From bada2f9c182dddf72a6d3b7b00c9eace7eb596c3 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Sun, 18 Jun 2017 13:08:36 +0200 Subject: evaluate: merge nested set flags A set may contain a nested set element definition, merge the nested set flags so we don't hit: BUG: invalid data expression type range nft: netlink.c:400: netlink_gen_data: Assertion `0' failed. Aborted With the following example ruleset: define dnat_ports = { 1234-1567 } define port_allow = { 53, # dns $dnat_ports, # dnat } add rule x y tcp dport $port_allow accept Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1145 Fixes: a6b75b837f5e ("evaluate: set: Allow for set elems to be sets") Signed-off-by: Pablo Neira Ayuso --- src/evaluate.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/evaluate.c b/src/evaluate.c index cee99272..ec898033 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1150,6 +1150,7 @@ static int expr_evaluate_set(struct eval_ctx *ctx, struct expr **expr) i->key->ops->type == EXPR_SET) { struct expr *new = expr_clone(i->key); + set->set_flags |= i->key->set_flags; list_replace(&i->list, &new->list); expr_free(i); i = new; -- cgit v1.2.3