summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorArturo Borrero Gonzalez <arturo@debian.org>2017-05-26 13:00:21 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2017-05-29 12:59:40 +0200
commit986dea8a4a9d612a63508f628d342f70146ac6d0 (patch)
tree2354c0e69fd4d79af9d821eacb0e101650f2b6eb
parent6be8a855fc4abd32646dda879d10b9f7854863e7 (diff)
evaluate: avoid reference to multiple src data in statements which set values
Prevent this assert: % nft [..] tcp dport set { 0 , 1 } BUG: unknown expression type set reference nft: netlink_linearize.c:696: netlink_gen_expr: Assertion `0' failed. Aborted We can't use a set here because we will not known which value to use. With this patch, a proper error message is reported to users: % nft add rule t c tcp dport set {1, 2, 3, 4, 5} <cmdline>:1:28-42: Error: you cannot use a set here, unknown value to use add rule t c tcp dport set {1, 2, 3, 4, 5} ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^ % nft add rule t c tcp dport set @s <cmdline>:1:28-29: Error: you cannot reference a set here, unknown value to use add rule t c tcp dport set @s ~~~~~~~~~~~~~~^^ This error is reported to all statements which set values. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-rw-r--r--src/evaluate.c15
1 files changed, 15 insertions, 0 deletions
diff --git a/src/evaluate.c b/src/evaluate.c
index 27cee989..4ca14842 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -1759,6 +1759,21 @@ static int stmt_evaluate_arg(struct eval_ctx *ctx, struct stmt *stmt,
"datatype mismatch: expected %s, "
"expression has type %s",
dtype->desc, (*expr)->dtype->desc);
+
+ /* we are setting a value, we can't use a set */
+ switch ((*expr)->ops->type) {
+ case EXPR_SET:
+ return stmt_binary_error(ctx, *expr, stmt,
+ "you cannot use a set here, unknown "
+ "value to use");
+ case EXPR_SET_REF:
+ return stmt_binary_error(ctx, *expr, stmt,
+ "you cannot reference a set here, "
+ "unknown value to use");
+ default:
+ break;
+ }
+
return 0;
}