evaluate: disallow negation with binary operation

The negation was introduced to provide a simple shortcut. Extend
e6c32b2fa0b8 ("src: add negation match on singleton bitmask value") to
disallow negation with binary operations too.

 # nft add rule meh tcp_flags 'tcp flags & (fin | syn | rst | ack) ! syn'
 Error: cannot combine negation with binary expression
 add rule meh tcp_flags tcp flags & (fin | syn | rst | ack) ! syn
                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^   ~~~

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/evaluate.c b/src/evaluate.c
index 4609576b2a6188f93917eb55d6e001b1ec4470de..8b5f51cee01ce459f44af3bbe72aa90f7791f4b5 100644 (file)
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -2016,12 +2016,16 @@ static int expr_evaluate_relational(struct eval_ctx *ctx, struct expr **expr)
                /* fall through */
        case OP_NEQ:
        case OP_NEG:
-               if (rel->op == OP_NEG &&
-                   (right->etype != EXPR_VALUE ||
-                    right->dtype->basetype == NULL ||
-                    right->dtype->basetype->type != TYPE_BITMASK))
-                       return expr_binary_error(ctx->msgs, left, right,
-                                                "negation can only be used with singleton bitmask values");
+               if (rel->op == OP_NEG) {
+                       if (left->etype == EXPR_BINOP)
+                               return expr_binary_error(ctx->msgs, left, right,
+                                                        "cannot combine negation with binary expression");
+                       if (right->etype != EXPR_VALUE ||
+                           right->dtype->basetype == NULL ||
+                           right->dtype->basetype->type != TYPE_BITMASK)
+                               return expr_binary_error(ctx->msgs, left, right,
+                                                        "negation can only be used with singleton bitmask values");
+               }
 
                switch (right->etype) {
                case EXPR_RANGE:

diff --git a/tests/py/inet/tcp.t b/tests/py/inet/tcp.t
index 983564ec5b751d2d3a5c59774e43cc9b1b5475ef..13b84215bd863ab17f6c0aceb4f52e3380dcf495 100644 (file)
--- a/tests/py/inet/tcp.t
+++ b/tests/py/inet/tcp.t
@@ -75,6 +75,7 @@ tcp flags & (fin | syn | rst | psh | ack | urg | ecn | cwr) == fin | syn | rst |
 tcp flags { syn, syn | ack };ok
 tcp flags & (fin | syn | rst | psh | ack | urg) == { fin, ack, psh | ack, fin | psh | ack };ok
 tcp flags ! fin,rst;ok
+tcp flags & (fin | syn | rst | ack) ! syn;fail
 
 tcp window 22222;ok
 tcp window 22;ok