From f470e181d8c6280ca031cfd9ee1ab52a2b21c93a Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Thu, 22 Dec 2022 12:49:59 +0100 Subject: ct: use inet_service_type for proto-src and proto-dst Instead of using the invalid type. Problem was uncovered by this ruleset: table ip foo { map pinned { typeof ip daddr . ct original proto-dst : ip daddr . tcp dport size 65535 flags dynamic,timeout timeout 6m } chain pr { meta l4proto tcp update @pinned { ip saddr . ct original proto-dst timeout 1m30s : ip daddr . tcp dport } } } resulting in the following misleading error: map-broken.nft:10:51-82: Error: datatype mismatch: expected concatenation of (IPv4 address), expression has type concatenation of (IPv4 address, internet network service) meta l4proto tcp update @pinned { ip saddr . ct original proto-dst timeout 1m30s : ip daddr . tcp dport } ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: Pablo Neira Ayuso --- tests/shell/testcases/maps/dumps/typeof_maps_concat_update_0.nft | 1 + tests/shell/testcases/maps/typeof_maps_concat_update_0 | 1 + 2 files changed, 2 insertions(+) (limited to 'tests') diff --git a/tests/shell/testcases/maps/dumps/typeof_maps_concat_update_0.nft b/tests/shell/testcases/maps/dumps/typeof_maps_concat_update_0.nft index a2c3c139..f8b574f4 100644 --- a/tests/shell/testcases/maps/dumps/typeof_maps_concat_update_0.nft +++ b/tests/shell/testcases/maps/dumps/typeof_maps_concat_update_0.nft @@ -8,5 +8,6 @@ table ip foo { chain pr { update @pinned { ip saddr . ct original proto-dst timeout 1m30s : ip daddr . tcp dport } + update @pinned { ip saddr . ct original proto-dst timeout 1m30s : ip daddr . tcp dport } } } diff --git a/tests/shell/testcases/maps/typeof_maps_concat_update_0 b/tests/shell/testcases/maps/typeof_maps_concat_update_0 index e996f14e..2a52ea0e 100755 --- a/tests/shell/testcases/maps/typeof_maps_concat_update_0 +++ b/tests/shell/testcases/maps/typeof_maps_concat_update_0 @@ -11,6 +11,7 @@ EXPECTED="table ip foo { } chain pr { update @pinned { ip saddr . ct original proto-dst timeout 1m30s : ip daddr . tcp dport } + meta l4proto tcp update @pinned { ip saddr . ct original proto-dst timeout 1m30s : ip daddr . tcp dport } } }" -- cgit v1.2.3