summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2023-10-25 16:00:50 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2023-10-26 10:59:54 +0200
commit4b6a4ad9134fa71277c2ff7f92776e1faeb83000 (patch)
tree5306431ce88fc574ff7117c2ea9bcf8321fbbce2
parentbe2856fc2280014d331d33a520cb5f3f3d909611 (diff)
evaluate: reject set in concatenation
Consider the following ruleset. define ext_if = { "eth0", "eth1" } table ip filter { chain c { iifname . tcp dport { $ext_if . 22 } accept } } Attempting to load this ruleset results in: BUG: invalid expression type 'set' in setnft: netlink.c:304: __netlink_gen_concat_key: Assertion `0' failed. Aborted (core dumped) After this patch: # nft -f ruleset.nft ruleset.nft:1:17-40: Error: cannot use set in concatenation define ext_if = { "eth0", "eth1" } ^^^^^^^^^^^^^^^^^^ Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1715 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-rw-r--r--src/evaluate.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/src/evaluate.c b/src/evaluate.c
index 2196e928..894987df 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -1511,6 +1511,12 @@ static int expr_evaluate_concat(struct eval_ctx *ctx, struct expr **expr)
if (list_member_evaluate(ctx, &i) < 0)
return -1;
+
+ if (i->etype == EXPR_SET)
+ return expr_error(ctx->msgs, i,
+ "cannot use %s in concatenation",
+ expr_name(i));
+
flags &= i->flags;
if (!key && i->dtype->type == TYPE_INTEGER) {