netlink: reset temporary set element stmt list after list splice

Reset temporary stmt list to deal with the key_end case which might
result in a jump backward to handle the rhs of the interval.

Reported-by: Martin Zatloukal <slezi2@pvfree.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/netlink.c b/src/netlink.c
index 9a0d96f0b546751726034aca5a142df27d059531..28a5514ad873e6298a395892c0e0ccfd97f06f62 100644 (file)
--- a/src/netlink.c
+++ b/src/netlink.c
@@ -1324,7 +1324,7 @@ key_end:
                nftnl_set_elem_expr_foreach(nlse, set_elem_parse_expressions,
                                            &setelem_parse_ctx);
        }
-       list_splice_tail(&setelem_parse_ctx.stmt_list, &expr->stmt_list);
+       list_splice_tail_init(&setelem_parse_ctx.stmt_list, &expr->stmt_list);
 
        if (flags & NFT_SET_ELEM_INTERVAL_END) {
                expr->flags |= EXPR_F_INTERVAL_END;

diff --git a/tests/shell/testcases/maps/0013map_0 b/tests/shell/testcases/maps/0013map_0
new file mode 100755 (executable)
index 0000000..70d7fd3
--- /dev/null
+++ b/tests/shell/testcases/maps/0013map_0
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+set -e
+
+RULESET="
+flush ruleset
+
+add table ip filter
+add chain ip filter FORWARD { type filter hook forward priority 0; policy drop; }
+add map ip filter forwport { type ipv4_addr . inet_proto . inet_service: verdict; flags interval; counter; }
+add rule ip filter FORWARD iifname enp0s8 ip daddr . ip protocol  . th dport vmap @forwport counter
+add element ip filter forwport { 10.133.89.138 . tcp . 8081: accept }"
+
+$NFT -f - <<< "$RULESET"

diff --git a/tests/shell/testcases/maps/dumps/0013map_0.nft b/tests/shell/testcases/maps/dumps/0013map_0.nft
new file mode 100644 (file)
index 0000000..1455877
--- /dev/null
+++ b/tests/shell/testcases/maps/dumps/0013map_0.nft
@@ -0,0 +1,13 @@
+table ip filter {
+       map forwport {
+               type ipv4_addr . inet_proto . inet_service : verdict
+               flags interval
+               counter
+               elements = { 10.133.89.138 . tcp . 8081 counter packets 0 bytes 0 : accept }
+       }
+
+       chain FORWARD {
+               type filter hook forward priority filter; policy drop;
+               iifname "enp0s8" ip daddr . ip protocol . th dport vmap @forwport counter packets 0 bytes 0
+       }
+}