NetBSD Problem Report #58371

From www@netbsd.org  Wed Jun 26 09:06:26 2024
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 479F11A923A
	for <gnats-bugs@gnats.NetBSD.org>; Wed, 26 Jun 2024 09:06:26 +0000 (UTC)
Message-Id: <20240626090625.11F601A923C@mollari.NetBSD.org>
Date: Wed, 26 Jun 2024 09:06:25 +0000 (UTC)
From: NetBSD-gnats-web@bow.st
Reply-To: NetBSD-gnats-web@bow.st
To: gnats-bugs@NetBSD.org
Subject: npfctl 'validate' or 'reload' can crash with crafted npf.conf
X-Send-Pr-Version: www-1.0

>Number:         58371
>Category:       bin
>Synopsis:       npfctl 'validate' or 'reload' can crash with crafted npf.conf
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jun 26 09:10:01 +0000 2024
>Last-Modified:  Wed Jun 26 16:10:01 +0000 2024
>Originator:     Math
>Release:        10.0_BETA
>Organization:
>Environment:
NetBSD m900 10.0_BETA NetBSD 10.0_BETA (XEN3_DOM0) #0: Tue Apr 25 16:17:59 UTC 2023  mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/xen/compile/XEN3_DOM0 amd64
>Description:
Given a npf.conf file as follows:

#----------------------->snip
# cat /tmp/npf.trip.conf
$ext_if = "lo0"

$lan_addrs= ifaddrs($ext_if)

group default {
    pass stateful in proto tcp to { $lan_addrs, 192.168.1.10 } port ssh 
#    pass stateful in proto tcp to { $lan_addrs } port ssh 
    pass stateful in on $ext_if from any to any port 655
}
#----------------------<snip


And running:
#----------------------->snip
# npfctl validate /tmp/npf.trip.conf
assertion "ctx->nblocks == ctx->gblock" failed: file "/usr/src/usr.sbin/npf/npfctl/npf_bpf_comp.c", line 408, function "fetch_l3"
[2]   Abort trap (core dumped) npfctl validate /tmp/npf.trip.conf
#
#----------------------<snip

The culprit seems to be variable referencing within a parenthesised list of addresses  - so for eg: the commented line doesn't seem to cause the problem.
>How-To-Repeat:
See above:
>Fix:
The npf config parser may need adjusting.

>Audit-Trail:
From: mlelstv@serpens.de (Michael van Elst)
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: bin/58371: npfctl 'validate' or 'reload' can crash with crafted npf.conf
Date: Wed, 26 Jun 2024 16:04:54 -0000 (UTC)

 NetBSD-gnats-web@bow.st writes:

 >$lan_addrs= ifaddrs($ext_if)

 >    pass stateful in proto tcp to { $lan_addrs, 192.168.1.10 } port ssh 

 $lan_addrs is assigned a value that represents a dynamic table lookup.

 The npf compiler converts the later reference into a lookup instruction
 that finishes any expression, but the match list that started with '{'
 is still open. That triggers the assertion when the parser continues
 to fetch the literal ip address.

 Reversing the order like:

     pass stateful in proto tcp to { 192.168.1.0, $lan_addrs } port ssh

 seems to succeed, but if you continue with the next line:

 >    pass stateful in on $ext_if from any to any port 655

 then npfctl segfaults.

Home	PR Database Search