ipv4_addr
                flags timeout
        }

        set candidates_ipv4 {
                type ipv4_addr . inet_service
                flags timeout
        }

        chain input {
                type filter hook input priority -10; policy accept;

                tcp dport 10001 add @candidates_ipv4 {ip  saddr . 10002 timeout 1s}
                tcp dport 10002 ip  saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 {ip  saddr . 10003 timeout 1s}
                tcp dport 10003 ip  saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 {ip  saddr . 10004 timeout 1s}
                tcp dport 10004 ip  saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 {ip  saddr . 10005 timeout 1s}
                tcp dport 10005 ip  saddr . tcp dport @candidates_ipv4 add @clients_ipv4 {ip  saddr timeout 600s} log prefix "Successful portknock: "

                tcp dport $guarded_ports ip  saddr @clients_ipv4 counter accept
                tcp dport $guarded_ports ct state established,related counter accept

                tcp dport $guarded_ports reject with tcp reset
        }
}