| Message ID | 20231025141210.124123-1-pablo@netfilter.org |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [nft] evaluate: reject set in concatenation | expand |
diff --git a/src/evaluate.c b/src/evaluate.c index 2196e92813d0..894987df7895 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1511,6 +1511,12 @@ static int expr_evaluate_concat(struct eval_ctx *ctx, struct expr **expr) if (list_member_evaluate(ctx, &i) < 0) return -1; + + if (i->etype == EXPR_SET) + return expr_error(ctx->msgs, i, + "cannot use %s in concatenation", + expr_name(i)); + flags &= i->flags; if (!key && i->dtype->type == TYPE_INTEGER) {
Consider the following ruleset. define ext_if = { "eth0", "eth1" } table ip filter { chain c { iifname . tcp dport { $ext_if . 22 } accept } } Attempting to load this ruleset results in: BUG: invalid expression type 'set' in setnft: netlink.c:304: __netlink_gen_concat_key: Assertion `0' failed. Aborted (core dumped) After this patch: # nft -f ruleset.nft ruleset.nft:1:17-40: Error: cannot use set in concatenation define ext_if = { "eth0", 127.0.0.0/24 } ^^^^^^^^^^^^^^^^^^^^^^^^ Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1715 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- src/evaluate.c | 6 ++++++ 1 file changed, 6 insertions(+)