XdpWagFirewall error on sudo ./wag start

[nhas]

XdpWagFirewall error on sudo ./wag start

[NHAS]

Hi there, thanks for your bug report.

Could you give me the kernel version you're running wag on? I cant replicate this on my dev machine (kernel 6.1.15-1 lts)

I would also recommend trying to build with the docker image, make docker after following the release build instructions down the end of the readme.

Does the binary release work?
https://github.com/NHAS/wag/releases/download/v5.1.1/wag

If it doesnt, could you tell me what version stops working?

[bluecraank]

Yes binary is working. Have to check other things on monday

[NHAS]

Yep fair enough. I suspect your version of clang or the header files are slightly different to mine.

What version of ubuntu are you using 22.04.2 LTS?

[NHAS]

Sweet, found what the problem is. Apparently in later version of the kernel they made the verifier less strict.

So in the C portions of the code it was accessing packets like this:

struct udphdr *udph = (data + ip->ihl * 4);

However I was never verifying that the ip header length that I was given was still inside the packet. In the older versions of the kernel this is pulled up as an issue (and honestly I should be checking it anyway)

So I've moved it to this:

    __u64 ip_header_length = (ip->ihl * 4);
    if (ip_header_length > MAX_PACKET_OFF)
    {
        return 0;
    }

    if ((void *)(data + ip_header_length) > data_end)
    {
        return 0;
    }

   ...
   
     struct udphdr *udph = (data + ip_header_length);
     
  ...

Which works on the ubuntu 22.04.2 LTS VM I was testing it on. Im going to do a small release for this. Thanks for finding i!