diff --git a/backport-evaluate-compact-STMT_F_STATEFUL-checks.patch b/backport-evaluate-compact-STMT_F_STATEFUL-checks.patch new file mode 100644 index 0000000000000000000000000000000000000000..4431e54deddd5cac2e0d0d9466a959b12274d310 --- /dev/null +++ b/backport-evaluate-compact-STMT_F_STATEFUL-checks.patch @@ -0,0 +1,81 @@ +From 36bd6d0088bca1087aeccfe14aaa786200d755bc Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Mon, 31 Mar 2025 17:23:19 +0200 +Subject: evaluate: compact STMT_F_STATEFUL checks + +We'll gain another F_STATEFUL check in a followup patch, +so lets condense the pattern into a helper to reduce copypaste. + +Signed-off-by: Florian Westphal +Reviewed-by: Pablo Neira Ayuso + +Conflict:context adjust +Reference:https://git.netfilter.org/nftables/commit/?id=36bd6d0088bca1087aeccfe14aaa786200d755bc + +--- + src/evaluate.c | 26 ++++++++++++++------------ + 1 file changed, 14 insertions(+), 12 deletions(-) + +diff --git a/src/evaluate.c b/src/evaluate.c +index 0db3d80f..92bf47a3 100644 +--- a/src/evaluate.c ++++ b/src/evaluate.c +@@ -3453,6 +3453,17 @@ static int stmt_evaluate_payload(struct eval_ctx *ctx, struct stmt *stmt) + return expr_evaluate(ctx, &stmt->payload.val); + } + ++static int stmt_evaluate_stateful(struct eval_ctx *ctx, struct stmt *stmt, const char *name) ++{ ++ if (stmt_evaluate(ctx, stmt) < 0) ++ return -1; ++ ++ if (!(stmt->flags & STMT_F_STATEFUL)) ++ return stmt_error(ctx, stmt, "%s statement must be stateful", name); ++ ++ return 0; ++} ++ + static int stmt_evaluate_meter(struct eval_ctx *ctx, struct stmt *stmt) + { + struct expr *key, *set, *setref; +@@ -3526,11 +3537,8 @@ static int stmt_evaluate_meter(struct eval_ctx *ctx, struct stmt *stmt) + setref->set->desc.size = stmt->meter.size; + stmt->meter.set = setref; + +- if (stmt_evaluate(ctx, stmt->meter.stmt) < 0) ++ if (stmt_evaluate_stateful(ctx, stmt->meter.stmt, "meter") < 0) + return -1; +- if (!(stmt->meter.stmt->flags & STMT_F_STATEFUL)) +- return stmt_binary_error(ctx, stmt->meter.stmt, stmt, +- "meter statement must be stateful"); + + return 0; + } +@@ -4656,11 +4664,8 @@ static int stmt_evaluate_set(struct eval_ctx *ctx, struct stmt *stmt) + return expr_error(ctx->msgs, stmt->set.key, + "Key expression comments are not supported"); + list_for_each_entry(this, &stmt->set.stmt_list, list) { +- if (stmt_evaluate(ctx, this) < 0) ++ if (stmt_evaluate_stateful(ctx, this, "set") < 0) + return -1; +- if (!(this->flags & STMT_F_STATEFUL)) +- return stmt_error(ctx, this, +- "statement must be stateful"); + } + + this_set = stmt->set.set->set; +@@ -4720,11 +4725,8 @@ static int stmt_evaluate_map(struct eval_ctx *ctx, struct stmt *stmt) + "Data expression timeouts are not supported"); + + list_for_each_entry(this, &stmt->map.stmt_list, list) { +- if (stmt_evaluate(ctx, this) < 0) ++ if (stmt_evaluate_stateful(ctx, this, "map") < 0) + return -1; +- if (!(this->flags & STMT_F_STATEFUL)) +- return stmt_error(ctx, this, +- "statement must be stateful"); + } + + return 0; +-- +cgit v1.2.3 diff --git a/backport-evaluate-dont-BUG-on-unexpected-base-datatype.patch b/backport-evaluate-dont-BUG-on-unexpected-base-datatype.patch new file mode 100644 index 0000000000000000000000000000000000000000..aba8e482ea42e8376019bf8846e01b48792f752a --- /dev/null +++ b/backport-evaluate-dont-BUG-on-unexpected-base-datatype.patch @@ -0,0 +1,53 @@ +From 845b8d7208077310e77560a64b698973fb047ef2 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Fri, 13 Jun 2025 16:46:06 +0200 +Subject: evaluate: don't BUG on unexpected base datatype + +Included bogon will cause a crash but this is the evaluation stage where +we can just emit an error instead. + +Signed-off-by: Florian Westphal + +Conflict:NA +Reference:https://git.netfilter.org/nftables/commit/?id=845b8d7208077310e77560a64b698973fb047ef2 + +--- + src/evaluate.c | 3 ++- + .../testcases/bogons/nft-f/invalid_basetype_verdict_assert | 11 +++++++++++ + 2 files changed, 13 insertions(+), 1 deletion(-) + create mode 100644 tests/shell/testcases/bogons/nft-f/invalid_basetype_verdict_assert + +diff --git a/src/evaluate.c b/src/evaluate.c +index 9c7f23cb..872a9e0d 100644 +--- a/src/evaluate.c ++++ b/src/evaluate.c +@@ -482,7 +482,8 @@ static int expr_evaluate_value(struct eval_ctx *ctx, struct expr **expr) + return -1; + break; + default: +- BUG("invalid basetype %s\n", expr_basetype(*expr)->name); ++ return expr_error(ctx->msgs, *expr, "Unexpected datatype %s", ++ (*expr)->dtype->name); + } + return 0; + } +diff --git a/tests/shell/testcases/bogons/nft-f/invalid_basetype_verdict_assert b/tests/shell/testcases/bogons/nft-f/invalid_basetype_verdict_assert +new file mode 100644 +index 00000000..f85ce7fe +--- /dev/null ++++ b/tests/shell/testcases/bogons/nft-f/invalid_basetype_verdict_assert +@@ -0,0 +1,11 @@ ++table ip t { ++ map m { ++ type ipv4_addr . inet_service : ipv4_addr . verdict ++ elements = { 10.0.0.1 . 42 : 10.1.1.1 . 0 } ++ } ++ ++ chain c { ++ type nat hook prerouting priority dstnat; policy accept; ++ dnat ip to ip saddr . tcp dport map @m ++ } ++} +-- +cgit v1.2.3 + diff --git a/backport-evaluate-dont-allow-nat-map-with-specified-protocol.patch b/backport-evaluate-dont-allow-nat-map-with-specified-protocol.patch new file mode 100644 index 0000000000000000000000000000000000000000..ac5c114457dc460c01eceab1dd3121c0e2b69811 --- /dev/null +++ b/backport-evaluate-dont-allow-nat-map-with-specified-protocol.patch @@ -0,0 +1,56 @@ +From 43cf4a2973ee9e3ab20edce47c6a054485707592 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Thu, 20 Mar 2025 09:39:20 +0100 +Subject: evaluate: don't allow nat map with specified protocol + +Included bogon asserts: +src/netlink_linearize.c:1305: netlink_gen_nat_stmt: Assertion `stmt->nat.proto == NULL' failed. + +The comment right above the assertion says: + nat_stmt evaluation step doesn't allow + STMT_NAT_F_CONCAT && stmt->nat.proto. + +... except it does allow it. Disable this. + +Fixes: c68314dd4263 ("src: infer NAT mapping with concatenation from set") +Signed-off-by: Florian Westphal +Reviewed-by: Pablo Neira Ayuso + +Conflict:NA +Reference:https://git.netfilter.org/nftables/commit/?id=43cf4a2973ee9e3ab20edce47c6a054485707592 + +--- + src/evaluate.c | 4 ++++ + tests/shell/testcases/bogons/nat_map_and_protocol_assert | 5 +++++ + 2 files changed, 9 insertions(+) + create mode 100644 tests/shell/testcases/bogons/nat_map_and_protocol_assert + +diff --git a/src/evaluate.c b/src/evaluate.c +index 95b9b3d5..3a453d01 100644 +--- a/src/evaluate.c ++++ b/src/evaluate.c +@@ -4196,6 +4196,10 @@ static int stmt_evaluate_nat_map(struct eval_ctx *ctx, struct stmt *stmt) + int addr_type; + int err; + ++ if (stmt->nat.proto) ++ return stmt_binary_error(ctx, stmt, stmt->nat.proto, ++ "nat map and protocol are mutually exclusive"); ++ + if (stmt->nat.family == NFPROTO_INET) + expr_family_infer(pctx, stmt->nat.addr, &stmt->nat.family); + +diff --git a/tests/shell/testcases/bogons/nat_map_and_protocol_assert b/tests/shell/testcases/bogons/nat_map_and_protocol_assert +new file mode 100644 +index 00000000..67f2ae87 +--- /dev/null ++++ b/tests/shell/testcases/bogons/nat_map_and_protocol_assert +@@ -0,0 +1,5 @@ ++table t { ++ chain y { ++ snat to ip saddr . tcp sport map { 1.1.1.1 . 1 : 1.1.1.2 . 1 } : 6 ++ } ++} +-- +cgit v1.2.3 + diff --git a/backport-evaluate-dont-update-cache-for-anonymous-chains.patch b/backport-evaluate-dont-update-cache-for-anonymous-chains.patch new file mode 100644 index 0000000000000000000000000000000000000000..37c7540b3a6e4e9e78b1a6af935bee25fdfaa974 --- /dev/null +++ b/backport-evaluate-dont-update-cache-for-anonymous-chains.patch @@ -0,0 +1,56 @@ +From bd1fc6c740535d1ad3f38f8ba9c539c14f1732f3 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Wed, 19 Mar 2025 21:05:53 +0100 +Subject: evaluate: don't update cache for anonymous chains + +Chain lookup needs a name, not a numerical id. +After patch, loading bogon gives following errors: + +Error: No symbol type information a b index 1 10.1.26.a + +v2: Don't return an error, just make it a no-op (Pablo Neira Ayuso) + +Fixes: c330152b7f77 ("src: support for implicit chain bindings") +Signed-off-by: Florian Westphal + +Conflict:NA +Reference:https://git.netfilter.org/nftables/commit/?id=bd1fc6c740535d1ad3f38f8ba9c539c14f1732f3 + +--- + src/evaluate.c | 4 ++++ + .../testcases/bogons/nft-f/null_deref_on_anon_chain_update_crash | 8 ++++++++ + 2 files changed, 12 insertions(+) + create mode 100644 tests/shell/testcases/bogons/nft-f/null_deref_on_anon_chain_update_crash + +diff --git a/src/evaluate.c b/src/evaluate.c +index a2796119..785c4fab 100644 +--- a/src/evaluate.c ++++ b/src/evaluate.c +@@ -5371,6 +5371,10 @@ static int rule_cache_update(struct eval_ctx *ctx, enum cmd_ops op) + if (!table) + return table_not_found(ctx); + ++ /* chain is anonymous, adding new rules via index is not supported. */ ++ if (!rule->handle.chain.name) ++ return 0; ++ + chain = chain_cache_find(table, rule->handle.chain.name); + if (!chain) + return chain_not_found(ctx); +diff --git a/tests/shell/testcases/bogons/nft-f/null_deref_on_anon_chain_update_crash b/tests/shell/testcases/bogons/nft-f/null_deref_on_anon_chain_update_crash +new file mode 100644 +index 00000000..310486c5 +--- /dev/null ++++ b/tests/shell/testcases/bogons/nft-f/null_deref_on_anon_chain_update_crash +@@ -0,0 +1,8 @@ ++table ip f { ++ chain c { ++ jump { ++ accept ++ } ++ } ++} ++a b index 1 10.1.26.a +-- +cgit v1.2.3 + diff --git a/backport-evaluate-only-allow-stateful-statements-in-set-and-map-definitions.patch b/backport-evaluate-only-allow-stateful-statements-in-set-and-map-definitions.patch new file mode 100644 index 0000000000000000000000000000000000000000..bd2bba0f6593c9a4ce18bebd03f5fcccce2a968f --- /dev/null +++ b/backport-evaluate-only-allow-stateful-statements-in-set-and-map-definitions.patch @@ -0,0 +1,88 @@ +From 0acd81559ec9efe2cc3d869bfc8e5a0b4d888456 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Mon, 31 Mar 2025 17:23:20 +0200 +Subject: evaluate: only allow stateful statements in set and map definitions + +The bison parser doesn't allow this to happen due to grammar +restrictions, but the json input has no such issues. + +The bogon input assigns 'notrack' which triggers: +BUG: unknown stateful statement type 19 +nft: src/netlink_linearize.c:1061: netlink_gen_stmt_stateful: Assertion `0' failed. + +After patch, we get: +Error: map statement must be stateful + +Fixes: 07958ec53830 ("json: add set statement list support") +Signed-off-by: Florian Westphal +Reviewed-by: Pablo Neira Ayuso + +Conflict:NA +Reference:https://git.netfilter.org/nftables/commit/?id=0acd81559ec9efe2cc3d869bfc8e5a0b4d888456 + +--- + src/evaluate.c | 5 +++- + .../unkown_stateful_statement_type_19_assert | 34 ++++++++++++++++++++++ + 2 files changed, 38 insertions(+), 1 deletion(-) + create mode 100644 tests/shell/testcases/bogons/nft-j-f/unkown_stateful_statement_type_19_assert + +diff --git a/src/evaluate.c b/src/evaluate.c +index 92bf47a3..a3c8f560 100644 +--- a/src/evaluate.c ++++ b/src/evaluate.c +@@ -5151,8 +5151,11 @@ static int set_evaluate(struct eval_ctx *ctx, struct set *set) + if (set->timeout) + set->flags |= NFT_SET_TIMEOUT; + +- list_for_each_entry(stmt, &set->stmt_list, list) ++ list_for_each_entry(stmt, &set->stmt_list, list) { ++ if (stmt_evaluate_stateful(ctx, stmt,type) < 0) ++ return -1; + num_stmts++; ++ } + + if (num_stmts > 1) + set->flags |= NFT_SET_EXPR; +diff --git a/tests/shell/testcases/bogons/nft-j-f/unkown_stateful_statement_type_19_assert b/tests/shell/testcases/bogons/nft-j-f/unkown_stateful_statement_type_19_assert +new file mode 100644 +index 00000000..e8a0f768 +--- /dev/null ++++ b/tests/shell/testcases/bogons/nft-j-f/unkown_stateful_statement_type_19_assert +@@ -0,0 +1,34 @@ ++{ ++ "nftables": [ ++ { ++ "metainfo": { ++ "version": "VERSION", ++ "release_name": "RELEASE_NAME", ++ "json_schema_version": 1 ++ } ++ }, ++ { ++ "table": { ++ "family": "ip", ++ "name": "t", ++ "handle": 0 ++ } ++ }, ++ { ++ "map": { ++ "family": "ip", ++ "name": "m", ++ "table": "t", ++ "type": "ipv4_addr", ++ "handle": 0, ++ "map": "mark", ++ "stmt": [ ++ { ++ "notrack": null ++ } ++ ] ++ } ++ } ++ ] ++} ++ +-- +cgit v1.2.3 + diff --git a/backport-json-dont-BUG-when-asked-to-list-synproxies.patch b/backport-json-dont-BUG-when-asked-to-list-synproxies.patch new file mode 100644 index 0000000000000000000000000000000000000000..3bdd5215880ef623cd5635f9e7be51f8712f4dfe --- /dev/null +++ b/backport-json-dont-BUG-when-asked-to-list-synproxies.patch @@ -0,0 +1,130 @@ +From 40b0708ca6dee4829a9b6e1c2f4677ff2c206b43 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Thu, 27 Mar 2025 17:32:00 +0100 +Subject: json: don't BUG when asked to list synproxies + +"-j list synproxys" triggers a BUG(). + +Rewrite this so that all enum values are handled so the compiler can alert +us to a missing value in case there are more commands in the future. + +While at it, implement a few low-hanging fruites as well. + +Not-yet-supported cases are simply ignored. + +v2: return EOPNOTSUPP for unsupported commands (Pablo Neira Ayuso) + +Signed-off-by: Florian Westphal +Reviewed-by: Pablo Neira Ayuso + +Conflict:NA +Reference:https://git.netfilter.org/nftables/commit/?id=40b0708ca6dee4829a9b6e1c2f4677ff2c206b43 + +--- + src/evaluate.c | 6 ++++-- + src/json.c | 26 ++++++++++++++++++++++++-- + src/rule.c | 12 ++++++++++-- + 3 files changed, 38 insertions(+), 6 deletions(-) + +diff --git a/src/evaluate.c b/src/evaluate.c +index ffb23005..0db3d80f 100644 +--- a/src/evaluate.c ++++ b/src/evaluate.c +@@ -6302,7 +6302,9 @@ int cmd_evaluate(struct eval_ctx *ctx, struct cmd *cmd) + return cmd_evaluate_monitor(ctx, cmd); + case CMD_IMPORT: + return cmd_evaluate_import(ctx, cmd); +- default: +- BUG("invalid command operation %u\n", cmd->op); ++ case CMD_INVALID: ++ break; + }; ++ ++ BUG("invalid command operation %u\n", cmd->op); + } +diff --git a/src/json.c b/src/json.c +index bcdcd56b..41a57201 100644 +--- a/src/json.c ++++ b/src/json.c +@@ -1957,7 +1957,7 @@ static json_t *generate_json_metainfo(void) + int do_command_list_json(struct netlink_ctx *ctx, struct cmd *cmd) + { + struct table *table = NULL; +- json_t *root; ++ json_t *root = NULL; + + if (cmd->handle.table.name) { + table = table_cache_find(&ctx->nft->cache.table_cache, +@@ -2017,6 +2017,13 @@ int do_command_list_json(struct netlink_ctx *ctx, struct cmd *cmd) + case CMD_OBJ_CT_HELPERS: + root = do_list_obj_json(ctx, cmd, NFT_OBJECT_CT_HELPER); + break; ++ case CMD_OBJ_CT_TIMEOUT: ++ case CMD_OBJ_CT_TIMEOUTS: ++ root = do_list_obj_json(ctx, cmd, NFT_OBJECT_CT_TIMEOUT); ++ case CMD_OBJ_CT_EXPECT: ++ case CMD_OBJ_CT_EXPECTATIONS: ++ root = do_list_obj_json(ctx, cmd, NFT_OBJECT_CT_EXPECT); ++ break; + case CMD_OBJ_LIMIT: + case CMD_OBJ_LIMITS: + root = do_list_obj_json(ctx, cmd, NFT_OBJECT_LIMIT); +@@ -2025,14 +2032,29 @@ int do_command_list_json(struct netlink_ctx *ctx, struct cmd *cmd) + case CMD_OBJ_SECMARKS: + root = do_list_obj_json(ctx, cmd, NFT_OBJECT_SECMARK); + break; ++ case CMD_OBJ_SYNPROXY: ++ case CMD_OBJ_SYNPROXYS: ++ root = do_list_obj_json(ctx, cmd, NFT_OBJECT_SYNPROXY); ++ break; + case CMD_OBJ_FLOWTABLE: + root = do_list_flowtable_json(ctx, cmd, table); + break; + case CMD_OBJ_FLOWTABLES: + root = do_list_flowtables_json(ctx, cmd); + break; +- default: ++ case CMD_OBJ_HOOKS: ++ return 0; ++ case CMD_OBJ_MONITOR: ++ case CMD_OBJ_MARKUP: ++ case CMD_OBJ_SETELEMS: ++ case CMD_OBJ_RULE: ++ case CMD_OBJ_EXPR: ++ case CMD_OBJ_ELEMENTS: ++ errno = EOPNOTSUPP; ++ return -1; ++ case CMD_OBJ_INVALID: + BUG("invalid command object type %u\n", cmd->obj); ++ break; + } + + if (!json_is_array(root)) { +diff --git a/src/rule.c b/src/rule.c +index 00fbbc4c..80315837 100644 +--- a/src/rule.c ++++ b/src/rule.c +@@ -2445,10 +2445,18 @@ static int do_command_list(struct netlink_ctx *ctx, struct cmd *cmd) + return do_list_flowtables(ctx, cmd); + case CMD_OBJ_HOOKS: + return do_list_hooks(ctx, cmd); +- default: +- BUG("invalid command object type %u\n", cmd->obj); ++ case CMD_OBJ_MONITOR: ++ case CMD_OBJ_MARKUP: ++ case CMD_OBJ_SETELEMS: ++ case CMD_OBJ_EXPR: ++ case CMD_OBJ_ELEMENTS: ++ errno = EOPNOTSUPP; ++ return -1; ++ case CMD_OBJ_INVALID: ++ break; + } + ++ BUG("invalid command object type %u\n", cmd->obj); + return 0; + } + +-- +cgit v1.2.3 + diff --git a/backport-json-make-sure-timeout-list-is-initialised.patch b/backport-json-make-sure-timeout-list-is-initialised.patch new file mode 100644 index 0000000000000000000000000000000000000000..77572b689fcdef43f2600d0288b45a3e2939a48d --- /dev/null +++ b/backport-json-make-sure-timeout-list-is-initialised.patch @@ -0,0 +1,150 @@ +From 0298bc012e020b2fca8ecc60b0091798d091e1fd Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Fri, 21 Mar 2025 12:53:40 +0100 +Subject: json: make sure timeout list is initialised + +On parser error, obj_free will iterate this list. +Included json bogon crashes due to null deref because +list head initialisation did not yet happen. + +Fixes: c82a26ebf7e9 ("json: Add ct timeout support") +Signed-off-by: Florian Westphal +Reviewed-by: Pablo Neira Ayuso + +Conflict:tests adjust tests context +Reference:https://git.netfilter.org/nftables/commit/?id=0298bc012e020b2fca8ecc60b0091798d091e1fd + +--- + src/parser_json.c | 2 +- + tests/shell/testcases/bogons/assert_failures | 35 +++++++++++--- + .../testcases/bogons/nft-j-f/ct_timeout_null_crash | 54 ++++++++++++++++++++++ + 3 files changed, 84 insertions(+), 7 deletions(-) + create mode 100644 tests/shell/testcases/bogons/nft-j-f/ct_timeout_null_crash + +diff --git a/src/parser_json.c b/src/parser_json.c +index 17bc38b5..dd085d78 100644 +--- a/src/parser_json.c ++++ b/src/parser_json.c +@@ -3722,6 +3722,7 @@ static struct cmd *json_parse_cmd_add_object(struct json_ctx *ctx, + break; + case NFT_OBJECT_CT_TIMEOUT: + cmd_obj = CMD_OBJ_CT_TIMEOUT; ++ init_list_head(&obj->ct_timeout.timeout_list); + obj->type = NFT_OBJECT_CT_TIMEOUT; + if (!json_unpack(root, "{s:s}", "protocol", &tmp)) { + if (!strcmp(tmp, "tcp")) { +@@ -3740,7 +3741,6 @@ static struct cmd *json_parse_cmd_add_object(struct json_ctx *ctx, + } + obj->ct_timeout.l3proto = l3proto; + +- init_list_head(&obj->ct_timeout.timeout_list); + if (json_parse_ct_timeout_policy(ctx, root, obj)) + goto err_free_obj; + break; +diff --git a/tests/shell/testcases/bogons/assert_failures b/tests/shell/testcases/bogons/assert_failures +index 3dee63b3..74e162ad 100755 +--- a/tests/shell/testcases/bogons/assert_failures ++++ b/tests/shell/testcases/bogons/assert_failures +@@ -1,12 +1,36 @@ + #!/bin/bash + + dir=$(dirname $0)/nft-f/ ++jsondir=$(dirname $0)/nft-j-f/ ++ + +-for f in $dir/*; do +- $NFT --check -f "$f" ++die_on_error() ++{ ++ local rv="$1" ++ local fname="$2" + +- if [ $? -ne 1 ]; then +- echo "Bogus input file $f did not cause expected error code" 1>&2 ++ if [ $rv -ne 1 ]; then ++ echo "Bogus input file $fname did not cause expected error code" 1>&2 + exit 111 + fi ++} ++ ++for f in $dir/*; do ++ echo "Check $f" ++ $NFT --check -f "$f" 2> "$tmpfile" ++ ++ die_on_error $? "$f" ++done ++ ++if [ "$NFT_TEST_HAVE_json" = "n" ];then ++ # Intentionally do not skip if we lack json input, ++ # we ran all the tests that we could. ++ exit 0 ++fi ++ ++for f in $jsondir/*; do ++ echo "Check json input $f" ++ $NFT --check -j -f "$f" 2> "$tmpfile" ++ ++ die_on_error $? + done +diff --git a/tests/shell/testcases/bogons/nft-j-f/ct_timeout_null_crash b/tests/shell/testcases/bogons/nft-j-f/ct_timeout_null_crash +new file mode 100644 +index 00000000..c8c662e9 +--- /dev/null ++++ b/tests/shell/testcases/bogons/nft-j-f/ct_timeout_null_crash +@@ -0,0 +1,54 @@ ++{ ++ "nftables": [ ++ { ++ "metainfo": { ++ "version": "VERSION", ++ "release_name": "RELEASE_NAME", ++ "json_schema_version": 1 ++ } ++ }, ++ { ++ "table": { ++ "family": "ip", ++ "name": "filter", ++ "handle": 0 ++ } ++ }, ++ { ++ "chain": { ++ "family": "ip", ++ "table": "filter", ++ "name": "c", ++ "handle": 0 ++ } ++ }, ++ { ++ "ct timeout": { ++ "family": "ip", ++ "name": "cttime", ++ "table": "filter", ++ "handle": 0, ++ "protocol": "Xcp", ++ "l3proto": "ip", ++ "policy": { ++ "established": 123, ++ "close": 12 ++ } ++ } ++ }, ++ { ++ "rule": { ++ "family": "ip", ++ "table": "filter", ++ "chain": "c", ++ "handle": 0, ++ "expr": [ ++ { ++ "ct timeout": "cttime" ++ } ++ ] ++ } ++ } ++ ] ++} ++ +-- +cgit v1.2.3 diff --git a/backport-json-return-error-if-table-does-not-exist.patch b/backport-json-return-error-if-table-does-not-exist.patch new file mode 100644 index 0000000000000000000000000000000000000000..56fda5e28c93f230802574395b7f5532987a7f26 --- /dev/null +++ b/backport-json-return-error-if-table-does-not-exist.patch @@ -0,0 +1,53 @@ +From 2200a105d4befc15b0cfa6cc24282e493888dc82 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Thu, 27 Mar 2025 09:07:52 +0100 +Subject: json: return error if table does not exist + +Identical bug and thus same fix as +853d3a2d3cbd ("rule: return error if table does not exist"), +but this time for json. + +Signed-off-by: Florian Westphal + +Conflict:NA +Reference:https://git.netfilter.org/nftables/commit/?id=2200a105d4befc15b0cfa6cc24282e493888dc82 + +--- + src/json.c | 7 ++++++- + tests/shell/testcases/bogons/nft-j-f/list_a_destroyed_table_crash | 3 +++ + 2 files changed, 9 insertions(+), 1 deletion(-) + create mode 100644 tests/shell/testcases/bogons/nft-j-f/list_a_destroyed_table_crash + +diff --git a/src/json.c b/src/json.c +index 96413d70..831bc90f 100644 +--- a/src/json.c ++++ b/src/json.c +@@ -1973,10 +1973,15 @@ int do_command_list_json(struct netlink_ctx *ctx, struct cmd *cmd) + struct table *table = NULL; + json_t *root; + +- if (cmd->handle.table.name) ++ if (cmd->handle.table.name) { + table = table_cache_find(&ctx->nft->cache.table_cache, + cmd->handle.table.name, + cmd->handle.family); ++ if (!table) { ++ errno = ENOENT; ++ return -1; ++ } ++ } + + switch (cmd->obj) { + case CMD_OBJ_TABLE: +diff --git a/tests/shell/testcases/bogons/nft-j-f/list_a_destroyed_table_crash b/tests/shell/testcases/bogons/nft-j-f/list_a_destroyed_table_crash +new file mode 100644 +index 00000000..f06145c7 +--- /dev/null ++++ b/tests/shell/testcases/bogons/nft-j-f/list_a_destroyed_table_crash +@@ -0,0 +1,3 @@ ++table t ++list table t ++destroy table t +-- +cgit v1.2.3 + diff --git a/backport-netlink-Avoid-crash-upon-missing-NFTNL_OBJ_CT_TIMEOUT_ARRAY.patch b/backport-netlink-Avoid-crash-upon-missing-NFTNL_OBJ_CT_TIMEOUT_ARRAY.patch new file mode 100644 index 0000000000000000000000000000000000000000..e97088b52167ccb4caa7fd55c97cc96bfd573728 --- /dev/null +++ b/backport-netlink-Avoid-crash-upon-missing-NFTNL_OBJ_CT_TIMEOUT_ARRAY.patch @@ -0,0 +1,40 @@ +From 2a38f458f12bc032dac1b3ba63f95ca5a3c03fbd Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 12 Jun 2025 20:17:22 +0200 +Subject: netlink: Avoid crash upon missing NFTNL_OBJ_CT_TIMEOUT_ARRAY + attribute + +If missing, the memcpy call ends up reading from address zero. + +Fixes: c7c94802679cd ("src: add ct timeout support") +Signed-off-by: Phil Sutter +Reviewed-by: Pablo Neira Ayuso + +Conflict:NA +Reference:https://git.netfilter.org/nftables/commit/?id=2a38f458f12bc032dac1b3ba63f95ca5a3c03fbd + +--- + src/netlink.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/src/netlink.c b/src/netlink.c +index be1fefc0..73fe579a 100644 +--- a/src/netlink.c ++++ b/src/netlink.c +@@ -1769,9 +1769,10 @@ struct obj *netlink_delinearize_obj(struct netlink_ctx *ctx, + init_list_head(&obj->ct_timeout.timeout_list); + obj->ct_timeout.l3proto = nftnl_obj_get_u16(nlo, NFTNL_OBJ_CT_TIMEOUT_L3PROTO); + obj->ct_timeout.l4proto = nftnl_obj_get_u8(nlo, NFTNL_OBJ_CT_TIMEOUT_L4PROTO); +- memcpy(obj->ct_timeout.timeout, +- nftnl_obj_get(nlo, NFTNL_OBJ_CT_TIMEOUT_ARRAY), +- NFTNL_CTTIMEOUT_ARRAY_MAX * sizeof(uint32_t)); ++ if (nftnl_obj_is_set(nlo, NFTNL_OBJ_CT_TIMEOUT_ARRAY)) ++ memcpy(obj->ct_timeout.timeout, ++ nftnl_obj_get(nlo, NFTNL_OBJ_CT_TIMEOUT_ARRAY), ++ NFTNL_CTTIMEOUT_ARRAY_MAX * sizeof(uint32_t)); + break; + case NFT_OBJECT_LIMIT: + obj->limit.rate = +-- +cgit v1.2.3 + diff --git a/backport-netlink-Avoid-potential-NULL-ptr-deref-parsing-set-elem-expressions.patch b/backport-netlink-Avoid-potential-NULL-ptr-deref-parsing-set-elem-expressions.patch new file mode 100644 index 0000000000000000000000000000000000000000..398eb5ea9ad1617a3f8f9baeced3feb17e942a55 --- /dev/null +++ b/backport-netlink-Avoid-potential-NULL-ptr-deref-parsing-set-elem-expressions.patch @@ -0,0 +1,35 @@ +From 89645d04106d45d5e23b6d5206777dad1fb3e6bf Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 16 May 2025 20:08:05 +0200 +Subject: netlink: Avoid potential NULL-ptr deref parsing set elem expressions + +Since netlink_parse_set_expr() may return NULL, the following deref must +be guarded. + +Fixes: e6d1d0d611958 ("src: add set element multi-statement support") +Signed-off-by: Phil Sutter + +Conflict:NA +Reference:https://git.netfilter.org/nftables/commit/?id=89645d04106d45d5e23b6d5206777dad1fb3e6bf + +--- + src/netlink.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/netlink.c b/src/netlink.c +index d8891245..0724190a 100644 +--- a/src/netlink.c ++++ b/src/netlink.c +@@ -969,7 +969,8 @@ static int set_elem_parse_expressions(struct nftnl_expr *e, void *data) + struct stmt *stmt; + + stmt = netlink_parse_set_expr(set, cache, e); +- list_add_tail(&stmt->list, &setelem_parse_ctx->stmt_list); ++ if (stmt) ++ list_add_tail(&stmt->list, &setelem_parse_ctx->stmt_list); + + return 0; + } +-- +cgit v1.2.3 + diff --git a/backport-netlink-Catch-unknown-types-when-deserializing-objects.patch b/backport-netlink-Catch-unknown-types-when-deserializing-objects.patch new file mode 100644 index 0000000000000000000000000000000000000000..a8f92ee5d59dd780d9167ed24d4ba84ad669bd82 --- /dev/null +++ b/backport-netlink-Catch-unknown-types-when-deserializing-objects.patch @@ -0,0 +1,37 @@ +From 690f19eadde5cb607ec3d8d471c86d558c7229bd Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 16 May 2025 19:41:19 +0200 +Subject: netlink: Catch unknown types when deserializing objects + +Print an error message and discard the object instead of returning it to +the caller. At least when trying to print it, we would hit an assert() +in obj_type_name() anyway. + +Fixes: 4756d92e517ae ("src: listing of stateful objects") +Signed-off-by: Phil Sutter + +Conflict:NA +Reference:https://git.netfilter.org/nftables/commit/?id=690f19eadde5cb607ec3d8d471c86d558c7229bd + +--- + src/netlink.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/netlink.c b/src/netlink.c +index 0724190a..52010c74 100644 +--- a/src/netlink.c ++++ b/src/netlink.c +@@ -1802,6 +1802,10 @@ struct obj *netlink_delinearize_obj(struct netlink_ctx *ctx, + obj->synproxy.flags = + nftnl_obj_get_u32(nlo, NFTNL_OBJ_SYNPROXY_FLAGS); + break; ++ default: ++ netlink_io_error(ctx, NULL, "Unknown object type %u", type); ++ obj_free(obj); ++ return NULL; + } + obj->type = type; + +-- +cgit v1.2.3 + diff --git a/backport-netlink-bogus-concatenated-set-ranges-with-netlink-message-overrun.patch b/backport-netlink-bogus-concatenated-set-ranges-with-netlink-message-overrun.patch new file mode 100644 index 0000000000000000000000000000000000000000..ac0e7ba9167d5805bb65901178d13817dc575da3 --- /dev/null +++ b/backport-netlink-bogus-concatenated-set-ranges-with-netlink-message-overrun.patch @@ -0,0 +1,858 @@ +From 2fbade3cd9900fe7f87ac660b6ac44544e238206 Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Thu, 17 Apr 2025 21:40:23 +0200 +Subject: netlink: bogus concatenated set ranges with netlink message overrun + +When building each component of the set element key, a late byteorder +switch is performed to ensure that all components in the interval are +represented in big endian, as required by the pipapo backend. + +In case that the set element does not fit into the netlink message, the +byteorder switch happens twice, leading to inserting an element with a +bogus component with large sets, so instead: + + "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890" + +listing reports: + + 16777216 . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890" + +Note that 16777216 is 0x1000000, which should instead be 0x00000001 to +represent "lo" as u32. + +Fix this by switching the value in a temporary variable and use it to +set the set element key attribute in the netlink message. + +Later, revisit this to perform this byteorder switch from evaluation +step. + +Add tests/shell unit to cover for this bug. + +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1792 +Fixes: 8ac2f3b2fca3 ("src: Add support for concatenated set ranges") +Signed-off-by: Pablo Neira Ayuso + +Conflict:modify netlink.c context +Reference:https://git.netfilter.org/nftables/commit/?id=2fbade3cd9900fe7f87ac660b6ac44544e238206 + +--- + src/netlink.c | 19 +- + tests/shell/testcases/sets/concat_nlmsg_overrun | 734 +++++++++++++++++++++ + .../testcases/sets/dumps/concat_nlmsg_overrun.nft | 7 + + 3 files changed, 755 insertions(+), 5 deletions(-) + create mode 100755 tests/shell/testcases/sets/concat_nlmsg_overrun + create mode 100644 tests/shell/testcases/sets/dumps/concat_nlmsg_overrun.nft + +diff --git a/src/netlink.c b/src/netlink.c +index dfb7f4d1..86ca3214 100644 +--- a/src/netlink.c ++++ b/src/netlink.c +@@ -268,6 +268,8 @@ static int __netlink_gen_concat_key(uint32_t flags, const struct expr *i, + unsigned char *data) + { + struct expr *expr; ++ mpz_t value; ++ int ret; + + switch (i->etype) { + case EXPR_RANGE: +@@ -276,9 +278,11 @@ static int __netlink_gen_concat_key(uint32_t flags, const struct expr *i, + else + expr = i->left; + ++ mpz_init_set(value, expr->value); ++ + if (expr_basetype(expr)->type == TYPE_INTEGER && + expr->byteorder == BYTEORDER_HOST_ENDIAN) +- byteorder_switch_expr_value(expr->value, expr); ++ byteorder_switch_expr_value(value, expr); + + i = expr; + break; +@@ -299,22 +303,27 @@ static int __netlink_gen_concat_key(uint32_t flags, const struct expr *i, + } + return netlink_export_pad(data, i->prefix->value, i); + case EXPR_VALUE: +- /* Switch byteorder only once for singleton values when the set ++ mpz_init_set(value, i->value); ++ ++ /* Switch byteorder to big endian representation when the set + * contains concatenation of intervals. + */ +- if (!(flags & EXPR_F_INTERVAL)) ++ if (!(flags & (EXPR_F_INTERVAL| EXPR_F_INTERVAL_END))) + break; + + expr = (struct expr *)i; + if (expr_basetype(expr)->type == TYPE_INTEGER && + expr->byteorder == BYTEORDER_HOST_ENDIAN) +- byteorder_switch_expr_value(expr->value, expr); ++ byteorder_switch_expr_value(value, expr); + break; + default: + BUG("invalid expression type '%s' in set", expr_ops(i)->name); + } + +- return netlink_export_pad(data, i->value, i); ++ ret = netlink_export_pad(data, value, i); ++ mpz_clear(value); ++ ++ return ret; + } + + static void netlink_gen_concat_key(const struct expr *expr, +diff --git a/tests/shell/testcases/sets/concat_nlmsg_overrun b/tests/shell/testcases/sets/concat_nlmsg_overrun +new file mode 100755 +index 00000000..69cefe90 +--- /dev/null ++++ b/tests/shell/testcases/sets/concat_nlmsg_overrun +@@ -0,0 +1,734 @@ ++#!/bin/bash ++ ++# NFT_TEST_REQUIRES(NFT_TEST_HAVE_pipapo) ++ ++set -e ++ ++RULESET='flush ruleset ++ ++table ip filter { ++ set test_set { ++ type iface_index . ether_addr . ipv4_addr ++ flags interval ++ elements = { ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890", ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3, ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3, ++ "lo" . 00:11:22:33:44:55 . 10.1.2.3, ++ } ++ } ++}' ++ ++$NFT -f - <<< $RULESET ++ ++exit 0 +diff --git a/tests/shell/testcases/sets/dumps/concat_nlmsg_overrun.nft b/tests/shell/testcases/sets/dumps/concat_nlmsg_overrun.nft +new file mode 100644 +index 00000000..01d76b90 +--- /dev/null ++++ b/tests/shell/testcases/sets/dumps/concat_nlmsg_overrun.nft +@@ -0,0 +1,7 @@ ++table ip filter { ++ set test_set { ++ type iface_index . ether_addr . ipv4_addr ++ flags interval ++ elements = { "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890" } ++ } ++} +-- +cgit v1.2.3 diff --git a/backport-netlink-fix-stack-overflow-due-to-erroneous-rounding.patch b/backport-netlink-fix-stack-overflow-due-to-erroneous-rounding.patch new file mode 100644 index 0000000000000000000000000000000000000000..f8092d1e20e02e5272eb7dcdc8cbe61809e42684 --- /dev/null +++ b/backport-netlink-fix-stack-overflow-due-to-erroneous-rounding.patch @@ -0,0 +1,77 @@ +From b9e19cc396347df8c7f8cf5d14ba1d6172040f16 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Wed, 20 Dec 2023 15:40:54 +0100 +Subject: netlink: fix stack overflow due to erroneous rounding + +Byteorder switch in this function may undersize the conversion +buffer by one byte, this needs to use div_round_up(). + +Signed-off-by: Florian Westphal + +Conflict:NA +Reference:https://git.netfilter.org/nftables/commit/?id=b9e19cc396347df8c7f8cf5d14ba1d6172040f16 + +--- + src/netlink.c | 11 ++++++++--- + .../testcases/bogons/nft-f/byteorder_switch_stack_overflow | 6 ++++++ + 2 files changed, 14 insertions(+), 3 deletions(-) + create mode 100644 tests/shell/testcases/bogons/nft-f/byteorder_switch_stack_overflow + +diff --git a/src/netlink.c b/src/netlink.c +index 32b18995..3d685b57 100644 +--- a/src/netlink.c ++++ b/src/netlink.c +@@ -254,6 +254,11 @@ static int netlink_export_pad(unsigned char *data, const mpz_t v, + return netlink_padded_len(i->len) / BITS_PER_BYTE; + } + ++static void byteorder_switch_expr_value(mpz_t v, const struct expr *e) ++{ ++ mpz_switch_byteorder(v, div_round_up(e->len, BITS_PER_BYTE)); ++} ++ + static int __netlink_gen_concat_key(uint32_t flags, const struct expr *i, + unsigned char *data) + { +@@ -268,7 +273,7 @@ static int __netlink_gen_concat_key(uint32_t flags, const struct expr *i, + + if (expr_basetype(expr)->type == TYPE_INTEGER && + expr->byteorder == BYTEORDER_HOST_ENDIAN) +- mpz_switch_byteorder(expr->value, expr->len / BITS_PER_BYTE); ++ byteorder_switch_expr_value(expr->value, expr); + + i = expr; + break; +@@ -280,7 +285,7 @@ static int __netlink_gen_concat_key(uint32_t flags, const struct expr *i, + mpz_init_bitmask(v, i->len - i->prefix_len); + + if (i->byteorder == BYTEORDER_HOST_ENDIAN) +- mpz_switch_byteorder(v, i->len / BITS_PER_BYTE); ++ byteorder_switch_expr_value(v, i); + + mpz_add(v, i->prefix->value, v); + count = netlink_export_pad(data, v, i); +@@ -298,7 +303,7 @@ static int __netlink_gen_concat_key(uint32_t flags, const struct expr *i, + expr = (struct expr *)i; + if (expr_basetype(expr)->type == TYPE_INTEGER && + expr->byteorder == BYTEORDER_HOST_ENDIAN) +- mpz_switch_byteorder(expr->value, expr->len / BITS_PER_BYTE); ++ byteorder_switch_expr_value(expr->value, expr); + break; + default: + BUG("invalid expression type '%s' in set", expr_ops(i)->name); +diff --git a/tests/shell/testcases/bogons/nft-f/byteorder_switch_stack_overflow b/tests/shell/testcases/bogons/nft-f/byteorder_switch_stack_overflow +new file mode 100644 +index 00000000..01640528 +--- /dev/null ++++ b/tests/shell/testcases/bogons/nft-f/byteorder_switch_stack_overflow +@@ -0,0 +1,6 @@ ++table inet x { ++ chain nat_dns_acme { ++ udp length . @th,260,118 vmap { 47-63 . 0xe373135363130333131303735353203 : goto nat_dns_dnstc, } ++ drop ++ } ++} +-- +cgit v1.2.3 + diff --git a/backport-optimize-expand-expression-list-when-merging-into-concatenation.patch b/backport-optimize-expand-expression-list-when-merging-into-concatenation.patch new file mode 100644 index 0000000000000000000000000000000000000000..b029e7f0596e078a873e57218f0a5043cd6b780d --- /dev/null +++ b/backport-optimize-expand-expression-list-when-merging-into-concatenation.patch @@ -0,0 +1,53 @@ +From 0d17d28bb06bf2a04862d5cd879a14bcb9a2d2dc Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Tue, 1 Apr 2025 18:11:45 +0200 +Subject: optimize: expand expression list when merging into concatenation + +The following rules: + + udp dport 137 ct state new,untracked accept + udp dport 138 ct state new,untracked accept + +results in: + + nft: src/optimize.c:670: __merge_concat: Assertion `0' failed. + +The logic to expand to the new,untracked list in the concatenation is +missing. + +Fixes: 187c6d01d357 ("optimize: expand implicit set element when merging into concatenation") +Signed-off-by: Pablo Neira Ayuso + +Conflict:delete tests, no such files +Reference:https://git.netfilter.org/nftables/commit/?id=0d17d28bb06bf2a04862d5cd879a14bcb9a2d2dc + +--- + src/optimize.c | 10 ++++ + .../dumps/merge_stmts_concat.json-nft | 61 ++++++++++++++++++++++ + .../optimizations/dumps/merge_stmts_concat.nft | 1 + + .../testcases/optimizations/merge_stmts_concat | 2 + + 4 files changed, 74 insertions(+) + +diff --git a/src/optimize.c b/src/optimize.c +index 44010f2b..139bc2d7 100644 +--- a/src/optimize.c ++++ b/src/optimize.c +@@ -666,6 +666,16 @@ static void __merge_concat(const struct optimize_ctx *ctx, uint32_t i, + clone = expr_clone(stmt_a->expr->right); + compound_expr_add(concat, clone); + break; ++ case EXPR_LIST: ++ list_for_each_entry(expr, &stmt_a->expr->right->expressions, list) { ++ concat_clone = expr_clone(concat); ++ clone = expr_clone(expr); ++ compound_expr_add(concat_clone, clone); ++ list_add_tail(&concat_clone->list, &pending_list); ++ } ++ list_del(&concat->list); ++ expr_free(concat); ++ break; + default: + assert(0); + break; +-- +cgit v1.2.3 diff --git a/backport-parser_bison-only-reset-by-name-is-supported-by-now.patch b/backport-parser_bison-only-reset-by-name-is-supported-by-now.patch new file mode 100644 index 0000000000000000000000000000000000000000..69c3689bfff502cb079678e2337f7f02bae391bd --- /dev/null +++ b/backport-parser_bison-only-reset-by-name-is-supported-by-now.patch @@ -0,0 +1,51 @@ +From e8c7ba0aac7ce321e61008fe9b4b8f11c3ba7e1d Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Sun, 15 Jun 2025 11:34:11 +0200 +Subject: parser_bison: only reset by name is supported by now + +NFT_MSG_GETSET does not support for handle lookup yet, restrict this to +reset by name by now. + +Add a bogon test reported by Florian Westphal. + +Fixes: 83e0f4402fb7 ("Implement 'reset {set,map,element}' commands") +Signed-off-by: Pablo Neira Ayuso + +Conflict:NA +Reference:https://git.netfilter.org/nftables/commit/?id=e8c7ba0aac7ce321e61008fe9b4b8f11c3ba7e1d + +--- + src/parser_bison.y | 4 ++-- + tests/shell/testcases/bogons/nft-f/null_set_name_crash | 2 ++ + 2 files changed, 4 insertions(+), 2 deletions(-) + create mode 100644 tests/shell/testcases/bogons/nft-f/null_set_name_crash + +diff --git a/src/parser_bison.y b/src/parser_bison.y +index ed6a24a1..87b34293 100644 +--- a/src/parser_bison.y ++++ b/src/parser_bison.y +@@ -1757,11 +1757,11 @@ reset_cmd : COUNTERS list_cmd_spec_any + { + $$ = cmd_alloc(CMD_RESET, CMD_OBJ_ELEMENTS, &$2, &@$, $3); + } +- | SET set_or_id_spec ++ | SET set_spec + { + $$ = cmd_alloc(CMD_RESET, CMD_OBJ_SET, &$2, &@$, NULL); + } +- | MAP set_or_id_spec ++ | MAP set_spec + { + $$ = cmd_alloc(CMD_RESET, CMD_OBJ_MAP, &$2, &@$, NULL); + } +diff --git a/tests/shell/testcases/bogons/nft-f/null_set_name_crash b/tests/shell/testcases/bogons/nft-f/null_set_name_crash +new file mode 100644 +index 00000000..e5d85b22 +--- /dev/null ++++ b/tests/shell/testcases/bogons/nft-f/null_set_name_crash +@@ -0,0 +1,2 @@ ++table y { } ++reset set y handle 6 +-- +cgit v1.2.3 + diff --git a/backport-rule-return-error-if-table-does-not-exist.patch b/backport-rule-return-error-if-table-does-not-exist.patch new file mode 100644 index 0000000000000000000000000000000000000000..0750e861753e77e80becf1c78e656e1b425e8672 --- /dev/null +++ b/backport-rule-return-error-if-table-does-not-exist.patch @@ -0,0 +1,59 @@ +From 853d3a2d3cbdc7aab16d3d33999d00b32a6db7ce Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Thu, 20 Mar 2025 14:31:42 +0100 +Subject: rule: return error if table does not exist + +The bogon triggers segfault due to NULL dereference. Error out and set +errno to ENOENT; caller uses strerror() in the errmsg. + +After fix, loading reproducer results in: +/tmp/A:2:1-18: Error: Could not process rule: No such file or directory +list table inet p +^^^^^^^^^^^^^^^^^^ + +Signed-off-by: Florian Westphal +Reviewed-by: Pablo Neira Ayuso + +Conflict:NA +Reference:https://git.netfilter.org/nftables/commit/?id=853d3a2d3cbdc7aab16d3d33999d00b32a6db7ce + +--- + src/rule.c | 8 +++++++- + tests/shell/testcases/bogons/nft-f/list_a_deleted_table_crash | 3 +++ + 2 files changed, 10 insertions(+), 1 deletion(-) + create mode 100644 tests/shell/testcases/bogons/nft-f/list_a_deleted_table_crash + +diff --git a/src/rule.c b/src/rule.c +index 3edfa471..00fbbc4c 100644 +--- a/src/rule.c ++++ b/src/rule.c +@@ -2380,10 +2380,16 @@ static int do_command_list(struct netlink_ctx *ctx, struct cmd *cmd) + if (nft_output_json(&ctx->nft->output)) + return do_command_list_json(ctx, cmd); + +- if (cmd->handle.table.name != NULL) ++ if (cmd->handle.table.name != NULL) { + table = table_cache_find(&ctx->nft->cache.table_cache, + cmd->handle.table.name, + cmd->handle.family); ++ if (!table) { ++ errno = ENOENT; ++ return -1; ++ } ++ } ++ + switch (cmd->obj) { + case CMD_OBJ_TABLE: + if (!cmd->handle.table.name) +diff --git a/tests/shell/testcases/bogons/nft-f/list_a_deleted_table_crash b/tests/shell/testcases/bogons/nft-f/list_a_deleted_table_crash +new file mode 100644 +index 00000000..b802430b +--- /dev/null ++++ b/tests/shell/testcases/bogons/nft-f/list_a_deleted_table_crash +@@ -0,0 +1,3 @@ ++table inet p ++list table inet p ++delete table inet p +-- +cgit v1.2.3 + diff --git a/backport-src-BASECHAIN-flag-no-longer-implies-presence-of-priority-expression.patch b/backport-src-BASECHAIN-flag-no-longer-implies-presence-of-priority-expression.patch new file mode 100644 index 0000000000000000000000000000000000000000..6f6b77cceccb91118f6bd457649f28e8de314990 --- /dev/null +++ b/backport-src-BASECHAIN-flag-no-longer-implies-presence-of-priority-expression.patch @@ -0,0 +1,71 @@ +From 44ea1936463728475768861073ca4ba34a5c2f75 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Thu, 12 Jun 2025 20:17:15 +0200 +Subject: src: BASECHAIN flag no longer implies presence of priority expression + +The included bogon will crash nft because print side assumes that BASECHAIN +flag presence also means that priority expression is available. + +Make the print side conditional. + +Fixes: a66b5ad9540d ("src: allow for updating devices on existing netdev chain") +Suggested-by: Pablo Neira Ayuso +Signed-off-by: Florian Westphal + +Conflict:NA +Reference:https://git.netfilter.org/nftables/commit/?id=44ea1936463728475768861073ca4ba34a5c2f75 + +--- + src/rule.c | 16 ++++++++++------ + .../shell/testcases/bogons/nft-f/null_ingress_type_crash | 6 ++++++ + 2 files changed, 16 insertions(+), 6 deletions(-) + create mode 100644 tests/shell/testcases/bogons/nft-f/null_ingress_type_crash + +diff --git a/src/rule.c b/src/rule.c +index 80315837..e2fe0979 100644 +--- a/src/rule.c ++++ b/src/rule.c +@@ -1047,8 +1047,10 @@ static void chain_print_declaration(const struct chain *chain, + nft_print(octx, "\n\t\tcomment \"%s\"", chain->comment); + nft_print(octx, "\n"); + if (chain->flags & CHAIN_F_BASECHAIN) { +- nft_print(octx, "\t\ttype %s hook %s", chain->type.str, +- hooknum2str(chain->handle.family, chain->hook.num)); ++ if (chain->type.str) ++ nft_print(octx, "\t\ttype %s hook %s", chain->type.str, ++ hooknum2str(chain->handle.family, chain->hook.num)); ++ + if (chain->dev_array_len == 1) { + nft_print(octx, " device \"%s\"", chain->dev_array[0]); + } else if (chain->dev_array_len > 1) { +@@ -1060,10 +1062,12 @@ static void chain_print_declaration(const struct chain *chain, + } + nft_print(octx, " }"); + } +- nft_print(octx, " priority %s;", +- prio2str(octx, priobuf, sizeof(priobuf), +- chain->handle.family, chain->hook.num, +- chain->priority.expr)); ++ ++ if (chain->priority.expr) ++ nft_print(octx, " priority %s;", ++ prio2str(octx, priobuf, sizeof(priobuf), ++ chain->handle.family, chain->hook.num, ++ chain->priority.expr)); + if (chain->policy) { + mpz_export_data(&policy, chain->policy->value, + BYTEORDER_HOST_ENDIAN, sizeof(int)); +diff --git a/tests/shell/testcases/bogons/nft-f/null_ingress_type_crash b/tests/shell/testcases/bogons/nft-f/null_ingress_type_crash +new file mode 100644 +index 00000000..2ed88af2 +--- /dev/null ++++ b/tests/shell/testcases/bogons/nft-f/null_ingress_type_crash +@@ -0,0 +1,6 @@ ++table netdev filter1 { ++ chain c { ++ devices = { lo } ++ } ++} ++list ruleset +-- +cgit v1.2.3 diff --git a/backport-src-netlink-fix-crash-when-ops-doesnt-support-udata.patch b/backport-src-netlink-fix-crash-when-ops-doesnt-support-udata.patch new file mode 100644 index 0000000000000000000000000000000000000000..b096f7c0e36718029f59904020e451d02c7fd992 --- /dev/null +++ b/backport-src-netlink-fix-crash-when-ops-doesnt-support-udata.patch @@ -0,0 +1,37 @@ +From be737a1986bfee0ddea4bee7863dca0123a2bcbc Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Thu, 8 May 2025 16:29:04 +0200 +Subject: src: netlink: fix crash when ops doesn't support udata + +Whenever a new version adds udata support to an expression, then old +versions of nft will crash when trying to list such a ruleset generated +by a more recent version of nftables. + +Fix this by falling back to 'type' format. + +Fixes: 6e48df5329ea ('src: add "typeof" build/parse/print support') +Signed-off-by: Florian Westphal +Reviewed-by: Pablo Neira Ayuso + +Conflict:modify expr_ops_by_type_u32 to expr_ops_by_type +Reference:https://git.netfilter.org/nftables/commit/?id=be737a1986bfee0ddea4bee7863dca0123a2bcbc + +--- + src/netlink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/netlink.c b/src/netlink.c +index 86ca3214..d8891245 100644 +--- a/src/netlink.c ++++ b/src/netlink.c +@@ -937,7 +937,7 @@ static struct expr *set_make_key(const struct nftnl_udata *attr) + + etype = nftnl_udata_get_u32(ud[NFTNL_UDATA_SET_TYPEOF_EXPR]); + ops = expr_ops_by_type(etype); +- if (!ops) ++ if (!ops || !ops->parse_udata) + return NULL; + + expr = ops->parse_udata(ud[NFTNL_UDATA_SET_TYPEOF_DATA]); +-- +cgit v1.2.3 diff --git a/nftables.spec b/nftables.spec index 9a037962e8c0716e652d7016b0ebd0def171fed2..936e3a00deeaad1db118db4f6bcdd47d600a2f68 100644 --- a/nftables.spec +++ b/nftables.spec @@ -1,6 +1,6 @@ Name: nftables Version: 1.0.8 -Release: 8 +Release: 9 Epoch: 1 Summary: A subsystem of the Linux kernel processing network data License: GPLv2 @@ -75,6 +75,25 @@ Patch0060: backport-parser_json-fix-several-expression-memleaks-from-error- Patch0061: backport-libnftables-Zero-ctx-vars-after-freeing-it.patch Patch0062: backport-nftables-iproute2-config-path-adapt.patch +Patch0063: backport-evaluate-dont-allow-nat-map-with-specified-protocol.patch +Patch0064: backport-rule-return-error-if-table-does-not-exist.patch +Patch0065: backport-json-make-sure-timeout-list-is-initialised.patch +Patch0066: backport-evaluate-dont-update-cache-for-anonymous-chains.patch +Patch0067: backport-json-return-error-if-table-does-not-exist.patch +Patch0068: backport-json-dont-BUG-when-asked-to-list-synproxies.patch +Patch0069: backport-evaluate-compact-STMT_F_STATEFUL-checks.patch +Patch0070: backport-evaluate-only-allow-stateful-statements-in-set-and-map-definitions.patch +Patch0071: backport-optimize-expand-expression-list-when-merging-into-concatenation.patch +Patch0072: backport-netlink-fix-stack-overflow-due-to-erroneous-rounding.patch +Patch0073: backport-netlink-bogus-concatenated-set-ranges-with-netlink-message-overrun.patch +Patch0074: backport-src-netlink-fix-crash-when-ops-doesnt-support-udata.patch +Patch0075: backport-netlink-Catch-unknown-types-when-deserializing-objects.patch +Patch0076: backport-netlink-Avoid-potential-NULL-ptr-deref-parsing-set-elem-expressions.patch +Patch0077: backport-netlink-Avoid-crash-upon-missing-NFTNL_OBJ_CT_TIMEOUT_ARRAY.patch +Patch0078: backport-evaluate-dont-BUG-on-unexpected-base-datatype.patch +Patch0079: backport-src-BASECHAIN-flag-no-longer-implies-presence-of-priority-expression.patch +Patch0080: backport-parser_bison-only-reset-by-name-is-supported-by-now.patch + BuildRequires: gcc flex bison libmnl-devel gmp-devel readline-devel libnftnl-devel docbook2X systemd BuildRequires: iptables-devel jansson-devel python3-devel BuildRequires: chrpath libedit-devel @@ -173,6 +192,30 @@ echo "%{_libdir}" > %{buildroot}/etc/ld.so.conf.d/%{name}-%{_arch}.conf %{python3_sitelib}/nftables/ %changelog +* Fri Oct 10 2025 eaglegai - 1:1.0.8-9 +- Type:bugfix +- CVE:NA +- SUG:NA +- DESC:backport upstream patches + evaluate: don't allow nat map with specified protocol + rule: return error if table does not exist + json: make sure timeout list is initialised + evaluate: don't update cache for anonymous chains + json: return error if table does not exist + json: don't BUG when asked to list synproxies + evaluate: compact STMT_F_STATEFUL checks + evaluate: only allow stateful statements in set and map definitions + optimize: expand expression list when merging into concatenation + netlink: fix stack overflow due to erroneous rounding + netlink: bogus concatenated set ranges with netlink message overrun + netlink: fix crash when ops doesn't support udata + netlink: Catch unknown types when deserializing objects + netlink: Avoid potential NULL-ptr deref parsing set elem expressions + netlink: Avoid crash upon missing NFTNL_OBJ_CT_TIMEOUT_ARRAY + evaluate: don't BUG on unexpected base datatype + src: BASECHAIN flag no longer implies presence of priority expression + parser_bison: only reset by name is supported by now + * Fri Aug 22 2025 hdliu - 1:1.0.8-8 - Type:bugfix - CVE:NA