]> git.ipfire.org Git - thirdparty/nftables.git/commit
evaluate: reset ctx->set after set interval evaluation
authorPablo Neira Ayuso <pablo@netfilter.org>
Wed, 1 Jun 2022 17:09:31 +0000 (19:09 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Wed, 1 Jun 2022 17:21:10 +0000 (19:21 +0200)
commit818f7dded9c9e8a89a2de98801425536180ae307
tree602ef65d5cd1b19e9b9777b9dbbd6c7acdacb0a5
parent3835de19fe5773baac5b79f35484d0f0e99bcfe1
evaluate: reset ctx->set after set interval evaluation

Otherwise bogus error reports on set datatype mismatch might occur, such as:

Error: datatype mismatch, expected Internet protocol, expression has type IPv4 address
    meta l4proto { tcp, udp } th dport 443 dnat to 10.0.0.1
    ~~~~~~~~~~~~ ^^^^^^^^^^^^

with an unrelated set declaration.

table ip test {
       set set_with_interval {
               type ipv4_addr
               flags interval
       }

       chain prerouting {
               type nat hook prerouting priority dstnat; policy accept;
               meta l4proto { tcp, udp } th dport 443 dnat to 10.0.0.1
       }
}

This bug has been introduced in the evaluation step.

Reported-by: Roman Petrov <nwhisper@gmail.com>
Fixes: 81e36530fcac ("src: replace interval segment tree overlap and automerge)"
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
src/evaluate.c
tests/shell/testcases/sets/dumps/set_eval_0.nft [new file with mode: 0644]
tests/shell/testcases/sets/set_eval_0 [new file with mode: 0755]