evaluate: bail out if ct saddr/daddr dependency cannot be inserted

commit 7f60519e356833ca007b138c00b9f5de09f21b56 upstream.

If we have an incomplete rule like "ct original saddr" in inet
family, this function generates an error because it can't determine the required protocol
dependency, hinting at missing ip/ip6 keyword.

We should not go on in this case to avoid a redundant followup error:

nft add rule inet f c ct original saddr 1.2.3.4
Error: cannot determine ip protocol version, use "ip saddr" or "ip6 saddr" instead
add rule inet f c ct original saddr 1.2.3.4
                  ^^^^^^^^^^^^^^^^^
Error: Could not parse symbolic invalid expression
add rule inet f c ct original saddr 1.2.3.4

After this change only the first error is shown.

Fixes: 2b29ea5f3c3e ("src: ct: add eval part to inject dependencies for ct saddr/daddr")
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/evaluate.c b/src/evaluate.c
index 641cd0d5bd02a8d176495d9345133bd5826ccd4a..72e1a0a9c513dc97c973f8294079c1d6ea4ddcb2 100644 (file)
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -1082,7 +1082,8 @@ static int expr_evaluate_ct(struct eval_ctx *ctx, struct expr **expr)
        switch (ct->ct.key) {
        case NFT_CT_SRC:
        case NFT_CT_DST:
-               ct_gen_nh_dependency(ctx, ct);
+               if (ct_gen_nh_dependency(ctx, ct) < 0)
+                       return -1;
                break;
        case NFT_CT_SRC_IP:
        case NFT_CT_DST_IP: