interesting
/
nftables
mirror of https://github.com/google/nftables.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Fix overflow in Flush by using receiveAckAware and handling the overrun flag (#237) 

Fixes https://github.com/google/nftables/issues/235
Added support for messages having overrun flag
Changed `conn.Receive` call to `receiveAckAware` in `Flush`
This commit is contained in:
turekt 2023-09-23 17:08:35 +02:00 committed by GitHub
parent 6a61933ab7
commit 0d9bfa4d18
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 22 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
conn.go
View File

@ -154,14 +154,33 @@ func receiveAckAware(nlconn *netlink.Conn, sentMsgFlags netlink.HeaderFlags) ([]
return reply, nil
}
// Dump flag is not set, we expect an ack
if len(reply) != 0 {
last := reply[len(reply)-1]
for re := last.Header.Type; (re&netlink.Overrun) == netlink.Overrun && (re&netlink.Done) != netlink.Done; re = last.Header.Type {
// we are not finished, the message is overrun
r, err := nlconn.Receive()
if err != nil {
return nil, err
}
reply = append(reply, r...)
last = reply[len(reply)-1]
}
if last.Header.Type == netlink.Error && binaryutil.BigEndian.Uint32(last.Data[:4]) == 0 {
// we have already collected an ack
return reply, nil
}
}
// Now we expect an ack
ack, err := nlconn.Receive()
if err != nil {
return nil, err
}
if len(ack) == 0 {
return nil, errors.New("received an empty ack")
// received an empty ack?
return reply, nil
}
msg := ack[0]
@ -232,10 +251,7 @@ func (cc *Conn) Flush() error {
// Fetch the requested acknowledgement for each message we sent.
for _, msg := range cc.messages {
if msg.Header.Flags&netlink.Acknowledge == 0 {
continue // message did not request an acknowledgement
}
if _, err := conn.Receive(); err != nil {
if _, err := receiveAckAware(conn, msg.Header.Flags); err != nil {
return fmt.Errorf("conn.Receive: %w", err)
}
}