diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2023-10-25 16:00:50 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2023-10-26 10:59:54 +0200 |
| commit | 4b6a4ad9134fa71277c2ff7f92776e1faeb83000 (patch) | |
| tree | 5306431ce88fc574ff7117c2ea9bcf8321fbbce2 | |
| parent | be2856fc2280014d331d33a520cb5f3f3d909611 (diff) | |
evaluate: reject set in concatenation
Consider the following ruleset.
define ext_if = { "eth0", "eth1" }
table ip filter {
chain c {
iifname . tcp dport { $ext_if . 22 } accept
}
}
Attempting to load this ruleset results in:
BUG: invalid expression type 'set' in setnft: netlink.c:304: __netlink_gen_concat_key: Assertion `0' failed.
Aborted (core dumped)
After this patch:
# nft -f ruleset.nft
ruleset.nft:1:17-40: Error: cannot use set in concatenation
define ext_if = { "eth0", "eth1" }
^^^^^^^^^^^^^^^^^^
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1715
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| -rw-r--r-- | src/evaluate.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/src/evaluate.c b/src/evaluate.c index 2196e928..894987df 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1511,6 +1511,12 @@ static int expr_evaluate_concat(struct eval_ctx *ctx, struct expr **expr) if (list_member_evaluate(ctx, &i) < 0) return -1; + + if (i->etype == EXPR_SET) + return expr_error(ctx->msgs, i, + "cannot use %s in concatenation", + expr_name(i)); + flags &= i->flags; if (!key && i->dtype->type == TYPE_INTEGER) { |